Republished vendor advisory. This ICSA is a verbatim republication of Siemens ProductCERT SSA-355557 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA…
General Recommendations: As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-47685 | CWE-908 Use of Uninitialized Resource | 9.1 Critical |
CVE-2024-47685 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core ---truncated--- Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46738 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2024-46738 VMCI: use-after-free when removing resource in vmci_resource_remove(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46740 | CWE-20 Improper Input Validation | 7.8 High |
CVE-2024-46740 binder: UAF caused by offsets overwrite. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47696 | CWE-416 Use After Free | 7.8 High |
CVE-2024-47696 In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq. But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM. Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47701 | CWE-416 Use After Free | 7.8 High |
CVE-2024-47701 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49889 | CWE-416 Use After Free | 7.8 High |
CVE-2024-49889 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows: ext4_split_extent path = *ppath; ext4_split_extent_at(ppath) path = ext4_find_extent(ppath) ext4_split_extent_at(ppath) // ext4_find_extent fails to free path // but zeroout succeeds ext4_ext_show_leaf(inode, path) eh = path[depth].p_hdr // path use-after-free !!! Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way. Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly. This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49982 | CWE-416 Use After Free | 7.8 High |
CVE-2024-49982 In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53061 | CWE-191 Integer Underflow (Wrap or Wraparound) | 7.8 High |
CVE-2024-53061 media: s5p-jpeg: vulnerability due to the possibility of buffer overflows when the variable word is less than 2, which is prevented by adding extra checks. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53165 | CWE-416 Use After Free | 7.8 High |
CVE-2024-53165 In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let's only add it to the list after everything has succeeded. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53214 | CWE-125 Out-of-bounds Read | 7.8 High |
CVE-2024-53214 vfio/pci: out-of-bounds access to ecap_perms array. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56600 | CWE-416 Use After Free | 7.8 High |
CVE-2024-56600 net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56601 | CWE-416 Use After Free | 7.8 High |
CVE-2024-56601 In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56606 | CWE-416 Use After Free | 7.8 High |
CVE-2024-56606 af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56650 | CWE-125 Out-of-bounds Read | 7.8 High |
CVE-2024-56650 In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-57951 | CWE-416 Use After Free | 7.8 High |
CVE-2024-57951 In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back to CPUHP_ONLINE: Since hrtimers_prepare_cpu() does not run, cpu_base.hres_active remains set to 1 throughout. However, during a CPU unplug operation, the tick and the clockevents are shut down at CPUHP_AP_TICK_DYING. On return to the online state, for instance CFS incorrectly assumes that the hrtick is already active, and the chance of the clockevent device to transition to oneshot mode is also lost forever for the CPU, unless it goes back to a lower state than CPUHP_HRTIMERS_PREPARE once. This round-trip reveals another issue; cpu_base.online is not set to 1 after the transition, which appears as a WARN_ON_ONCE in enqueue_hrtimer(). Aside of that, the bulk of the per CPU state is not reset either, which means there are dangling pointers in the worst case. Address this by adding a corresponding startup() callback, which resets the stale per CPU state and sets the online flag. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2025-21692 | CWE-129 Improper Validation of Array Index | 7.8 High |
CVE-2025-21692 net: sched: fix ets qdisc OOB Indexing Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-6197 | CWE-590 Free of Memory not on the Heap | 7.5 High |
CVE-2024-6197 libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-8176 | CWE-674 Uncontrolled Recursion | 7.5 High |
CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-44999 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-44999 gtp: missing network headers in gtp_dev_xmit(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46743 | CWE-125 Out-of-bounds Read | 7.1 High |
CVE-2024-46743 In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47663 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-47663 staging: iio: frequency: ad9834: In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50033 | CWE-908 Use of Uninitialized Resource | 7.1 High |
CVE-2024-50033 In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455 ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline] ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212 ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50035 | CWE-908 Use of Uninitialized Resource | 7.1 High |
CVE-2024-50035 In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_encode() is called with an empty skb. BUG: KMSAN: uninit-value in ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] BUG: KMSAN: uninit-value in ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_encode drivers/net/ppp/ppp_async.c:545 [inline] ppp_async_push+0xb4f/0x2660 drivers/net/ppp/ppp_async.c:675 ppp_async_send+0x130/0x1b0 drivers/net/ppp/ppp_async.c:634 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2280 [inline] ppp_input+0x1f1/0xe60 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4092 [inline] slab_alloc_node mm/slub.c:4135 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4187 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 1 UID: 0 PID: 5411 Comm: syz.1.14 Not tainted 6.12.0-rc1-syzkaller-00165-g360c1f1f24c6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50059 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-50059 ntb: ntb_hw_switchtec: use after free vulnerability in switchtec_ntb_remove due to race condition. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50278 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-50278 dm cache: potential out-of-bounds access on the first resume Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50301 | CWE-125 Out-of-bounds Read | 7.1 High |
CVE-2024-50301 In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56642 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-56642 tipc: vulnerability in TIPC (Transparent Inter-Process Communication) involves a use-after-free issue with the UDP kernel socket in cleanup_bearer(), caused by premature reference count decrements, which is resolved by moving the decrement after releasing the socket. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56662 | CWE-20 Improper Input Validation | 7.1 High |
CVE-2024-56662 acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53148 | CWE-20 Improper Input Validation | 7.0 High |
CVE-2024-53148 comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buffer reference with comedi_buf_map_put(bm). The userspace mappings are only cleaned up later in the mmap error path. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53173 | CWE-20 Improper Input Validation | 7.0 High |
CVE-2024-53173 NFSv4.0: When two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47748 | CWE-416 Use After Free | 6.7 Medium |
CVE-2024-47748 vhost_vdpa: assign irq bypass producer token correctly. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46745 | CWE-400 Uncontrolled Resource Consumption | 6.5 Medium |
CVE-2024-46745 In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-9681 | CWE-697 Incorrect Comparison | 6.5 Medium |
CVE-2024-9681 When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects curl using applications that enable HSTS and use URLs with the insecure `HTTP://` scheme and perform transfers with hosts like `x.example.com` as well as `example.com` where the first host is a subdomain of the second host. (The HSTS cache either needs to have been populated manually or there needs to have been previous HTTPS accesses done as the cache needs to have entries for the domains involved to trigger this problem.) When `x.example.com` responds with `Strict-Transport-Security:` headers, this bug can make the subdomain's expiry timeout *bleed over* and get set for the parent domain `example.com` in curl's HSTS cache. The result of a triggered bug is that HTTP accesses to `example.com` get converted to HTTPS for a different period of time than what was asked for by the origin server. If `example.com` for example stops supporting HTTPS at its expiry time, curl might then fail to access `http://example.com` until the (wrongly set) timeout expires. This bug can also expire the parent's entry *earlier*, thus making curl inadvertently switch back to insecure HTTP earlier than otherwise intended. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50040 | CWE-390 Detection of Error Condition Without Action | 6.2 Medium |
CVE-2024-50040 In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53158 | CWE-20 Improper Input Validation | 6.1 Medium |
CVE-2024-53158 soc: qcom: geni-se: array underflow in geni_se_clk_tbl_get() This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53161 | CWE-190 Integer Overflow or Wraparound | 6.1 Medium |
CVE-2024-53161 EDAC/bluefield: potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2022-49034 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2022-49034 sh: cpuinfo: warning for CONFIG_CPUMASK_OFFSTACK. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning when showing /proc/cpuinfo. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-43098 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-43098 i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock. A deadlock may happen since the i3c_master_register() acquires i3cbus->lock twice. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-44987 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-44987 In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-44989 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-44989 In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-44990 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-44990 In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-44995 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-44995 net: hns3: a deadlock problem when config TC during resetting. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-45003 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-45003 vfs: Some filesystems(eg. ext4 with ea_inode feature, ubifs with xattr) may do inode lookup in the inode evicting callback function, if the inode lookup is operated under the inode lru traversing context, deadlock problems may happen. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-45006 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-45006 xhci: Panther point NULL pointer deref at full-speed re-enumeration. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-45008 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-45008 Input: missing limit on max slots results in too large allocation at input_mt_init_slots(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-45021 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-45021 memcg_write_event_control(): a user-triggerable oops. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-45025 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-45025 bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE copy_fd_bitmaps. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46674 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-46674 usb: dwc3: st: fix probed platform device ref count on probe error path. The probe function never performs any paltform device allocation, thus error path "undo_platform_dev_alloc" is entirely bogus. It drops the reference count from the platform device being probed. If error path is triggered, this will lead to unbalanced device reference counts and premature release of device resources, thus possible use-after-free when releasing remaining devm-managed resources. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46675 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46675 usb: dwc3: core: A vulnerability where the USB core could access an invalid event buffer address during runtime suspend, potentially causing SMMU faults and other memory issues in Exynos platforms. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46676 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46676 nfc: pn533: Add poll mod list filling check. In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46677 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-46677 gtp: fix NULL pointer dereference. When sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers thus miss the NULL pointer case. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46679 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 5.5 Medium |
CVE-2024-46679 In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46685 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-46685 pinctrl: single: fix NULL dereference in pcs_get_function(). pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46689 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46689 soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache eviction as "write" into the write protected region leading to secure interrupt which causes an endless loop somewhere in Trust Zone. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46713 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46713 perf/aux: AUX buffer serialization. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46719 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46719 usb: typec: ucsi: Fix null pointer dereference in trace ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46721 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46721 apparmor: fix possible NULL pointer dereference. profile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made from __create_missing_ancestors(..) and 'ent->old' is NULL in aa_replace_profiles(..). In that case, it must return an error code and the code, -ENOENT represents its state that the path of its parent is not existed yet. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46737 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46737 nvmet-tcp: kernel crash if commands allocation fails. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46739 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46739 uio_hv_generic: kernel NULL pointer dereference in hv_uio_rescind. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46744 | CWE-908 Use of Uninitialized Resource | 5.5 Medium |
CVE-2024-46744 In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46750 | CWE-413 Improper Resource Locking | 5.5 Medium |
CVE-2024-46750 In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46759 | CWE-124 Buffer Underwrite ('Buffer Underflow') | 5.5 Medium |
CVE-2024-46759 In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46761 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46761 pci/hotplug/pnv_php: hotplug driver crash on Powernv. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46763 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46763 fou: null-ptr-deref in GRO. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46771 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46771 can: bcm: Remove proc entry when dev is unregistered. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46777 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46777 udf: Avoid excessive partition lengths Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46782 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46782 ila: call nf_unregister_net_hooks() use-after-free Read in ila_nf_input. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46783 | CWE-229 Improper Handling of Values | 5.5 Medium |
CVE-2024-46783 In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46791 | CWE-667 Improper Locking | 5.5 Medium |
CVE-2024-46791 can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open The mcp251x_hw_wake() function is called with the mpc_lock mutex held and disables the interrupt handler so that no interrupts can be processed while waking the device. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46798 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46798 ASoC: dapm: vulnerability is an use-after-free bug where snd_pcm_suspend_all() accessed a freed snd_soc_pcm_runtime object during system suspension, detected with KASAN configurations. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46800 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46800 sch/netem: use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46828 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46828 sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46829 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46829 rtmutex: Drop rt_mutex::wait_lock before scheduling. rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-46844 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-46844 um: line: always fill *error_out in setup_one_line() The pointer isn't initialized by callers, but I have encountered cases where it's still printed; initialize it in all possible cases in setup_one_line(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47143 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47143 dma-debug: possible deadlock on radix_lock. radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is called holding rq_lock(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47659 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47659 smack: tcp: vulnerability in Smack’s TCP/IPv4 labeling allows packets to be incorrectly labeled, enabling unauthorized data writing from one label to another. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47660 | CWE-413 Improper Resource Locking | 5.5 Medium |
CVE-2024-47660 In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant amount of time. Since the bulk of this function happens under inode->i_lock this causes a significant contention on the lock when we remove the watch from the directory as the __fsnotify_update_child_dentry_flags() call from fsnotify_recalc_mask() races with __fsnotify_update_child_dentry_flags() calls from __fsnotify_parent() happening on children. This can lead upto softlockup reports reported by users. Fix the problem by calling fsnotify_update_children_dentry_flags() to set PARENT_WATCHED flags only when parent starts watching children. When parent stops watching children, clear false positive PARENT_WATCHED flags lazily in __fsnotify_parent() for each accessed child. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47667 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47667 PCI: keystone: Missing workaround for Errata #i2037 (AM65x SR 1.0). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47668 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47668 lib/generic-radix-tree.c: race in __genradix_ptr_alloc(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47679 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47679 vfs: race between evice_inodes() and find_inode()&iput(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47684 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-47684 In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases: Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_even ---truncated--- Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47705 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-47705 In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blk_add_partition The blk_add_partition() function initially used a single if-condition (IS_ERR(part)) to check for errors when adding a partition. This was modified to handle the specific case of -ENXIO separately, allowing the function to proceed without logging the error in this case. However, this change unintentionally left a path where md_autodetect_dev() could be called without confirming that part is a valid pointer. This commit separates the error handling logic by splitting the initial if-condition, improving code readability and handling specific error scenarios explicitly. The function now distinguishes the general error case from -ENXIO without altering the existing behavior of md_autodetect_dev() calls. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47706 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-47706 In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible UAF for bfqq->bic with merge chain In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1. Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ---truncated--- Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47709 | CWE-825 Expired Pointer Dereference | 5.5 Medium |
CVE-2024-47709 can: bcm: A warning is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered. However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47710 | CWE-400 Uncontrolled Resource Consumption | 5.5 Medium |
CVE-2024-47710 sock_map: vulnerability result of adding a cond_resched() in sock_hash_free() to prevent CPU soft lockups when destroying maps with a large number of buckets. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47735 | CWE-667 Improper Locking | 5.5 Medium |
CVE-2024-47735 RDMA/hns: missuse of spin_lock_irq()/spin_unlock_irq() when spin_lock_irqsave()/spin_lock_irqrestore() was hold. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47739 | CWE-190 Integer Overflow or Wraparound | 5.5 Medium |
CVE-2024-47739 padata: missing integer wrap around can cause deadlock on seq_nr overflow. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47740 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-47740 Inf2fs: Require FMODE_WRITE for atomic write ioctls. The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47742 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 5.5 Medium |
CVE-2024-47742 firmware_loader: Block path traversal Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such. However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47747 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-47747 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition. In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47749 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-47749 RDMA/cxgb4: Added NULL check for lookup_atid. The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the `act_establish()` and `act_open_rpl()` functions. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-47756 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-47756 PCI: keystone: Fix if-statement expression in ks_pcie_quirk(). This code accidentally uses && where || was intended. It potentially results in a NULL dereference. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-48881 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-48881 bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49851 | CWE-459 Incomplete Cleanup | 5.5 Medium |
CVE-2024-49851 tpm: Clean up TPM space after command failure tpm_dev_transmit prepares the TPM space before attempting command transmission. However if the command fails no rollback of this preparation is done. This can result in transient handles being leaked if the device is subsequently closed with no further commands performed. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49858 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49858 efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table. The use of EFI_LOADER_DATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kexec, which is therefore unaware that the region should be reserved. Even though the utility of the TPM2 event log after a kexec is questionable, any corruption might send the parsing code off into the weeds and crash the kernel. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49860 | CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') | 5.5 Medium |
CVE-2024-49860 CPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49878 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49878 resource: Because drivers/dax/kmem.c calls add_memory_driver_managed() during onlining CXL memory, which makes "System RAM (kmem)" a descendant of "CXL Window X". This confuses region_intersects(), which expects all "System RAM" resources to be at the top level of iomem_resource. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49881 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-49881 In the Linux kernel, the following vulnerability has been resolved: ext4: update orig_path in ext4_find_extent(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49882 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49882 ext4: In ext4_ext_try_to_merge_up(), path[1].p_bh should be set to NULL after it has been released, otherwise it may be released twice. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49883 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49883 ext4: In ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), the stale path will be used and cause use-after-free. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49884 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-49884 In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49924 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49924 fbdev: pxafb:use after free in pxafb_task(). In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49933 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49933 blk_iocost: fix more out of bound shifts. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49936 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-49936 net/xen-netback: prevent UAF in xenvif_flush_hash(). During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is called when the rcu grace period ends during the iteration, UAF occurs when accessing head->next after the entry becomes free. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49944 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-49944 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start. In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49948 | CWE-124 Buffer Underwrite ('Buffer Underflow') | 5.5 Medium |
CVE-2024-49948 In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49949 | CWE-124 Buffer Underwrite ('Buffer Underflow') | 5.5 Medium |
CVE-2024-49949 In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49952 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 5.5 Medium |
CVE-2024-49952 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49955 | CWE-672 Operation on a Resource after Expiration or Release | 5.5 Medium |
CVE-2024-49955 In the Linux kernel, the following vulnerability has been resolved: ACPI: battery: Fix possible crash when unregistering a battery hook When a battery hook returns an error when adding a new battery, then the battery hook is automatically unregistered. However the battery hook provider cannot know that, so it will later call battery_hook_unregister() on the already unregistered battery hook, resulting in a crash. Fix this by using the list head to mark already unregistered battery hooks as already being unregistered so that they can be ignored by battery_hook_unregister(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49959 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49959 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error In __jbd2_log_wait_for_space(), we might call jbd2_cleanup_journal_tail() to recover some journal space. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49962 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49962 ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49963 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49963 mailbox: bcm2835: timeout during suspend mode. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49975 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49975 uprobes: vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ permission. Additionally setting VM_EXEC produces the same page protection attributes (pgprot_t) as setting both VM_EXEC and VM_READ. Nevertheless, the debugger can read this memory. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49977 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49977 net: stmmac: port_transmit_rate_kbps could be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled. This leads to a zero-division error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49981 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49981 media: venus: A race condition may trigger a use after free vulnerability in venus_remove. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49983 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49983 ext4: When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49985 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-49985 i2c: stm32f7: In case there is any sort of clock controller attached to the I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-49997 | CWE-226 Sensitive Information in Resource Not Removed Before Reuse | 5.5 Medium |
CVE-2024-49997 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer. In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions. Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50001 | CWE-755 Improper Handling of Exceptional Conditions | 5.5 Medium |
CVE-2024-50001 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix error path in multi-packet WQE transmit Remove the erroneous unmap in case no DMA mapping was established The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can't allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq's FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state. The erroneous behavior was seen in a stress-test environment that created memory pressure. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50006 | CWE-833 Deadlock | 5.5 Medium |
CVE-2024-50006 In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50013 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50013 exfat: memory leak in exfat_load_bitmap() If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50015 | CWE-665 Improper Initialization | 5.5 Medium |
CVE-2024-50015 ext4: dax: Overflowing extents beyond inode size when partially writing. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50024 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50024 net: unsafe loop on the list. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50039 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-50039 In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backlog using qdisc_pkt_len(skb) on the assumption it is invariant between the enqueue() and dequeue() handlers. Unfortunately syzbot can crash a host rather easily using a TBF + SFQ combination, with an STAB on SFQ [1] We can't support TCA_STAB on arbitrary level, this would require to maintain per-qdisc storage. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50045 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-50045 In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50046 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-50046 In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() On the node of an NFS client, some files saved in the mountpoint of the NFS server were copied to another location of the same NFS server. Accidentally, the nfs42_complete_copies() got a NULL-pointer dereference crash. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50051 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50051 spi: mpc52xx: Add cancel_work_sync before module remove. If the module which will call mpc52xx_spi_remove is removed, it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50074 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50074 parport: The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50082 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50082 blk-rq-qos: vulnerability in blk-rq-qos can cause a crash due to a race condition between rq_qos_wait and rq_qos_wake_function, which is fixed by ensuring the waitqueue entry is accessed in the correct order. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50083 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50083 tcp: vulnerability in may cause DSS corruption due to large PMTU transmissions, which is fixed by addressing the issue in the __mptcp_move_skbs_from_subflow function. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50095 | CWE-667 Improper Locking | 5.5 Medium |
CVE-2024-50095 In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handler of mad agent acquires/releases mad_agent_priv lock for every timed out WRs. This causes heavy locking contention when higher no. of WRs are to be handled inside timeout handler. This leads to softlockup with below trace in some use cases where rdma-cm path is used to establish connection between peer nodes Simplified timeout handler by creating local list of timed out WRs and invoke send handler post creating the list. The new method acquires/releases lock once to fetch the list and hence helps to reduce locking contetiong when processing higher no. of WRs Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50179 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50179 ceph: incorrect Fw reference check when dirtying pages. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50180 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50180 fbdev: sisfb: Fix strbuf array overflow. The values of the variables xres and yres are placed in strbuf. These variables are obtained from strbuf1. The strbuf1 array contains digit characters and a space if the array contains non-digit characters. Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres); more than 16 bytes will be written to strbuf. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50184 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50184 virtio_pmem: Check device status before requesting flush. If a pmem device is in a bad status, the driver side could wait for host ack forever in virtio_pmem_flush(), causing the system to hang. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50185 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50185 linux: mptcp: handle consistently DSS corruption. Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50188 | CWE-787 Out-of-bounds Write | 5.5 Medium |
CVE-2024-50188 net: phy: dp83869: fix memory corruption when enabling fiber. When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50195 | CWE-754 Improper Check for Unusual or Exceptional Conditions | 5.5 Medium |
CVE-2024-50195 posix-clock: Fix missing timespec64 check in pc_clock_settime(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50198 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-50198 iio: light: veml6030: fix IIO device retrieval from embedded device. The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50199 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50199 mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a 1GB HugeTLB when calling swapoff. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50201 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50201 linux: drm/radeon: encoder->possible_clones. In the past nothing validated that drivers were populating possible_clones correctly, which resulted in some warnings during driver initialization. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50251 | CWE-131 Incorrect Calculation of Buffer Size | 5.5 Medium |
CVE-2024-50251 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50262 | CWE-787 Out-of-bounds Write | 5.5 Medium |
CVE-2024-50262 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50264 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50264 vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans. During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50267 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50267 USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50268 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50268 usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd(). The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50269 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-50269 usb: musb: sunxi: accessing an released usb phy will cause that usb phy @glue->xceiv is accessed after released. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50279 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50279 dm cache: out-of-bounds access to the dirty bitset when resizing dm-cache checks the dirty bits of the cache blocks to be dropped when shrinking the fast device, but an index bug in bitset iteration causes out-of-bounds access. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50287 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50287 media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50290 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50290 media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. Prevent that. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50292 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50292 ASoC: stm32: spdifrx: dma channel release in stm32_spdifrx_remove In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50295 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50295 net: arc: A warning is shown because ndev->dev and pdev->dev are not the same device. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50296 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50296 hns3: A kernel crash may occur when the driver is uninstalled and the VF is disabled concurrently. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50299 | CWE-131 Incorrect Calculation of Buffer Size | 5.5 Medium |
CVE-2024-50299 In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50304 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-50304 ipv4: ip_tunnel: Suspicious RCU usage warning in ip_tunnel_find(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-50602 | CWE-754 Improper Check for Unusual or Exceptional Conditions | 5.5 Medium |
CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-52332 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | 5.5 Medium |
CVE-2024-52332 igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier can be called when igb fails to install, resulting to invalid memory access. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53052 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53052 io_uring/rw: vulnerability due to io_uring not checking for IOCB_NOWAIT when starting an O_DIRECT write, leading to potential deadlocks if the mount point is being frozen. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53057 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-53057 In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53101 | CWE-456 Missing Initialization of a Variable | 5.5 Medium |
CVE-2024-53101 In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53103 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53103 hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer When hvs is released, there is a possibility that vsk->trans may not be initialized to NULL, which could lead to a dangling pointer. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53157 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53157 firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53171 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53171 ubifs: authentication: After an insertion in TNC, the tree might split and cause a node to change its `znode->parent`. A further deletion of other nodes in the tree (which also could free the nodes), the aforementioned node's `znode->cparent` could still point to a freed node. This `znode->cparent` may not be updated when getting nodes to commit in `ubifs_tnc_start_commit()`. This could then trigger a use-after-free when accessing the `znode->cparent` in `write_index()` in `ubifs_tnc_end_commit()`. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53172 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53172 ubi: fastmap: The duplicate slab cache names can be detected and a kernel WARNING is thrown out. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53174 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53174 SUNRPC: The function `c_show` was called with protection from RCU. This only ensures that `cp` will not be freed. Therefore, the reference count for `cp` can drop to zero, which will trigger a refcount use-after-free warning when `cache_get` is called. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53181 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53181 um: vector: The drvdata is not available in release Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53183 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53183 um: net: The drvdata is not available in release. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53184 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53184 um: ubd: The drvdata is not available in release. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53194 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-53194 PCI: vulnerability causes a use-after-free error during hot removal of a USB4 dock due to improper handling of pci_slot and pci_bus references, which is fixed by ensuring pci_slot acquires a reference to pci_bus. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53226 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2024-53226 RDMA/hns: vulnerability due to a potential NULL pointer dereference in hns_roce_map_mr_sg() because ib_map_mr_sg() allows upper layer protocols (ULPs) to specify NULL as the sg_offset argument, requiring the driver to check for NULL before dereferencing. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53680 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-53680 ipvs: vulnerability causes undefined behavior due to uninitialized stack access in ip_vs_protocol_init(), which is fixed by zeroing the on-stack buffer to prevent out-of-bound accesses. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56548 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56548 hfsplus: Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56567 | CWE-369 Divide By Zero | 5.5 Medium |
CVE-2024-56567 ad7780: division by zero in ad7780_write_raw() In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info's write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not specified to be non-zero. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56568 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56568 iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for client is called after the iommu_device_register() for smmu driver probe has executed but before the driver_bound() for smmu driver has been called. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56570 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56570 In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function.This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56572 | CWE-401 Missing Release of Memory after Effective Lifetime | 5.5 Medium |
CVE-2024-56572 media: platform: allegro-dvt: possible memory leak in allocate_buffers_internal(). If The buffer in the loop is not released under the exception path, it may lead to a memory leak. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56574 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56574 media: ts2020: null-ptr-deref in ts2020_probe(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56576 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56576 media: i2c: tc358743: crash in the probe error path when using polling. If an error occurs in the probe() function, the polling timer that was alarmed earlier should be removed, otherwise the timer is called with arguments that are already freed, which results in a crash. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56587 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56587 leds: class: Protect brightness_show() with led_cdev->led_access mutex. There is NULL pointer vulnerability observed if from Process A where hid device being added which results in adding a led_cdev addition and later a another call to access of led_cdev attribute from Process B can result in NULL pointer vulnerability. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56602 | CWE-416 Use After Free | 5.5 Medium |
CVE-2024-56602 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create(). sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56603 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56603 net: af_can: do not leave a dangling sk pointer in can_create(). On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56610 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56610 kcsan: Turn report_filterlist_lock into a raw_spinlock, with a KCSAN-enabled PREEMPT_RT kernel, we can see splats like sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56615 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56615 bpf: OOB devmap writes when deleting elements against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56633 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56633 tcp_bpf: The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller value apply_bytes. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56634 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56634 gpio: grgpio: vulnerability due to a missing NULL check in grgpio_probe for the return value of devm_kasprintf(), leading to a kernel NULL pointer dereference error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56637 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56637 netfilter: ipset: vulnerability involves a race condition where the ip_set.ko module can be unloaded by user space while it is requesting a set type backend module, potentially causing a kernel crash. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56643 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56643 dccp: vulnerability in DCCP (Datagram Congestion Control Protocol) involves a memory leak in dccp_feat_change_recv where memory allocated for a new SP feature value is not freed if dccp_feat_push_confirm() fails, leading to potential resource exhaustion. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56645 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56645 can: j1939: vulnerability involves a reference count underflow issue in j1939_session_new(), which is fixed by adding an extra skb_get() to match the behavior of j1939_session_skb_queue(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56648 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56648 net: hsr: avoid potential out-of-bound access in fill_frame_info(). By extending the check to cover packets with only 14 bytes, it prevents uninitialized values from causing undefined behavior or security issues. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56659 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56659 net: lapb: It is unclear if net/lapb code is supposed to be ready for 8021q, this may lead to crashes. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56661 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56661 tipc: NULL deref in cleanup_bearer(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56670 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56670 usb: gadget: u_serial: gs_start_io crashed due to accessing null pointer. Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Thread A is executing the open operation and calling the gs_open, Thread B is executing the disconnect operation and calling the gserial_disconnect function, the port->port_usb pointer will be set to NULL. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56681 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56681 crypto: bcm - add error check in the ahash_hmac_init function The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56688 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56688 sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56690 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56690 crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56691 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56691 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56698 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56698 usb: dwc3: gadget: looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queued_sgs no longer reflects the total number of num_queued_sgs (it would be cleared). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56700 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56700 media: wl128x: Atomicity violation occurs when the fmc_send_cmd() function is executed. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56705 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56705 media: atomisp: In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56720 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56720 bpf, sockmap: Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, it should put_page 2. if (len == 0), returning early is better 3. pop the entire sk_msg (last == msg->sg.size) should be supported 4. Fix for the value of variable "a" 5. In sk_msg_shift_left, after shifting, it has already pointed to the next element. Addtional sk_msg_iter_var_next may result in BUG. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56723 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56723 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices. While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) vulnerabilities. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56724 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56724 mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device. While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) vulnerability. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56728 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56728 octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c. Add error pointer check after calling otx2_mbox_get_rsp(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56739 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56739 rtc: check if __rtc_read_time was successful in rtc_timer_do_work() If the __rtc_read_time call fails, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56746 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56746 fbdev: sh7760fb: vulnerability involves a potential memory leak in sh7760fb_alloc_mem() where sh7760fb_free_mem() does not release memory correctly if info->screen_base is not ready, which is fixed by calling dma_free_coherent() instead. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56754 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56754 crypto: vulnerability due to passing an incorrect parameter type to devm_add_action_or_reset() in the CAAM driver, which is fixed by ensuring the correct parameter type is used to properly release resources. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56756 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2024-56756 nvme-pci: vulnerability involves an incorrect size being passed to dma_free_coherent in nvme-pci due to __nvme_alloc_host_mem potentially using fewer descriptors than planned, which is fixed by ensuring the correct size is used for freeing the HMB descriptor table. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56770 | CWE-670 Always-Incorrect Control Flow Implementation | 5.5 Medium |
CVE-2024-56770 net/sched: netem: The interface fully stops transferring packets and "locks". In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2025-21689 | CWE-476 NULL Pointer Dereference | 5.5 Medium |
CVE-2025-21689 In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newport > serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); break; } The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL: serial_priv->current_port = newport; port = serial->port[serial_priv->current_port]; The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2025-21699 | CWE-20 Improper Input Validation | 5.5 Medium |
CVE-2025-21699 In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space will either use buffer heads or iomap_folio_state structs, and we cannot mix the two. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2023-4039 | CWE-693 Protection Mechanism Failure | 4.8 Medium |
CVE-2023-4039 A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer overflow in dynamically-sized local variables in your application without this being detected. This stack-protector failure only applies to C99-style dynamically-sized local variables or those created using alloca(). The stack-protector operates as intended for statically-sized local variables. The default behavior when the stack-protector detects an overflow is to terminate your application, resulting in controlled loss of availability. An attacker who can exploit a buffer overflow without triggering the stack-protector might be able to change program flow control to cause an uncontrolled loss of availability or to go further and affect confidentiality or integrity. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56636 | CWE-241 Improper Handling of Unexpected Data Type | 4.7 Medium |
CVE-2024-56636 geneve: vulnerability in geneve_xmit_skb() arises from incorrectly assuming the MAC header is set in the output path, which can lead to errors. The fix involves using skb_eth_hdr() instead of eth_hdr() to ensure the MAC header is correctly referenced, preventing potential issues. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56644 | CWE-401 Missing Release of Memory after Effective Lifetime | 4.7 Medium |
CVE-2024-56644 In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception table. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56780 | CWE-833 Deadlock | 4.7 Medium |
CVE-2024-56780 quota: flush quota_release_work upon quota writeback One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53145 | CWE-190 Integer Overflow or Wraparound | 4.4 Medium |
CVE-2024-53145 um: potential integer overflow during physmem setup. This vulnerability happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56562 | CWE-20 Improper Input Validation | 4.4 Medium |
CVE-2024-56562 i3c: master: miss free init_dyn_addr at i3c_master_put_i3c_addrs(). Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-56569 | CWE-476 NULL Pointer Dereference | 4.4 Medium |
CVE-2024-56569 ftrace: Fix regression with module command in stack_trace_filter When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2025-21694 | CWE-667 Improper Locking | 4.1 Medium |
CVE-2025-21694 fs/proc: softlockup in __read_vmcore Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-7264 | CWE-125 Out-of-bounds Read | 3.7 Low |
CVE-2024-7264 libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-53097 | CWE-20 Improper Input Validation | 3.3 Low |
CVE-2024-53097 mm: krealloc: MTE false alarm in __do_krealloc. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2024-6874 | CWE-126 Buffer Over-read | 3.1 Low |
CVE-2024-6874 libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string. This flaw can lead to stack contents accidently getting returned as part of the converted string. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2023-52918 | CWE-20 Improper Input Validation | 0.0 None |
CVE-2023-52918 In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go to the error unwind if it is NULL. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2025-21687 | CWE-20 Improper Input Validation | 0.0 None |
CVE-2025-21687 In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device. Vendor fix: Update to V3.2 or later version ↗ Vendor fix: See Section Additional Information. Vendor fix: Update to V3.2 or later version Affected, fixed & timelineAffected:
|
| CVE-2021-47316 | CWE-20 Improper Input Validation | — |
CVE-2021-47316 nfsd: NULL dereference in nfs3svc_encode_getaclres. |
| CVE-2022-48666 | CWE-416 Use After Free | — |
CVE-2022-48666 scsi: core: use-after-free vulnerability. |
| CVE-2022-48827 | CWE-125 Out-of-bounds Read | — |
CVE-2022-48827 NFSD: vulnerability caused by loff_t overflow on the server when a client reads near the maximum offset, causing the server to return an EINVAL error, which the client retries indefinitely, instead of handling out-of-range READ requests by returning a short result with an EOF flag. |
| CVE-2022-48828 | CWE-20 Improper Input Validation | — |
CVE-2022-48828 NFSD: Vulnerability caused by an underflow in ia_size due to a mismatch between signed and unsigned 64-bit file size values, which can cause issues when handling large file sizes from NFS clients. |
| CVE-2022-48829 | CWE-253 Incorrect Check of Function Return Value | — |
CVE-2022-48829 NFSD: Vulnerability handling large file sizes for NFSv3 improperly capping client size values larger than s64_max, leading to unexpected behavior and potential data corruption. |
| CVE-2023-52887 | CWE-20 Improper Input Validation | — |
CVE-2023-52887 net: can: j1939: vulnerability related to error handling for closely received RTS messages in xtp_rx_rts_session_new, which is addressed by replacing less informative backtraces with a new method that provides clearer error messages and allows for early termination of problematic sessions. |
| CVE-2024-36484 | CWE-99 Improper Control of Resource Identifiers ('Resource Injection') | — |
CVE-2024-36484 In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. |
| CVE-2024-36894 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | — |
CVE-2024-36894 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete |
| CVE-2024-36901 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-36901 ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a chance that ip6_dst_idev() returns NULL in ip6_output(). |
| CVE-2024-36938 | CWE-20 Improper Input Validation | — |
CVE-2024-36938 Denial of Service Vulnerability in the Linux Kernel: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported. |
| CVE-2024-36974 | CWE-20 Improper Input Validation | — |
CVE-2024-36974 net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP. If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen. |
| CVE-2024-36978 | CWE-20 Improper Input Validation | — |
CVE-2024-36978 net: sched: sch_multiq: possible OOB write in multiq_tune() q->bands will be assigned to qopt->bands to execute subsequent code logic after kmalloc. So the old q->bands should not be used in kmalloc. Otherwise, an out-of-bounds write will occur. |
| CVE-2024-37078 | CWE-20 Improper Input Validation | — |
CVE-2024-37078 nilfs2: kernel vulnerability due to lack of writeback flag waiting. When the log writer starts a writeback for segment summary blocks or a super root block that use the backing devices page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. |
| CVE-2024-38586 | CWE-20 Improper Input Validation | — |
CVE-2024-38586 r8169: possible ring buffer corruption on fragmented Tx packets. Vulnerability on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into the transmit ring buffer, subsequently leading to calls to dma_unmap_single() with a null address. This was caused by rtl8169_start_xmit() not noticing changes to nr_frags which may occur when small packets are padded (to work around hardware quirks) in rtl8169_tso_csum_v2(). |
| CVE-2024-38619 | CWE-20 Improper Input Validation | — |
CVE-2024-38619 usb-storage: alauda: Check whether the media is initialized. The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). |
| CVE-2024-39468 | CWE-20 Improper Input Validation | — |
CVE-2024-39468 smb: client: Deadlock in smb2_find_smb_tcon(). |
| CVE-2024-39469 | CWE-1050 Excessive Platform Resource Consumption within a Loop | — |
CVE-2024-39469 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. |
| CVE-2024-39482 | CWE-20 Improper Input Validation | — |
CVE-2024-39482 bcache: Variable length array abuse in btree_iter. |
| CVE-2024-39484 | CWE-770 Allocation of Resources Without Limits or Throttling | — |
CVE-2024-39484 mmc: davinci: Vulnerability from resource leaks. Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. |
| CVE-2024-39487 | CWE-125 Out-of-bounds Read | — |
CVE-2024-39487 In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set(). |
| CVE-2024-39495 | CWE-416 Use After Free | — |
CVE-2024-39495 greybus: use-after-free vulnerability in gb_interface_release due to race condition. |
| CVE-2024-39499 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | — |
CVE-2024-39499 vmci: speculation leaks by sanitizing event in event_deliver(). event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization, leading to information leaks. |
| CVE-2024-39502 | CWE-416 Use After Free | — |
CVE-2024-39502 ionic: use after netif_napi_del(). When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). |
| CVE-2024-39503 | CWE-416 Use After Free | — |
CVE-2024-39503 netfilter: ipset: race between namespace cleanup and gc in the list:set type. The namespace cleanup can destroy the list:set type of sets while the gc of the set type is waiting to run in rcu cleanup. The latter uses data from the destroyed set which thus leads use after free. |
| CVE-2024-39505 | CWE-20 Improper Input Validation | — |
CVE-2024-39505 drm/komeda: check for error-valued pointer. komeda_pipeline_get_state() may return an error-valued pointer, thus check the pointer for negative or null value before dereferencing. |
| CVE-2024-39506 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-39506 liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet. In lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value, but then it is unconditionally passed to skb_add_rx_frag(), which could lead to null pointer dereference. |
| CVE-2024-39509 | CWE-20 Improper Input Validation | — |
CVE-2024-39509 HID: core: remove unnecessary WARN_ON() in implement(). There is a warning in a call to implement() when trying to write a value into a field of smaller size in an output report. Since implement() already has a warn message printed out with the help of hid_warn() and value in question gets trimmed with: ... value &= m; ... WARN_ON may be considered superfluous. |
| CVE-2024-40901 | CWE-125 Out-of-bounds Read | — |
CVE-2024-40901 In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory. |
| CVE-2024-40902 | CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | — |
CVE-2024-40902 jfs: xattr: buffer overflow for invalid xattr. When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size, printing it out can cause an access off the end of the buffer. |
| CVE-2024-40904 | CWE-20 Improper Input Validation | — |
CVE-2024-40904 USB: class: cdc-wdm: CPU lockup caused by excessive log messages. |
| CVE-2024-40905 | CWE-20 Improper Input Validation | — |
CVE-2024-40905 ipv6: possible race in __fib6_drop_pcpu_from(). |
| CVE-2024-40912 | CWE-20 Improper Input Validation | — |
CVE-2024-40912 wifi: mac80211: deadlock in ieee80211_sta_ps_deliver_wakeup(). |
| CVE-2024-40916 | CWE-20 Improper Input Validation | — |
CVE-2024-40916 drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. |
| CVE-2024-40929 | CWE-20 Improper Input Validation | — |
CVE-2024-40929 wifi: iwlwifi: mvm: check n_ssids before accessing the ssids.In some versions of cfg80211, the ssids poinet might be a valid one even though n_ssids is 0. Accessing the pointer in this case will cuase an out-of-bound access. |
| CVE-2024-40931 | CWE-20 Improper Input Validation | — |
CVE-2024-40931 mptcp: ensure snd_una is properly initialized on connect. |
| CVE-2024-40932 | CWE-20 Improper Input Validation | — |
CVE-2024-40932 drm/exynos/vidi: memory leak in .get_modes(). |
| CVE-2024-40934 | CWE-404 Improper Resource Shutdown or Release | — |
CVE-2024-40934 HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() Fix a memory leak on logi_dj_recv_send_report() error path. |
| CVE-2024-40941 | CWE-125 Out-of-bounds Read | — |
CVE-2024-40941 wifi: iwlwifi: mvm: don't read past the mfuart notifcation. In case the firmware sends a notification that claims it has more data than it has, it will read past that was allocated for the notification. |
| CVE-2024-40942 | CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak') | — |
CVE-2024-40942 wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. |
| CVE-2024-40943 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | — |
CVE-2024-40943 ocfs2: fix races between hole punching and AIO+DIO. |
| CVE-2024-40945 | CWE-393 Return of Wrong Status Code | — |
CVE-2024-40945 iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return value with IS_ERR(). This could potentially lead to a kernel NULL pointer dereference issue if the function returns NULL instead of an error pointer. In reality, this doesn't cause any problems because iommu_sva_bind_device() only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA. |
| CVE-2024-40947 | CWE-20 Improper Input Validation | — |
CVE-2024-40947 ima: Avoid blocking in RCU read-side critical section, a panic happens in ima_match_policy. |
| CVE-2024-40958 | CWE-416 Use After Free | — |
CVE-2024-40958 netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. |
| CVE-2024-40959 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-40959 In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr(). |
| CVE-2024-40960 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-40960 ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL dereference in rt6_probe() [1] Bail out if __in6_dev_get() returns NULL. |
| CVE-2024-40961 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-40961 ipv6: prevent possible NULL deref in fib6_nh_init() syzbot reminds us that in6_dev_get() can return NULL. |
| CVE-2024-40963 | CWE-20 Improper Input Validation | — |
CVE-2024-40963 mips: bmips: BCM6358: Some device have CBR address set to 0 causing kernel panic when arch_sync_dma_for_cpu_all is called. |
| CVE-2024-40968 | CWE-20 Improper Input Validation | — |
CVE-2024-40968 MIPS:The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it can generate kernel panic caused by "Data bus error". |
| CVE-2024-40971 | CWE-20 Improper Input Validation | — |
CVE-2024-40971 f2fs: remove clear SB_INLINECRYPT flag in default_options In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable. |
| CVE-2024-40974 | CWE-20 Improper Input Validation | — |
CVE-2024-40974 powerpc/pseries: stack corruption at runtime when plpar_hcall9() stores results past the end of the array. |
| CVE-2024-40976 | CWE-20 Improper Input Validation | — |
CVE-2024-40976 drm/lima: There is a race condition in which a rendering job might take just long enough to trigger the drm sched job timeout handler but also still complete before the hard reset is done by the timeout handler. This runs into race conditions not expected by the timeout handler. In some very specific cases it currently may result in a refcount imbalance on lima_pm_idle, with a stack dump. |
| CVE-2024-40978 | CWE-20 Improper Input Validation | — |
CVE-2024-40978 scsi: qedi: crash while reading debugfs attribute. The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly on a __user pointer, which results into the crash. |
| CVE-2024-40980 | CWE-20 Improper Input Validation | — |
CVE-2024-40980 drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat. |
| CVE-2024-40981 | CWE-20 Improper Input Validation | — |
CVE-2024-40981 batman-adv: empty buckets in batadv_purge_orig_ref() are pointing to soft lockups in batadv_purge_orig_ref(). |
| CVE-2024-40983 | CWE-20 Improper Input Validation | — |
CVE-2024-40983 tipc: possible crash before doing decryption. |
| CVE-2024-40984 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-40984 ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." |
| CVE-2024-40987 | CWE-20 Improper Input Validation | — |
CVE-2024-40987 drm/amdgpu: UBSAN warning in kv_dpm.c. |
| CVE-2024-40988 | CWE-20 Improper Input Validation | — |
CVE-2024-40988 drm/radeon: UBSAN warning in kv_dpm.c. |
| CVE-2024-40990 | CWE-20 Improper Input Validation | — |
CVE-2024-40990 ptp: integer overflow in max_vclocks_store. |
| CVE-2024-40995 | CWE-20 Improper Input Validation | — |
CVE-2024-40995 net/sched: act_api: possible infinite loop in tcf_idr_check_alloc(). |
| CVE-2024-41000 | CWE-190 Integer Overflow or Wraparound | — |
CVE-2024-41000 block/ioctl: prefer different overflow check Running syzkaller with the newly reintroduced signed integer overflow sanitizer. |
| CVE-2024-41004 | CWE-20 Improper Input Validation | — |
CVE-2024-41004 tracing: Build event generation tests only as modules The kprobes and synth event generation test modules add events and lock (get a reference) those event file reference in module init function, and unlock and delete it in module exit function. This is because those are designed for playing as modules. If we make those modules as built-in, those events are left locked in the kernel, and never be removed. |
| CVE-2024-41005 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | — |
CVE-2024-41005 netpoll: race condition in netpoll_owner_active KCSAN detected a race condition in netpoll. |
| CVE-2024-41006 | CWE-404 Improper Resource Shutdown or Release | — |
CVE-2024-41006 netrom: a memory leak in nr_heartbeat_expiry(). |
| CVE-2024-41007 | CWE-99 Improper Control of Resource Identifiers ('Resource Injection') | — |
CVE-2024-41007 tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT. |
| CVE-2024-41009 | CWE-770 Allocation of Resources Without Limits or Throttling | — |
CVE-2024-41009 bpf: Fix overrunning reservations in ringbuf. |
| CVE-2024-41012 | CWE-416 Use After Free | — |
CVE-2024-41012 filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). |
| CVE-2024-41015 | CWE-20 Improper Input Validation | — |
CVE-2024-41015 ocfs2: add bounds checking to ocfs2_check_dir_entry(). This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region. |
| CVE-2024-41017 | CWE-20 Improper Input Validation | — |
CVE-2024-41017 jfs: vulnerability involves the risk of accessing memory beyond the end of ealist, which can lead to undefined behavior or crashes. |
| CVE-2024-41020 | CWE-20 Improper Input Validation | — |
CVE-2024-41020 filelock: race condition vulnerability between fcntl and close operations, which can lead to issues in the recovery compatibility path. |
| CVE-2024-41022 | CWE-20 Improper Input Validation | — |
CVE-2024-41022 drm/amdgpu: vulnerability involves a signedness problem in sdma_v4_0_process_trap_irq(), which can lead to incorrect handling of values and potential errors. |
| CVE-2024-41034 | CWE-20 Improper Input Validation | — |
CVE-2024-41034 nilfs2: kernel bug on rename operation of broken directory. |
| CVE-2024-41035 | CWE-20 Improper Input Validation | — |
CVE-2024-41035 USB: core: duplicate endpoint bug. |
| CVE-2024-41040 | CWE-20 Improper Input Validation | — |
CVE-2024-41040 net/sched: UAF when resolving a clash. |
| CVE-2024-41041 | CWE-20 Improper Input Validation | — |
CVE-2024-41041 udp: small race window. |
| CVE-2024-41044 | CWE-20 Improper Input Validation | — |
CVE-2024-41044 ppp: claimed-as-LCP but actually malformed packets. |
| CVE-2024-41046 | CWE-415 Double Free | — |
CVE-2024-41046 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. |
| CVE-2024-41049 | CWE-416 Use After Free | — |
CVE-2024-41049 In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was added to the inode's list. However, before the tracepoint could fire, another task raced in and freed that lock. Fix this by moving the tracepoint inside the spinlock, which should ensure that this doesn't happen. |
| CVE-2024-41055 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-41055 In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it. |
| CVE-2024-41059 | CWE-20 Improper Input Validation | — |
CVE-2024-41059 hfsplus: uninit-value in copy_name. |
| CVE-2024-41063 | CWE-20 Improper Input Validation | — |
CVE-2024-41063 Bluetooth: hci_core: deadlock at destroy_workqueue(). |
| CVE-2024-41064 | CWE-20 Improper Input Validation | — |
CVE-2024-41064 powerpc/eeh: possible crash when edev->pdev changes. |
| CVE-2024-41065 | CWE-20 Improper Input Validation | — |
CVE-2024-41065 powerpc/pseries: Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG(). |
| CVE-2024-41068 | CWE-20 Improper Input Validation | — |
CVE-2024-41068 s390/sclp: sclp_init() failure. |
| CVE-2024-41070 | CWE-20 Improper Input Validation | — |
CVE-2024-41070 KVM: PPC: Book3S HV: UAF in kvm_spapr_tce_attach_iommu_group(). |
| CVE-2024-41072 | CWE-20 Improper Input Validation | — |
CVE-2024-41072 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise. |
| CVE-2024-41077 | CWE-20 Improper Input Validation | — |
CVE-2024-41077 null_blk: validation error on block size. |
| CVE-2024-41078 | CWE-20 Improper Input Validation | — |
CVE-2024-41078 btrfs: qgroup: quota root leak after quota disable failure. |
| CVE-2024-41081 | CWE-20 Improper Input Validation | — |
CVE-2024-41081 ila: block BH in ila_output(). |
| CVE-2024-41087 | CWE-20 Improper Input Validation | — |
CVE-2024-41087 ata: libata-core: double free on error. |
| CVE-2024-41089 | CWE-20 Improper Input Validation | — |
CVE-2024-41089 drm/nouveau/dispnv04: null pointer dereference in nv17_tv_get_hd_modes. |
| CVE-2024-41090 | CWE-20 Improper Input Validation | — |
CVE-2024-41090 tap: add missing verification for short frame. Missing to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. |
| CVE-2024-41091 | CWE-20 Improper Input Validation | — |
CVE-2024-41091 tun: add missing verification for short frame. Missing to check against the validity of the frame length in the tun_xdp_one() path could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either causeout-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. |
| CVE-2024-41092 | CWE-20 Improper Input Validation | — |
CVE-2024-41092 drm/i915/gt: potential UAF by revoke of fence registers. |
| CVE-2024-41095 | CWE-20 Improper Input Validation | — |
CVE-2024-41095 drm/nouveau/dispnv04: null pointer dereference in nv17_tv_get_ld_modes. |
| CVE-2024-41097 | CWE-20 Improper Input Validation | — |
CVE-2024-41097 usb: atm: cxacru: incomplete endpoint checking in cxacru_bind(). |
| CVE-2024-42076 | CWE-20 Improper Input Validation | — |
CVE-2024-42076 net: can: j1939: unused data in j1939_send_one(). |
| CVE-2024-42077 | CWE-20 Improper Input Validation | — |
CVE-2024-42077 ocfs2: DIO failure due to insufficient transaction credits. |
| CVE-2024-42082 | CWE-770 Allocation of Resources Without Limits or Throttling | — |
CVE-2024-42082 xdp: unused WARN() in __xdp_reg_mem_model(). |
| CVE-2024-42084 | CWE-20 Improper Input Validation | — |
CVE-2024-42084 ftruncate: passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. |
| CVE-2024-42086 | CWE-20 Improper Input Validation | — |
CVE-2024-42086 iio: chemical: bme680: overflows in compensate() functions. |
| CVE-2024-42087 | CWE-20 Improper Input Validation | — |
CVE-2024-42087 drm/panel: ilitek-ili9881c: warning with GPIO controllers. |
| CVE-2024-42092 | CWE-20 Improper Input Validation | — |
CVE-2024-42092 gpio: davinci: There can be out of chips->irqs array boundaries access in davinci_gpio_probe(). |
| CVE-2024-42093 | CWE-20 Improper Input Validation | — |
CVE-2024-42093 net/dpaa2: explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack can cause potential stack overflow. |
| CVE-2024-42094 | CWE-20 Improper Input Validation | — |
CVE-2024-42094 net/iucv: explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack can cause potential stack overflow. |
| CVE-2024-42095 | CWE-20 Improper Input Validation | — |
CVE-2024-42095 serial: 8250_omap: Erroneous timeout can be triggered, and it may lead to storm of interrupts. |
| CVE-2024-42101 | CWE-20 Improper Input Validation | — |
CVE-2024-42101 drm/nouveau: null pointer dereference in nouveau_connector_get_modes. |
| CVE-2024-42105 | CWE-20 Improper Input Validation | — |
CVE-2024-42105 nilfs2: use-after-free. |
| CVE-2024-42145 | CWE-20 Improper Input Validation | — |
CVE-2024-42145 IB/core: an unbounded UMAD receive list, poses a risk of uncontrolled growth. |
| CVE-2024-42148 | CWE-20 Improper Input Validation | — |
CVE-2024-42148 bnx2x: multiple UBSAN array-index-out-of-bounds. |
| CVE-2024-42152 | CWE-20 Improper Input Validation | — |
CVE-2024-42152 nvmet: possible leak when destroy a ctrl during qp establishment. |
| CVE-2024-42153 | CWE-20 Improper Input Validation | — |
CVE-2024-42153 i2c: pnx: potential deadlock warning from del_timer_sync() call in isr. |
| CVE-2024-42154 | CWE-805 Buffer Access with Incorrect Length Value | — |
CVE-2024-42154 In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). |
| CVE-2024-42161 | CWE-457 Use of Uninitialized Variable | — |
CVE-2024-42161 In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD. |
| CVE-2024-42223 | CWE-20 Improper Input Validation | — |
CVE-2024-42223 media: dvb-frontends: tda10048: integer overflow state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. |
| CVE-2024-42224 | CWE-20 Improper Input Validation | — |
CVE-2024-42224 net: dsa: mv88e6xxx: wrong check on empty list. |
| CVE-2024-42229 | CWE-20 Improper Input Validation | — |
CVE-2024-42229 crypto: aead,cipher - key buffer after use not zeroized. |
| CVE-2024-42232 | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | — |
CVE-2024-42232 libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in order to avoid interfering with the hunting interval logic. This part was missed in(libceph: behave in mon_fault() if cur_mon < ") and use-after-free can still ensue on monc and objects that hang off of it, with monc-> auth and monc->monmap being particularly susceptible to quickly being reused. |
| CVE-2024-42236 | CWE-20 Improper Input Validation | — |
CVE-2024-42236 usb: gadget: configfs: OOB read/write in usb_string_copy(). |
| CVE-2024-42244 | CWE-99 Improper Control of Resource Identifiers ('Resource Injection') | — |
CVE-2024-42244 USB: serial: mos7840: fix crash on resume Since("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic resume implementation when the driver has not provided one. This can trigger a crash on resume with mos7840 since support for multiple read URBs was added back in 2011. Specifically, both port read URBs are now submitted on resume for open ports, but the context pointer of the second URB is left set to the core rather than mos7840 port structure. |
| CVE-2024-42247 | CWE-20 Improper Input Validation | — |
CVE-2024-42247 wireguard: allowedips: unaligned 64-bit memory accesses. |
| CVE-2024-43861 | CWE-20 Improper Input Validation | — |
CVE-2024-43861 net: usb: qmi_wwan: memory leak for not ip packets. |
| CVE-2024-43867 | CWE-20 Improper Input Validation | — |
CVE-2024-43867 drm/nouveau: prime: refcount underflow. |
| CVE-2024-43871 | CWE-416 Use After Free | — |
CVE-2024-43871 In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed by using devres_release() instead of devres_destroy() within devm_free_percpu(). |
| CVE-2024-43879 | CWE-20 Improper Input Validation | — |
CVE-2024-43879 wifi: cfg80211: Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to warning. |
| CVE-2024-43880 | CWE-20 Improper Input Validation | — |
CVE-2024-43880 mlxsw: spectrum_acl_erp: object nesting warning. |
| CVE-2024-43882 | CWE-20 Improper Input Validation | — |
CVE-2024-43882 exec: the execution may gain unintended privileges. |
| CVE-2024-43883 | CWE-20 Improper Input Validation | — |
CVE-2024-43883 usb: vhci-hcd: vulnerability due to the vhci-hcd driver dropping references before new ones were gained, potentially leading to the use of stale pointers. |
| CVE-2024-43889 | CWE-20 Improper Input Validation | — |
CVE-2024-43889 padata: vulnerability due to a possible divide-by-zero error in padata_mt_helper() during bootup, caused by an uninitialized chunk_size being zero. |
| CVE-2024-43890 | CWE-20 Improper Input Validation | — |
CVE-2024-43890 tracing: vulnerability due to an overflow in get_free_elt(), which could lead to infinite loops and CPU hangs when the tracing map becomes full. |
| CVE-2024-43893 | CWE-20 Improper Input Validation | — |
CVE-2024-43893 serial: core: vulnerability due to a missing check for uartclk being zero, leading to a potential divide-by-zero error when calling ioctl TIOCSSERIAL with an invalid baud_base. |
| CVE-2024-43894 | CWE-20 Improper Input Validation | — |
CVE-2024-43894 drm/client: vulnerability due to a potential null pointer dereference in drm_client_modeset_probe() when drm_mode_duplicate() fails, which was fixed by adding a check. |
| CVE-2024-43907 | CWE-20 Improper Input Validation | — |
CVE-2024-43907 drm/amdgpu/pm: null pointer dereference in apply_state_adjust_rules. |
| CVE-2024-43908 | CWE-20 Improper Input Validation | — |
CVE-2024-43908 drm/amdgpu: null pointer dereference in ras_manager. |
| CVE-2024-43914 | CWE-20 Improper Input Validation | — |
CVE-2024-43914 md/raid5: BUG_ON() while continue reshape after reassembling. |
| CVE-2024-44935 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-44935 sctp: Fix null-ptr-deref in reuseport_add_sock(). A Null Pointer Dereference in reuseport_add_sock() while accessing sk2->sk_reuseport_cb . The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. The second listen() calls reuseport_add_sock() with the first listener as sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently, but the close() does clear it by reuseport_detach_sock(). |
| CVE-2024-44944 | CWE-401 Missing Release of Memory after Effective Lifetime | — |
CVE-2024-44944 In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace. |
| CVE-2024-44949 | CWE-20 Improper Input Validation | — |
CVE-2024-44949 parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is written using DMA and the other is written using cached write, the value that was written with DMA may be corrupted. |
| CVE-2024-44954 | CWE-20 Improper Input Validation | — |
CVE-2024-44954 ALSA: line6: vulnerability involved racy access to the midibuf in the ALSA line6 driver, which has been fixed by using a spinlock to prevent concurrent access issues. |
| CVE-2024-44960 | CWE-20 Improper Input Validation | — |
CVE-2024-44960 usb: gadget: core: Check for unset descriptor. It needs to be reassured that the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for the current speed, or the gadget descriptors are malformed and the descriptor for the speed/endpoint are not found. No current gadget driver is known to have this problem, but this may cause a hard-to-find bug during development of new gadgets. |
| CVE-2024-44965 | CWE-229 Improper Handling of Values | — |
CVE-2024-44965 In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack guard. It turned out that pti_clone_pgtable() had alignment assumptions on the start address, notably it hard assumes start is PMD aligned. This is true on x86_64, but very much not true on i386. These assumptions can cause the end condition to malfunction, leading to a 'short' clone. Guess what happens when the user mapping has a short copy of the entry text? Use the correct increment form for addr to avoid alignment assumptions. |
| CVE-2024-44969 | CWE-20 Improper Input Validation | — |
CVE-2024-44969 s390/sclp: vulnerability could lead to data corruption if a Store Data operation is interrupted and the halt attempt fails, which was resolved by preventing the release of data buffers in such cases. |
| CVE-2024-44971 | CWE-401 Missing Release of Memory after Effective Lifetime | — |
CVE-2024-44971 net: dsa: bcm_sf2: vulnerability caused a memory leak by not decrementing the reference count after finding and removing PHY devices, which has been fixed by adding a call to phy_device_free() to balance the reference count. |
| CVE-2024-44988 | CWE-20 Improper Input Validation | — |
CVE-2024-44988 net: dsa: mv88e6xxx: vulnerability caused an out-of-bound access in the mv88e6xxx driver due to an ATU violation causing the SPID to exceed DSA_MAX_PORTS, which was resolved by ensuring the SPID stays within the valid range. |
| CVE-2024-44998 | CWE-20 Improper Input Validation | — |
CVE-2024-44998 atm: idt77252: use after free in dequeue_rx(). |
| CVE-2024-46673 | CWE-415 Double Free | — |
CVE-2024-46673 scsi: aacraid: Fix double-free on probe failure. aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_init_adapter(). If aac_init_adapter() fails after allocating memory for aac_dev::queues, it frees the memory but does not clear that member. After the hardware-specific init function returns an error, aac_probe_one() goes down an error path that frees the memory pointed to by aac_dev::queues, resulting in a double-free. |
| CVE-2024-46702 | CWE-20 Improper Input Validation | — |
CVE-2024-46702 thunderbolt: Mark XDomain as unplugged when router is removed. |
| CVE-2024-46707 | CWE-20 Improper Input Validation | — |
CVE-2024-46707 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICC_*SGI*_EL1 registers is trapped to EL2. |
| CVE-2024-46714 | CWE-20 Improper Input Validation | — |
CVE-2024-46714 drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Callers can pass null in filter (i.e. from returned from the function wbscl_get_filter_coeffs_16p) and a null check is added to ensure that is not the case. |
| CVE-2024-46722 | CWE-20 Improper Input Validation | — |
CVE-2024-46722 drm/amdgpu: vulnerability due to an out-of-bounds read warning when accessing mc_data[i-1]. |
| CVE-2024-46723 | CWE-20 Improper Input Validation | — |
CVE-2024-46723 drm/amdgpu: vulnerability due to an out-of-bounds read warning when accessing ucode[]. |
| CVE-2024-46724 | CWE-20 Improper Input Validation | — |
CVE-2024-46724 drm/amdgpu: vulnerability in drm/amdgpu that involved an out-of-bounds read of df_v1_7_channel_number. |
| CVE-2024-46725 | CWE-20 Improper Input Validation | — |
CVE-2024-46725 drm/amdgpu: vulnerability caused by an out-of-bounds write warning due to an unchecked ring type value. |
| CVE-2024-46731 | CWE-20 Improper Input Validation | — |
CVE-2024-46731 drm/amd/pm: vulnerability caused by an out-of-bounds read warning where the index i - 1U can exceed the bounds of the mc_data[] array when i is zero. |
| CVE-2024-46747 | CWE-20 Improper Input Validation | — |
CVE-2024-46747 HID: cougar: slab-out-of-bounds Read in cougar_report_fixup. Report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it. |
| CVE-2024-46755 | CWE-20 Improper Input Validation | — |
CVE-2024-46755 wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id(). mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the priv is actually currently in use. Unused priv pointers do not have a wiphy attached to them which can lead to NULL pointer dereferences further down the callstack. |
| CVE-2024-46780 | CWE-20 Improper Input Validation | — |
CVE-2024-46780 nilfs2: vulnerability caused by the need for mutual exclusion using nilfs->ns_sem when accessing superblock buffers in sysfs attribute show methods to prevent issues with pointer dereferencing and memory access. |
| CVE-2024-46781 | CWE-20 Improper Input Validation | — |
CVE-2024-46781 nilfs2: vulnerability involves a use-after-free bug during mount-time recovery, where inodes with recovered data are not freed if an error occurs before the log writer starts, leading to potential memory issues. |
| CVE-2024-46804 | CWE-20 Improper Input Validation | — |
CVE-2024-46804 drm/amd/display: Add array index check for hdcp ddc access. |
| CVE-2024-46814 | CWE-20 Improper Input Validation | — |
CVE-2024-46814 drm/amd/display: Check msg_id before processing transcation. |
| CVE-2024-46815 | CWE-20 Improper Input Validation | — |
CVE-2024-46815 drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]. |
| CVE-2024-46817 | CWE-20 Improper Input Validation | — |
CVE-2024-46817 drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6. |
| CVE-2024-46818 | CWE-20 Improper Input Validation | — |
CVE-2024-46818 drm/amd/display: Check gpio_id before used as array index. |
| CVE-2024-46819 | CWE-20 Improper Input Validation | — |
CVE-2024-46819 drm/amdgpu: the warning dereferencing obj for nbio_v7_4 if ras_manager obj null, don't print NBIO err data. |
| CVE-2024-46822 | CWE-20 Improper Input Validation | — |
CVE-2024-46822 arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry. |
| CVE-2024-46832 | CWE-20 Improper Input Validation | — |
CVE-2024-46832 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warning: [ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Caused by get_c0_compare_int on secondary CPU. We also skipped saving IRQ number to struct clock_event_device *cd as it's never used by clockevent core, as per comments it's only meant for "non CPU local devices". |
| CVE-2024-46840 | CWE-20 Improper Input Validation | — |
CVE-2024-46840 btrfs: clean up our handling of refs == 0 in snapshot delete. In reada we BUG_ON(refs == 0), which may be problematic because there is no lock on the extent leave, potentially leading to a transient incorrect answer. In walk_down_proc, BUG_ON(refs == 0) is also used, which could occur due to extent tree corruption. This has been changed to return -EUCLEAN. In do_walk_down() this case is caught and handled correctly, however -EIO is returned, whereas -EUCLEAN would a more appropriate error code. Finally in walk_up_proc, BUG_ON(refs == 0) is also used, it has also been converted to proper error handling. |
| CVE-2024-47669 | CWE-20 Improper Input Validation | — |
CVE-2024-47669 nilfs2: state management vulnerability in error path of log writing function. |
| CVE-2024-47692 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-47692 In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdup_user() to return ZERO_SIZE_PTR. When we access the name.data that has been assigned the value of ZERO_SIZE_PTR in nfs4_client_to_reclaim(), null pointer dereference is triggered. [ T1205] ================================================================== [ T1205] BUG: KASAN: null-ptr-deref in nfs4_client_to_reclaim+0xe9/0x260 [ T1205] Read of size 1 at addr 0000000000000010 by task nfsdcld/1205 [ T1205] [ T1205] CPU: 11 PID: 1205 Comm: nfsdcld Not tainted 5.10.0-00003-g2c1423731b8d #406 [ T1205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ T1205] Call Trace: [ T1205] dump_stack+0x9a/0xd0 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] __kasan_report.cold+0x34/0x84 [ T1205] ? nfs4_client_to_reclaim+0xe9/0x260 [ T1205] kasan_report+0x3a/0x50 [ T1205] nfs4_client_to_reclaim+0xe9/0x260 [ T1205] ? nfsd4_release_lockowner+0x410/0x410 [ T1205] cld_pipe_downcall+0x5ca/0x760 [ T1205] ? nfsd4_cld_tracking_exit+0x1d0/0x1d0 [ T1205] ? down_write_killable_nested+0x170/0x170 [ T1205] ? avc_policy_seqno+0x28/0x40 [ T1205] ? selinux_file_permission+0x1b4/0x1e0 [ T1205] rpc_pipe_write+0x84/0xb0 [ T1205] vfs_write+0x143/0x520 [ T1205] ksys_write+0xc9/0x170 [ T1205] ? __ia32_sys_read+0x50/0x50 [ T1205] ? ktime_get_coarse_real_ts64+0xfe/0x110 [ T1205] ? ktime_get_coarse_real_ts64+0xa2/0x110 [ T1205] do_syscall_64+0x33/0x40 [ T1205] entry_SYSCALL_64_after_hwframe+0x67/0xd1 [ T1205] RIP: 0033:0x7fdbdb761bc7 [ T1205] Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 514 [ T1205] RSP: 002b:00007fff8c4b7248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ T1205] RAX: ffffffffffffffda RBX: 000000000000042b RCX: 00007fdbdb761bc7 [ T1205] RDX: 000000000000042b RSI: 00007fff8c4b75f0 RDI: 0000000000000008 [ T1205] RBP: 00007fdbdb761bb0 R08: 0000000000000000 R09: 0000000000000001 [ T1205] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000042b [ T1205] R13: 0000000000000008 R14: 00007fff8c4b75f0 R15: 0000000000000000 [ T1205] ================================================================== |
| CVE-2024-47697 | CWE-787 Out-of-bounds Write | — |
CVE-2024-47697 In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access. dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue. |
| CVE-2024-47698 | CWE-20 Improper Input Validation | — |
CVE-2024-47698 drivers: media: dvb-frontends/rtl2832: An out-of-bounds access occurs if rtl2832_pid_filter exceed 31, which was not verified. |
| CVE-2024-47699 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-47699 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() Patch series "nilfs2: fix potential issues with empty b-tree nodes". This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot. This patch (of 3): If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert(). This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called. Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency. Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on. |
| CVE-2024-47712 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-47712 wifi: wilc1000: vulnerability caused by a potential RCU dereference issue in wilc_parse_join_bss_param by storing the TSF value in a local variable before releasing the RCU lock to prevent use-after-free errors. |
| CVE-2024-47713 | CWE-664 Improper Control of a Resource Through its Lifetime | — |
CVE-2024-47713 wifi: mac80211: vulnerability caused by implementing a two-phase skb reclamation in ieee80211_do_stop() to avoid warnings and potential issues caused by calling __dev_queue_xmit() with interrupts disabled. |
| CVE-2024-47718 | CWE-416 Use After Free | — |
CVE-2024-47718 wifi: rtw88: vulnerability may lead to a use-after-free (UAF) error if firmware loading is not properly synchronized during USB initialization and disconnection. |
| CVE-2024-47723 | CWE-125 Out-of-bounds Read | — |
CVE-2024-47723 In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG() and diAlloc() In dbNextAG() , there is no check for the case where bmp->db_numag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should be added in dbMount(). And in dbNextAG(), a check for the case where agpref is greater than bmp->db_numag should be added, so an out-of-bounds exception should be prevented. Additionally, a check for the case where agno is greater or same than MAXAG should be added in diAlloc() to prevent out-of-bounds. |
| CVE-2024-47737 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-47737 In the Linux kernel, the following vulnerability has been resolved: nfsd: call cache_put if xdr_reserve_space returns NULL. |
| CVE-2024-47757 | CWE-125 Out-of-bounds Read | — |
CVE-2024-47757 nilfs2: potential oob read in nilfs_btree_check_delete(). The function nilfs_btree_check_delete(), which checks whether degeneration to direct mapping occurs before deleting a b-tree entry, causes memory access outside the block buffer when retrieving the maximum key if the root node has no entries. |
| CVE-2024-49863 | CWE-20 Improper Input Validation | — |
CVE-2024-49863 vhost/scsi: null-ptr-dereference in vhost_scsi_get_req(). |
| CVE-2024-49867 | CWE-20 Improper Input Validation | — |
CVE-2024-49867 btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at close_ctree(). |
| CVE-2024-49868 | CWE-20 Improper Input Validation | — |
CVE-2024-49868 btrfs: a NULL pointer dereference when failed to start a new trasacntion. |
| CVE-2024-49875 | CWE-20 Improper Input Validation | — |
CVE-2024-49875 nfsd: map the EBADMSG to nfserr_io to avoid warning Ext4 will throw -EBADMSG through ext4_readdir when a checksum error occurs. |
| CVE-2024-49877 | CWE-20 Improper Input Validation | — |
CVE-2024-49877 ocfs2: When doing cleanup, if flags do not have OCFS2_BH_READAHEAD set, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL. |
| CVE-2024-49879 | CWE-20 Improper Input Validation | — |
CVE-2024-49879 drm: omapdrm: alloc_ordered_workqueue may return NULL pointer and cause NULL pointer dereference. |
| CVE-2024-49890 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-49890 In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fw_info is not null before using it This resolves the dereference null return value warning reported by Coverity. |
| CVE-2024-49892 | CWE-369 Divide By Zero | — |
CVE-2024-49892 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize get_bytes_per_element's default to 1 Variables, used as denominators and maybe not assigned to other values, should not be 0. bytes_per_element_y & bytes_per_element_c are initialized by get_bytes_per_element() which should never return 0. This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity. |
| CVE-2024-49894 | CWE-129 Improper Validation of Array Index | — |
CVE-2024-49894 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max |
| CVE-2024-49895 | CWE-20 Improper Input Validation | — |
CVE-2024-49895 drm/amd/display: vulnerability caused by adding a check to ensure the index 'i' is within bounds before accessing transfer function points in cm_helper_translate_curve_to_degamma_hw_format, preventing buffer overflow errors. |
| CVE-2024-49896 | CWE-20 Improper Input Validation | — |
CVE-2024-49896 drm/amd/display: vulnerability caused by adding a null check for the stream before dereferencing it in dc_is_stream_unchanged to prevent null pointer dereference. |
| CVE-2024-49900 | CWE-908 Use of Uninitialized Resource | — |
CVE-2024-49900 In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1_do_compress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178 ... Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline] ... Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934 ===================================================== The reason is ea_buf->new_ea is not initialized properly. Fix this by using memset to empty its content at the beginning in ea_get(). |
| CVE-2024-49901 | CWE-20 Improper Input Validation | — |
CVE-2024-49901 drm/msm/adreno: vulnerability caused by assigning msm_gpu->pdev earlier in the initialization process to prevent null pointer dereferences in msm_gpu_cleanup. |
| CVE-2024-49902 | CWE-125 Out-of-bounds Read | — |
CVE-2024-49902 jfs: vulnerability caused by assigning msm_gpu->pdev earlier in the initialization process to prevent null pointer dereferences in msm_gpu_cleanup. |
| CVE-2024-49903 | CWE-416 Use After Free | — |
CVE-2024-49903 In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uaf in dbFreeBits [syzbot reported] ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216 CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 Freed by task 5218: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278 jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247 jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfigure_super+0x445/0x880 fs/super.c:1083 vfs_cmd_reconfigure fs/fsopen.c:263 [inline] vfs_fsconfig_locked fs/fsopen.c:292 [inline] __do_sys_fsconfig fs/fsopen.c:473 [inline] __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [Analysis] There are two paths (dbUnmount and jfs_ioc_trim) that generate race condition when accessing bmap, which leads to the occurrence of uaf. Use the lock s_umount to synchronize them, in order to avoid uaf caused by race condition. |
| CVE-2024-49907 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-49907 drm/amd/display: missing null pointer check before using dc->clk_mgr. |
| CVE-2024-49913 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-49913 drm/amd/display: missing null check for top_pipe_to_program in commit_planes_for_stream. |
| CVE-2024-49930 | CWE-125 Out-of-bounds Read | — |
CVE-2024-49930 wifi: ath11k: fix array out-of-bound access in SoC stats. Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. |
| CVE-2024-49938 | CWE-824 Access of Uninitialized Pointer | — |
CVE-2024-49938 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it. |
| CVE-2024-49957 | CWE-20 Improper Input Validation | — |
CVE-2024-49957 ocfs2: null-ptr-deref when journal load failed. |
| CVE-2024-49958 | CWE-20 Improper Input Validation | — |
CVE-2024-49958 ocfs2: reserve space for inline xattr before attaching reflink tree. |
| CVE-2024-49965 | CWE-20 Improper Input Validation | — |
CVE-2024-49965 ocfs2: remove unreasonable unlock in ocfs2_read_blocks Patch series "Misc fixes for ocfs2_read_blocks", v5. |
| CVE-2024-49966 | CWE-20 Improper Input Validation | — |
CVE-2024-49966 ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end. |
| CVE-2024-49969 | CWE-20 Improper Input Validation | — |
CVE-2024-49969 drm/amd/display: index out of bounds in DCN30 color transformation. |
| CVE-2024-49971 | CWE-20 Improper Input Validation | — |
CVE-2024-49971 drm/amd/display: dml2_core_shared_mode_support and dml_core_mode_support access the third element of dummy_boolean, for example: hw_debug5 = &s->dummy_boolean. Any assignment to hw_debug5 would cause an OVERRUN. |
| CVE-2024-49973 | CWE-787 Out-of-bounds Write | — |
CVE-2024-49973 r8169: RTL8125 added fields to the tally counter, this change could cause the chip to perform Direct Memory Access on these new fields, potentially writing to unallocated memory. |
| CVE-2024-50007 | CWE-20 Improper Input Validation | — |
CVE-2024-50007 ALSA: asihpi: potential OOB array access ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. |
| CVE-2024-50008 | CWE-787 Out-of-bounds Write | — |
CVE-2024-50008 wifi: mwifiex: memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() Replace one-element array with a flexible-array member in `struct host_cmd_ds_802_11_scan_ext`. |
| CVE-2024-50044 | CWE-667 Improper Locking | — |
CVE-2024-50044 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it. |
| CVE-2024-50049 | CWE-20 Improper Input Validation | — |
CVE-2024-50049 drm/amd/display: null pointer before dereferencing se. |
| CVE-2024-50096 | CWE-20 Improper Input Validation | — |
CVE-2024-50096 nouveau/dmem: vulnerability in migrate_to_ram upon copy error. |
| CVE-2024-50099 | CWE-20 Improper Input Validation | — |
CVE-2024-50099 arm64: probes: Broken LDR (literal) uprobe support. |
| CVE-2024-50193 | CWE-665 Improper Initialization | — |
CVE-2024-50193 x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffers are currently cleared after call to exc_nmi, but before register state is restored. This may be okay for MDS mitigation but not for RDFS. Because RDFS mitigation requires CPU buffers to be cleared when registers don't have any sensitive data. Move CLEAR_CPU_BUFFERS after RESTORE_ALL_NMI. |
| CVE-2024-50194 | CWE-20 Improper Input Validation | — |
CVE-2024-50194 arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is broken for big-endian kernels as it doesn't convert the in-memory instruction encoding (which is always little-endian) into the kernel's native endianness before analyzing and simulating instructions. |
| CVE-2024-50202 | CWE-20 Improper Input Validation | — |
CVE-2024-50202 nilfs2: propagate directory read errors from nilfs_find_entry(). A task hang occurs in vcs_open() during a fuzzing test for nilfs2. The root cause of this problem is that in nilfs_find_entry(), which searches for directory entries, ignores errors when loading a directory page/folio via nilfs_get_folio() fails. If the filesystem images is corrupted, and the i_size of the directory inode is large, and the directory page/folio is successfully read but fails the sanity check. |
| CVE-2024-50218 | CWE-20 Improper Input Validation | — |
CVE-2024-50218 ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow. |
| CVE-2024-50234 | CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition | — |
CVE-2024-50234 wifi: iwlegacy: vulnerability due to stale interrupts not being cleared before resuming the iwl4965 device from hibernation, causing a race condition between the resume process and restart work. |
| CVE-2024-50236 | CWE-20 Improper Input Validation | — |
CVE-2024-50236 wifi: ath10k: Fix memory leak in management tx In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. |
| CVE-2024-50237 | CWE-20 Improper Input Validation | — |
CVE-2024-50237 wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid potentially crashing in the driver because of uninitialized private data. |
| CVE-2024-50265 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-50265 ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(). |
| CVE-2024-50273 | CWE-908 Use of Uninitialized Resource | — |
CVE-2024-50273 btrfs: reinitialize delayed ref list after deleting it from the list. At insert_delayed_ref() if there is a need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, the ref from its ref head's ref_add_list is deleted using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. |
| CVE-2024-50282 | CWE-20 Improper Input Validation | — |
CVE-2024-50282 drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buffer overflow if size is larger than 4K. |
| CVE-2024-50302 KEV | CWE-908 Use of Uninitialized Resource | — |
CVE-2024-50302 In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report. |
| CVE-2024-53059 | CWE-460 Improper Cleanup on Thrown Exception | — |
CVE-2024-53059 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The size of the response packet is not validated. 2. The response buffer is not freed. Resolve these issues by switching to iwl_mvm_send_cmd_status(), which handles both size validation and frees the buffer. |
| CVE-2024-53060 | CWE-20 Improper Input Validation | — |
CVE-2024-53060 drm/amdgpu: vulnerability due to a potential NULL pointer dereference in drm/amdgpu if acpi_evaluate_object() returns AE_NOT_FOUND, which is mitigated by bailing out when this status is encountered. |
| CVE-2024-53063 | CWE-20 Improper Input Validation | — |
CVE-2024-53063 media: dvbdev: risk of out of memory access. |
| CVE-2024-53066 | CWE-20 Improper Input Validation | — |
CVE-2024-53066 nfs: KMSAN warning in decode_getfattr_attrs(). |
| CVE-2024-53104 KEV | CWE-20 Improper Input Validation | — |
CVE-2024-53104 media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
| CVE-2024-53146 | CWE-20 Improper Input Validation | — |
CVE-2024-53146 NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value. |
| CVE-2024-53150 KEV | CWE-125 Out-of-bounds Read | — |
CVE-2024-53150 ALSA: usb-audio: out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. |
| CVE-2024-53155 | CWE-20 Improper Input Validation | — |
CVE-2024-53155 ocfs2: uninitialized value in ocfs2_file_read_iter(). |
| CVE-2024-53156 | CWE-20 Improper Input Validation | — |
CVE-2024-53156 wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service(). |
| CVE-2024-53197 KEV | CWE-20 Improper Input Validation | — |
CVE-2024-53197 ALSA: usb-audio: vulnerability leading to out-of-bound accesses due to a bogus device providing an excessive bNumConfigurations value, which is fixed by ensuring proper allocation in usb_get_configuration. |
| CVE-2024-53198 | CWE-20 Improper Input Validation | — |
CVE-2024-53198 xen: issue of resource not being properly released in xenbus_dev_probe(). |
| CVE-2024-53217 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-53217 In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update(). |
| CVE-2024-53227 | CWE-20 Improper Input Validation | — |
CVE-2024-53227 scsi: bfa: use-after-free in bfad_im_module_exit(). |
| CVE-2024-53237 | CWE-416 Use After Free | — |
CVE-2024-53237 Bluetooth: vulnerability due to an use-after-free error in the device_for_each_child function, where a device may be accessed after it has been freed, potentially leading to a dangling pointer and system instability. |
| CVE-2024-53239 | CWE-20 Improper Input Validation | — |
CVE-2024-53239 ALSA: 6fire: The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might be still in use (as we're calling snd_card_free_when_closed()) and cause potential UAFs. |
| CVE-2024-53240 | CWE-476 NULL Pointer Dereference | — |
CVE-2024-53240 xen/netfront: vulnerability causes a crash when removing a device after a suspend/resume cycle due to uninitialized queues, which is fixed by checking for the existence of queues before attempting to stop them. |
| CVE-2024-53241 | CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer | — |
CVE-2024-53241 x86/xen: vulnerability due to issues with the PV iret hypercall through the hypercall page, which is fixed by directly coding the sequence in xen-asm.S to avoid problems with speculation mitigations. |
| CVE-2024-56531 | CWE-20 Improper Input Validation | — |
CVE-2024-56531 ALSA: caiaq: OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. |
| CVE-2024-56532 | CWE-20 Improper Input Validation | — |
CVE-2024-56532 ALSA: us122l: OTOH, the current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. |
| CVE-2024-56533 | CWE-20 Improper Input Validation | — |
CVE-2024-56533 ALSA: usx2y: The USB disconnect callback takes longer than it should. The current code uses snd_card_free() at disconnection, but this waits for the close of all used fds, hence it can take long. It eventually blocks the upper layer USB ioctls, which may trigger a soft lockup. |
| CVE-2024-56539 | CWE-20 Improper Input Validation | — |
CVE-2024-56539 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan(). |
| CVE-2024-56558 | CWE-20 Improper Input Validation | — |
CVE-2024-56558 nfsd: make sure exp active before svc_export_show The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for `exp` can drop to zero, which will trigger a refcount use-after-free warning when `exp_get` is called. |
| CVE-2024-56581 | CWE-416 Use After Free | — |
CVE-2024-56581 btrfs: ref-verify: use-after-free after invalid ref action. |
| CVE-2024-56586 | CWE-20 Improper Input Validation | — |
CVE-2024-56586 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on. |
| CVE-2024-56589 | CWE-20 Improper Input Validation | — |
CVE-2024-56589 scsi: hisi_sas: Add cond_resched() for no forced preemption model. For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, a call trace may occur. |
| CVE-2024-56593 | CWE-20 Improper Input Validation | — |
CVE-2024-56593 wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw(). This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue. |
| CVE-2024-56594 | CWE-20 Improper Input Validation | — |
CVE-2024-56594 drm/amdgpu: set the right AMDGPU sg segment limitation. The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length. |
| CVE-2024-56595 | CWE-20 Improper Input Validation | — |
CVE-2024-56595 jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree. When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out. |
| CVE-2024-56596 | CWE-20 Improper Input Validation | — |
CVE-2024-56596 jfs: array-index-out-of-bounds in jfs_readdir. The stbl might contain some invalid values. Added a check to return error code in that case. |
| CVE-2024-56597 | CWE-20 Improper Input Validation | — |
CVE-2024-56597 jfs: fix shift-out-of-bounds in dbSplit. When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. |
| CVE-2024-56598 | CWE-20 Improper Input Validation | — |
CVE-2024-56598 jfs: array-index-out-of-bounds fix in dtReadFirst. The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. |
| CVE-2024-56605 | CWE-20 Improper Input Validation | — |
CVE-2024-56605 Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. |
| CVE-2024-56619 | CWE-20 Improper Input Validation | — |
CVE-2024-56619 nilfs2: When searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. |
| CVE-2024-56623 | CWE-20 Improper Input Validation | — |
CVE-2024-56623 scsi: qla2xxx: System crash is observed with stack trace warning of use after free. |
| CVE-2024-56629 | CWE-20 Improper Input Validation | — |
CVE-2024-56629 HID: wacom: Due to incorrect dev->product reporting by certain devices, null pointer dereferences occur when dev->product is empty, leading to potential system crashes. |
| CVE-2024-56630 | CWE-20 Improper Input Validation | — |
CVE-2024-56630 ocfs2: iput() is not called when new_inode() succeeded and dquot_initialize() failed. |
| CVE-2024-56701 | CWE-20 Improper Input Validation | — |
CVE-2024-56701 powerpc/pseries: The dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because the code calls kmalloc() while holding it, which can sleep. |
| CVE-2024-56704 | CWE-20 Improper Input Validation | — |
CVE-2024-56704 9p/xen: A fix release of IRQ Kernel logs indicate an IRQ was double-freed. |
| CVE-2024-56747 | CWE-20 Improper Input Validation | — |
CVE-2024-56747 scsi: qedi: vulnerability involves a potential memory leak in qedi_alloc_and_init_sb() where the DMA memory sb_virt is not released upon failure, which is fixed by adding dma_free_coherent() to free the memory, similar to other functions like qedr_alloc_mem_sb() and qede_alloc_mem_sb(). |
| CVE-2024-56748 | CWE-20 Improper Input Validation | — |
CVE-2024-56748 scsi: qedf: vulnerability involves a potential memory leak in qedf_alloc_and_init_sb() where the DMA memory sb_virt is not released upon failure, which is fixed by adding dma_free_coherent() to free the memory, similar to other functions like qedr_alloc_mem_sb() and qede_alloc_mem_sb(). |
| CVE-2024-56779 | CWE-401 Missing Release of Memory after Effective Lifetime | — |
CVE-2024-56779 nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. |
| CVE-2024-56785 | CWE-129 Improper Validation of Array Index | — |
CVE-2024-56785 MIPS: Loongson64: DTS: issues with PCIe port nodes for ls7a. |
| CVE-2024-57874 | CWE-824 Access of Uninitialized Pointer | — |
CVE-2024-57874 arm64: ptrace: vulnerability due to an uninitialized variable in the tagged_addr_ctrl_set() function, leading to potential memory leakage from the kernel stack when a zero-length SETREGSET call is made, exposing up to 64 bits of memory. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-41040 | 9.8 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BU… |
| CVE-2024-43883 | 9.8 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few… |
| CVE-2024-50033 | 9.8 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found t… |
| CVE-2024-50046 | 9.8 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() On the node … |
| CVE-2024-56645 | 9.8 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session… |
| CVE-2022-48828 | 9.1 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bi… |
| CVE-2022-48829 | 9.1 Critical | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is… |
| CVE-2024-41046 | 8.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the current… |
| CVE-2024-41090 | 8.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check … |
| CVE-2024-49930 | 8.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_… |
| CVE-2024-49982 | 8.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-202… |
| CVE-2024-43882 | 8.4 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file f… |
| CVE-2024-40941 | 8.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware… |
| CVE-2024-36974 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_AT… |
| CVE-2024-36978 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: sched: sch_multiq: fix possible OOB write in multiq_tune() q->bands will b… |
| CVE-2024-39482 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two… |
| CVE-2024-39495 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. … |
| CVE-2024-39502 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add()… |
| CVE-2024-39503 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type… |
| CVE-2024-40902 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not wha… |
| CVE-2024-40943 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit "ocfs2: return … |
| CVE-2024-40958 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refc… |
| CVE-2024-40974 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Enforce hcall result buffer validity and size plpar_hcall(), p… |
| CVE-2024-40984 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."… |
| CVE-2024-41049 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported… |
| CVE-2024-41087 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ata_port_alloc() call in… |
| CVE-2024-42105 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks Patch series "nilfs2: fix potential issue… |
| CVE-2024-42236 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace pr… |
| CVE-2024-44949 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - thi… |
| CVE-2024-44987 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1… |
| CVE-2024-44995 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix a deadlock problem when config TC during resetting When config T… |
| CVE-2024-46673 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-… |
| CVE-2024-46713 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is s… |
| CVE-2024-46740 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and co… |
| CVE-2024-46750 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that t… |
| CVE-2024-46781 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error In an error injection… |
| CVE-2024-46798 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the f… |
| CVE-2024-46800 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues pack… |
| CVE-2024-47679 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently … |
| CVE-2024-47697 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure … |
| CVE-2024-47701 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When l… |
| CVE-2024-47706 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible UAF for bfqq->bic with merge chain 1) initial state, t… |
| CVE-2024-47723 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG() and diAlloc() In dbNextAG() , there is no … |
| CVE-2024-47747 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Conditi… |
| CVE-2024-49883 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in … |
| CVE-2024-49884 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() We hit the following us… |
| CVE-2024-49889 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4_ext_show_leaf() In ext4_find_extent(), path … |
| CVE-2024-49902 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out… |
| CVE-2024-49952 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf… |
| CVE-2024-49958 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our … |
| CVE-2024-49966 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will … |
| CVE-2024-49973 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the … |
| CVE-2024-49983 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When cal… |
| CVE-2024-50001 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix error path in multi-packet WQE transmit Remove the erroneous unma… |
| CVE-2024-50039 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backl… |
| CVE-2024-50051 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module… |
| CVE-2024-50074 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out… |
| CVE-2024-50082 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing… |
| CVE-2024-50180 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yr… |
| CVE-2024-50262 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocat… |
| CVE-2024-50264 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans Du… |
| CVE-2024-50267 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb-… |
| CVE-2024-50269 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb: … |
| CVE-2024-50282 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a pos… |
| CVE-2024-53057 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_bac… |
| CVE-2024-53059 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The… |
| CVE-2024-53061 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be l… |
| CVE-2024-53063 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a s… |
| CVE-2024-53103 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer When hvs… |
| CVE-2024-53104 | 7.8 High | Linux Kernel Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow … |
| CVE-2024-53148 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls su… |
| CVE-2024-53156 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found… |
| CVE-2024-53165 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error han… |
| CVE-2024-53171 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit After an inse… |
| CVE-2024-53173 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open() Yang Erkun rep… |
| CVE-2024-53174 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `c_show` wa… |
| CVE-2024-53194 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash … |
| CVE-2024-53197 | 7.8 High | Linux Kernel Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use… |
| CVE-2024-53214 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases … |
| CVE-2024-53227 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfad_im_module_exit() BUG: KASAN: slab-use-aft… |
| CVE-2024-53237 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix use-after-free in device_for_each_child() Syzbot has reported th… |
| CVE-2024-53239 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to … |
| CVE-2024-56548 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block… |
| CVE-2024-56558 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svc_export_show The function `e_show` was cal… |
| CVE-2024-56576 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If a… |
| CVE-2024-56581 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tre… |
| CVE-2024-56595 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the val… |
| CVE-2024-56596 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in jfs_readdir The stbl might contain some i… |
| CVE-2024-56597 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it c… |
| CVE-2024-56598 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be some… |
| CVE-2024-56600 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data… |
| CVE-2024-56601 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data()… |
| CVE-2024-56602 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() sock… |
| CVE-2024-56603 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_cr… |
| CVE-2024-56605 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create… |
| CVE-2024-56606 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After s… |
| CVE-2024-56615 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against … |
| CVE-2024-56619 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot … |
| CVE-2024-56623 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use after free on unload System crash is observed with stack… |
| CVE-2024-56642 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). syzkaller report… |
| CVE-2024-56681 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - add error check in the ahash_hmac_init function The ahash_init fu… |
| CVE-2024-56704 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fix release of IRQ Kernel logs indicate an IRQ was double-freed. Pass … |
| CVE-2024-57951 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU… |
| CVE-2025-21687 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are pas… |
| CVE-2025-21692 | 7.8 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <[email protected]> found… |
| CVE-2021-47316 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svc_encode_getaclres In error cases the dentr… |
| CVE-2022-48827 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSET_MAX Dan Aloni reports: > Due to comm… |
| CVE-2023-52887 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xt… |
| CVE-2024-39468 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock befo… |
| CVE-2024-40980 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called … |
| CVE-2024-41007 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOU… |
| CVE-2024-42145 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_uma… |
| CVE-2024-42247 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc pla… |
| CVE-2024-46763 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive… |
| CVE-2024-47696 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the com… |
| CVE-2024-47739 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: padata: use integer wrap around to prevent deadlock on seq_nr overflow When sub… |
| CVE-2024-47749 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Added NULL check for lookup_atid The lookup_atid() function can ret… |
| CVE-2024-50045 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in … |
| CVE-2024-56644 | 7.5 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked… |
| CVE-2024-6197 | 7.5 High | curl curl libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortu… |
| CVE-2024-8176 | 7.5 High | — A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an … |
| CVE-2022-48666 | 7.4 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. … |
| CVE-2024-40901 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is … |
| CVE-2024-40971 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: f2fs: remove clear SB_INLINECRYPT flag in default_options In f2fs_remount, SB_I… |
| CVE-2024-46743 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of… |
| CVE-2024-50024 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetl… |
| CVE-2024-56637 | 7.3 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Hold module reference while requesting a module User space ma… |
| CVE-2024-39469 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error… |
| CVE-2024-39487 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function… |
| CVE-2024-45021 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guarantee… |
| CVE-2024-47740 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting … |
| CVE-2024-49894 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation … |
| CVE-2024-50193 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: x86/entry_32: Clear CPU buffers after register restore in NMI return CPU buffer… |
| CVE-2024-50268 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Th… |
| CVE-2024-50278 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds … |
| CVE-2024-50279 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache c… |
| CVE-2024-50301 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an o… |
| CVE-2024-53150 | 7.1 High | Linux Kernel Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sens… |
| CVE-2024-53155 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported th… |
| CVE-2024-56650 | 7.1 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the… |
| CVE-2024-50234 | 7.0 High | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upo… |
| CVE-2024-7264 | 6.3 Medium | curl curl libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect fiel… |
| CVE-2024-57874 | 6.1 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagg… |
| CVE-2024-56662 | 6.0 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected b… |
| CVE-2024-50602 | 5.9 Medium | n/a n/a An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an un… |
| CVE-2024-9681 | 5.9 Medium | curl curl When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than oth… |
| CVE-2024-36894 | 5.6 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS b… |
| CVE-2024-43098 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid de… |
| CVE-2024-47143 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held… |
| CVE-2024-48881 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b (… |
| CVE-2024-50095 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Improve handling of timed out WRs of mad agent Current timeout handle… |
| CVE-2024-50096 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error The `nouveau_… |
| CVE-2024-50099 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_lite… |
| CVE-2024-50179 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing th… |
| CVE-2024-50184 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: Check device status before requesting flush If a pmem device is in… |
| CVE-2024-50185 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mptcp: handle consistently DSS corruption Bugged peer implementation can send c… |
| CVE-2024-50188 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83869: fix memory corruption when enabling fiber When configuring t… |
| CVE-2024-50194 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is bro… |
| CVE-2024-50195 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew point… |
| CVE-2024-50198 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: iio: light: veml6030: fix IIO device retrieval from embedded device The dev poi… |
| CVE-2024-50201 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix encoder->possible_clones Include the encoder itself in its poss… |
| CVE-2024-50202 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported… |
| CVE-2024-50236 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is … |
| CVE-2024-50237 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid p… |
| CVE-2024-50265 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() S… |
| CVE-2024-50273 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_… |
| CVE-2024-50287 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity… |
| CVE-2024-50290 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if r… |
| CVE-2024-50292 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case o… |
| CVE-2024-50296 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninsta… |
| CVE-2024-50299 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix simi… |
| CVE-2024-50302 | 5.5 Medium | Linux Kernel The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID rep… |
| CVE-2024-53060 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_eval… |
| CVE-2024-53066 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warni… |
| CVE-2024-53097 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in __do_krealloc This patch addresses an issu… |
| CVE-2024-53101 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() us… |
| CVE-2024-53145 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: um: Fix potential integer overflow during physmem setup This issue happens when… |
| CVE-2024-53146 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 … |
| CVE-2024-53157 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a ker… |
| CVE-2024-53158 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() This loop is s… |
| CVE-2024-53161 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get… |
| CVE-2024-53198 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: xen: Fix the issue of resource not being properly released in xenbus_dev_probe()… |
| CVE-2024-53217 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized… |
| CVE-2024-53226 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() ib_map_mr_sg() al… |
| CVE-2024-56531 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnec… |
| CVE-2024-56532 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconne… |
| CVE-2024-56533 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnec… |
| CVE-2024-56567 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ad7780: fix division by zero in ad7780_write_raw() In the ad7780_write_raw() , … |
| CVE-2024-56569 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix regression with module command in stack_trace_filter When executing… |
| CVE-2024-56574 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: ts2020: fix null-ptr-deref in ts2020_probe() KASAN reported a null-ptr-d… |
| CVE-2024-56587 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: leds: class: Protect brightness_show() with led_cdev->led_access mutex There is… |
| CVE-2024-56593 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_r… |
| CVE-2024-56629 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix when get product name maybe null pointer Due to incorrect dev->… |
| CVE-2024-56634 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gpio: grgpio: Add NULL check in grgpio_probe devm_kasprintf() can return a NULL… |
| CVE-2024-56648 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is ab… |
| CVE-2024-56659 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: lapb: increase LAPB_HEADER_LEN It is unclear if net/lapb code is supposed … |
| CVE-2024-56661 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed com… |
| CVE-2024-56670 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing n… |
| CVE-2024-56688 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock … |
| CVE-2024-56698 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queue… |
| CVE-2024-56720 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpf_msg_pop_data Several fixes to bpf_msg_pop_da… |
| CVE-2024-56723 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices While design wise th… |
| CVE-2024-56724 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device While design wise the … |
| CVE-2024-56728 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Add error point… |
| CVE-2024-56739 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() If the __rt… |
| CVE-2024-56754 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: crypto: caam - Fix the pointer passed to caam_qi_shutdown() The type of the las… |
| CVE-2024-56756 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is s… |
| CVE-2024-56770 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qle… |
| CVE-2024-56779 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force… |
| CVE-2024-56780 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths quota wri… |
| CVE-2024-56785 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a Fix the dtc warnings… |
| CVE-2025-21689 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch … |
| CVE-2025-21694 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("f… |
| CVE-2025-21699 | 5.5 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inod… |
| CVE-2023-4039 | 4.8 Medium | Arm Ltd Arm GNU Toolchain **DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains that target AArch64 allows an attacker to exploit an existing buffer … |
| CVE-2024-56568 | 4.7 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer der… |
| CVE-2024-53052 | 4.4 Medium | Linux Linux In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring st… |
| CVE-2024-56572 | 3.3 Low | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_inter… |
| CVE-2024-56643 | 3.3 Low | Linux Linux In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fail… |
| CVE-2024-56746 | 3.3 Low | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() When inform… |
| CVE-2024-56747 | 3.3 Low | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Hook "qedi_o… |
| CVE-2024-56748 | 3.3 Low | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook "qed_op… |
| CVE-2024-6874 | 3.1 Low | curl curl libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to conv… |
| CVE-2022-49034 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFS… |
| CVE-2023-52918 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can r… |
| CVE-2024-36484 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following … |
| CVE-2024-36901 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a … |
| CVE-2024-36938 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NU… |
| CVE-2024-37078 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destruct… |
| CVE-2024-38586 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue w… |
| CVE-2024-38619 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesi… |
| CVE-2024-39484 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using __exit f… |
| CVE-2024-39499 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity… |
| CVE-2024-39505 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komeda_pipeline_get_state() may retu… |
| CVE-2024-39506 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet In lio_… |
| CVE-2024-39509 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: HID: core: remove unnecessary WARN_ON() in implement() Syzkaller hit a warning … |
| CVE-2024-40904 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot… |
| CVE-2024-40905 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib… |
| CVE-2024-40912 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211… |
| CVE-2024-40916 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found Whe… |
| CVE-2024-40929 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids In some versions o… |
| CVE-2024-40931 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly relat… |
| CVE-2024-40932 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/exynos/vidi: fix memory leak in .get_modes() The duplicated EDID is never f… |
| CVE-2024-40934 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() Fix a mem… |
| CVE-2024-40942 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects The hwmp code use obj… |
| CVE-2024-40945 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() sh… |
| CVE-2024-40947 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section A panic happens in ima_ma… |
| CVE-2024-40959 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() ip6_dst_idev() ca… |
| CVE-2024-40960 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL dereference in rt6_probe() syzbot caught a NULL der… |
| CVE-2024-40961 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible NULL deref in fib6_nh_init() syzbot reminds us that in6_… |
| CVE-2024-40963 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: make sure CBR is correctly set It was discovered that som… |
| CVE-2024-40968 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon: Add PCIe link status check The standard PCIe configuration read-w… |
| CVE-2024-40976 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/lima: mask irqs in timeout path before hard reset There is a race condition… |
| CVE-2024-40978 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix crash while reading debugfs attribute The qedi_dbg_do_not_recov… |
| CVE-2024-40981 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: batman-adv: bypass empty buckets in batadv_purge_orig_ref() Many syzbot reports… |
| CVE-2024-40983 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tipc: force a dst refcount before doing decryption As it says in commit 3bc0732… |
| CVE-2024-40987 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mappin… |
| CVE-2024-40988 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mappin… |
| CVE-2024-40990 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Add check for srq max_sge attribute max_sge attribute is passed by t… |
| CVE-2024-40995 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() syzbot … |
| CVE-2024-41000 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: block/ioctl: prefer different overflow check Running syzkaller with the newly r… |
| CVE-2024-41004 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tracing: Build event generation tests only as modules The kprobes and synth eve… |
| CVE-2024-41005 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix race condition in netpoll_owner_active KCSAN detected a race condi… |
| CVE-2024-41006 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nr_heartbeat_expiry() syzbot reported a memory lea… |
| CVE-2024-41009 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is … |
| CVE-2024-41012 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_se… |
| CVE-2024-41015 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_check_dir_entry() This adds sanity checks f… |
| CVE-2024-41017 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members o… |
| CVE-2024-41020 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc… |
| CVE-2024-41022 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" v… |
| CVE-2024-41034 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported … |
| CVE-2024-41035 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descripto… |
| CVE-2024-41041 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the w… |
| CVE-2024-41044 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_enco… |
| CVE-2024-41055 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("m… |
| CVE-2024-41059 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-val… |
| CVE-2024-41063 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is repor… |
| CVE-2024-41064 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is re… |
| CVE-2024-41065 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the… |
| CVE-2024-41068 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclp_init() cleanup on failure If sclp_init() fails it only part… |
| CVE-2024-41070 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Al repor… |
| CVE-2024-41072 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwsca… |
| CVE-2024-41077 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size Block size should be between 512 and PAG… |
| CVE-2024-41078 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the qu… |
| CVE-2024-41081 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block… |
| CVE-2024-41089 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes In n… |
| CVE-2024-41091 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check … |
| CVE-2024-41092 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadi… |
| CVE-2024-41095 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes In n… |
| CVE-2024-41097 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still report… |
| CVE-2024-42076 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: Initialize unused data in j1939_send_one() syzbot reported ker… |
| CVE-2024-42077 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix DIO failure due to insufficient transaction credits The code in ocfs… |
| CVE-2024-42082 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __… |
| CVE-2024-42084 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit o… |
| CVE-2024-42086 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: iio: chemical: bme680: Fix overflows in compensate() functions There are cases … |
| CVE-2024-42087 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep The il… |
| CVE-2024-42092 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gpio: davinci: Validate the obtained number of IRQs Value of pdata->gpio_unbank… |
| CVE-2024-42093 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OF… |
| CVE-2024-42094 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFF… |
| CVE-2024-42095 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: serial: 8250_omap: Implementation of Errata i2310 As per Errata i2310[0], Erron… |
| CVE-2024-42101 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes In nou… |
| CVE-2024-42148 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bnx2x: Fix multiple UBSAN array-index-out-of-bounds Fix UBSAN warnings that occ… |
| CVE-2024-42152 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet… |
| CVE-2024-42153 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr When… |
| CVE-2024-42154 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP… |
| CVE-2024-42161 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - U… |
| CVE-2024-42223 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up t… |
| CVE-2024-42224 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Correct check for empty list Since commit a3c53be55c95 ("n… |
| CVE-2024-42229 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 spe… |
| CVE-2024-42232 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delay… |
| CVE-2024-42244 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: seri… |
| CVE-2024-43861 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when… |
| CVE-2024-43867 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouvea… |
| CVE-2024-43871 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will caus… |
| CVE-2024-43879 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() C… |
| CVE-2024-43880 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newe… |
| CVE-2024-43889 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: padata: Fix possible divide-by-0 panic in padata_mt_helper() We are hit with a … |
| CVE-2024-43890 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tracing: Fix overflow in get_free_elt() "tracing_map->next_elt" in get_free_elt… |
| CVE-2024-43893 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOC… |
| CVE-2024-43894 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_cli… |
| CVE-2024-43907 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules Che… |
| CVE-2024-43908 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer dereference to ras_manager Check ras_manager b… |
| CVE-2024-43914 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid BUG_ON() while continue reshape after reassembling Currently, m… |
| CVE-2024-44935 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-de… |
| CVE-2024-44944 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expecta… |
| CVE-2024-44954 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to lin… |
| CVE-2024-44960 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been… |
| CVE-2024-44965 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy cra… |
| CVE-2024-44969 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion … |
| CVE-2024-44971 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf… |
| CVE-2024-44988 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by … |
| CVE-2024-44989 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev t… |
| CVE-2024-44990 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there… |
| CVE-2024-44998 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb… |
| CVE-2024-44999 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit… |
| CVE-2024-45003 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaim… |
| CVE-2024-45006 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enum… |
| CVE-2024-45008 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_m… |
| CVE-2024-45025 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE copy_fd_bitmaps… |
| CVE-2024-46674 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: st: fix probed platform device ref count on probe error path The pro… |
| CVE-2024-46675 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: Prevent USB core invalid event buffer address access This comm… |
| CVE-2024-46676 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 … |
| CVE-2024-46677 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfd_lookup() fails, gtp_e… |
| CVE-2024-46679 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can … |
| CVE-2024-46685 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcs_get_function() pinmux_ge… |
| CVE-2024-46689 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cm… |
| CVE-2024-46702 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that wh… |
| CVE-2024-46707 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system wit… |
| CVE-2024-46714 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Callers can pas… |
| CVE-2024-46719 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix null pointer dereference in trace ucsi_register_altmode c… |
| CVE-2024-46721 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: apparmor: fix possible NULL pointer dereference profile->parent->dents[AAFS_PRO… |
| CVE-2024-46722 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mc_data out-of-bounds read warning Clear warning that read mc_d… |
| CVE-2024-46723 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode[… |
| CVE-2024-46724 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Check the fb_chann… |
| CVE-2024-46725 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix th… |
| CVE-2024-46731 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix the Out-of-bounds read warning using index i - 1U may beyond el… |
| CVE-2024-46737 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix kernel crash if commands allocation fails If the commands alloca… |
| CVE-2024-46738 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When … |
| CVE-2024-46739 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For prima… |
| CVE-2024-46744 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-va… |
| CVE-2024-46745 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercis… |
| CVE-2024-46747 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup report_fixup fo… |
| CVE-2024-46755 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_ge… |
| CVE-2024-46759 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes DIV_ROUND… |
| CVE-2024-46761 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv The hotplug driver for… |
| CVE-2024-46771 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warn… |
| CVE-2024-46777 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: udf: Avoid excessive partition lengths Avoid mounting filesystems where the par… |
| CVE-2024-46780 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect references to superblock parameters exposed in sysfs The superb… |
| CVE-2024-46782 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read … |
| CVE-2024-46783 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->… |
| CVE-2024-46791 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open The mcp25… |
| CVE-2024-46804 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add array index check for hdcp ddc access [Why] Coverity repor… |
| CVE-2024-46814 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msg_id before processing transcation [WHY & HOW] HDCP_ME… |
| CVE-2024-46815 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] [WHY & … |
| CVE-2024-46817 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why… |
| CVE-2024-46818 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpio_id before used as array index [WHY & HOW] GPIO_ID_U… |
| CVE-2024-46819 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 if ras_manager obj null… |
| CVE-2024-46822 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review… |
| CVE-2024-46828 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, … |
| CVE-2024-46829 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() … |
| CVE-2024-46832 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This av… |
| CVE-2024-46840 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON… |
| CVE-2024-46844 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: um: line: always fill *error_out in setup_one_line() The pointer isn't initiali… |
| CVE-2024-47659 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of … |
| CVE-2024-47660 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directories can have… |
| CVE-2024-47663 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834_w… |
| CVE-2024-47667 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) Errata #i2037 in… |
| CVE-2024-47668 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() If we need to… |
| CVE-2024-47669 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit… |
| CVE-2024-47684 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running … |
| CVE-2024-47685 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that … |
| CVE-2024-47692 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in … |
| CVE-2024-47698 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error Ensure … |
| CVE-2024-47699 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() Patch series "nilf… |
| CVE-2024-47705 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blk_add_partition The blk_a… |
| CVE-2024-47709 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). syzbot reported a … |
| CVE-2024-47710 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sock_map: Add a cond_resched() in sock_hash_free() Several syzbot soft lockup r… |
| CVE-2024-47712 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param… |
| CVE-2024-47713 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() Since '__d… |
| CVE-2024-47718 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: always wait for both firmware loading attempts In 'rtw_wait_firmwa… |
| CVE-2024-47735 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled Fix missuse of … |
| CVE-2024-47737 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: call cache_put if xdr_reserve_space returns NULL If not enough buffer spa… |
| CVE-2024-47742 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings… |
| CVE-2024-47748 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vhost_vdpa: assign irq bypass producer token correctly We used to call irq_bypa… |
| CVE-2024-47756 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() This code acciden… |
| CVE-2024-47757 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential oob read in nilfs_btree_check_delete() The function nilfs… |
| CVE-2024-49851 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tpm: Clean up TPM space after command failure tpm_dev_transmit prepares the TPM… |
| CVE-2024-49858 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM … |
| CVE-2024-49860 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid … |
| CVE-2024-49863 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e11… |
| CVE-2024-49867 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount Dur… |
| CVE-2024-49868 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion [B… |
| CVE-2024-49875 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: nfsd: map the EBADMSG to nfserr_io to avoid warning Ext4 will throw -EBADMSG th… |
| CVE-2024-49877 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate When doing clea… |
| CVE-2024-49878 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system wi… |
| CVE-2024-49879 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm: omapdrm: Add missing check for alloc_ordered_workqueue As it may return NU… |
| CVE-2024-49881 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: update orig_path in ext4_find_extent() In ext4_find_extent(), if the path… |
| CVE-2024-49882 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_mer… |
| CVE-2024-49890 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fw_info is not null before using it This resolves the de… |
| CVE-2024-49892 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize get_bytes_per_element's default to 1 Variables, use… |
| CVE-2024-49895 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format transl… |
| CVE-2024-49896 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check stream before comparing them [WHAT & HOW] amdgpu_dm can … |
| CVE-2024-49900 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1… |
| CVE-2024-49901 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs There are some c… |
| CVE-2024-49903 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uaf in dbFreeBits [syzbot reported] ==================================… |
| CVE-2024-49907 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before using dc->clk_mgr [WHY & HOW] dc->c… |
| CVE-2024-49913 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_str… |
| CVE-2024-49924 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe fu… |
| CVE-2024-49933 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: blk_iocost: fix more out of bound shifts Recently running UBSAN caught few out … |
| CVE-2024-49936 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_en… |
| CVE-2024-49938 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbo… |
| CVE-2024-49944 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start In sct… |
| CVE-2024-49948 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_… |
| CVE-2024-49949 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c… |
| CVE-2024-49955 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ACPI: battery: Fix possible crash when unregistering a battery hook When a batt… |
| CVE-2024-49957 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process… |
| CVE-2024-49959 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error In … |
| CVE-2024-49962 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_packag… |
| CVE-2024-49963 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase th… |
| CVE-2024-49965 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove unreasonable unlock in ocfs2_read_blocks Patch series "Misc fixes… |
| CVE-2024-49969 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This com… |
| CVE-2024-49971 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummy_boolean [WHY] dml2_core_shared_mo… |
| CVE-2024-49975 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninit… |
| CVE-2024-49977 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f… |
| CVE-2024-49981 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race condition in v… |
| CVE-2024-49985 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In c… |
| CVE-2024-49997 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the bu… |
| CVE-2024-50006 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate() Fuzzing reports a possi… |
| CVE-2024-50007 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access ASIHPI driver stores some values i… |
| CVE-2024-50008 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_s… |
| CVE-2024-50013 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: exfat: fix memory leak in exfat_load_bitmap() If the first directory entry in t… |
| CVE-2024-50015 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ext4: dax: fix overflowing extents beyond inode size when partially writing The… |
| CVE-2024-50035 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_asyn… |
| CVE-2024-50040 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 ("igb… |
| CVE-2024-50044 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_st… |
| CVE-2024-50049 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se [WHAT & HOW] se is … |
| CVE-2024-50059 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove … |
| CVE-2024-50083 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trig… |
| CVE-2024-50199 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a … |
| CVE-2024-50218 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow Syzbot reported a kerne… |
| CVE-2024-50251 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum()… |
| CVE-2024-50295 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and … |
| CVE-2024-50304 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() The per-n… |
| CVE-2024-52332 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_… |
| CVE-2024-53172 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ubi: fastmap: Fix duplicate slab cache names while attaching Since commit 4c395… |
| CVE-2024-53181 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release The drvdata is not available in relea… |
| CVE-2024-53183 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available in release.… |
| CVE-2024-53184 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release.… |
| CVE-2024-53240 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: xen/netfront: fix crash when removing device When removing a netfront device di… |
| CVE-2024-53241 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping t… |
| CVE-2024-53680 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() Under c… |
| CVE-2024-56539 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan(… |
| CVE-2024-56562 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() if (dev-… |
| CVE-2024-56570 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_… |
| CVE-2024-56586 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. creat… |
| CVE-2024-56589 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add cond_resched() for no forced preemption model For no forced… |
| CVE-2024-56594 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: set the right AMDGPU sg segment limitation The driver needs to set … |
| CVE-2024-56610 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: kcsan: Turn report_filterlist_lock into a raw_spinlock Ran Xiaokai reports that… |
| CVE-2024-56630 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy in… |
| CVE-2024-56633 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory… |
| CVE-2024-56636 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: geneve: do not assume mac header is set in geneve_xmit_skb() We should not assu… |
| CVE-2024-56690 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EB… |
| CVE-2024-56691 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device While design wi… |
| CVE-2024-56700 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: wl128x: Fix atomicity violation in fmc_send_cmd() Atomicity violation oc… |
| CVE-2024-56701 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore The dtl_access_lock n… |
| CVE-2024-56705 | — | Linux Linux In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.