DEBIAN-CVE-2024-46803

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check debug trap enable before write dbgevfile In interrupt context, write dbgevfile will be run by work queue. It will cause write dbgevfile execution after debugtrapdisable, which will cause NULL pointer access. v2:...

UBUNTU-CVE-2024-46809

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check BIOS images before it is used BIOS images may fail to load and null checks are added before they are used. This fixes 6 NULLRETURNS issues reported by Coverity...

UBUNTU-CVE-2024-46837

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on groupcreate We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service. We now only allow the DRM...

UBUNTU-CVE-2024-46835

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix smatch static checker warning adev-gfx.imu.funcs could be NULL...

UBUNTU-CVE-2024-46819

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbiov74 if rasmanager obj null, don't print NBIO err data...

UBUNTU-CVE-2024-46810

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Make sure the connector is fully initialized before signalling any HPD events via drmkmshelperhotplugevent, otherwise this may lead to NULL...

UBUNTU-CVE-2024-46808

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add missing NULL pointer check within dpcdextendaddressrange Why & How ASSERT if return NULL from kcalloc...

UBUNTU-CVE-2024-46866

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in showmeminfo bomeminfo wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab...

UBUNTU-CVE-2024-46850

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn35setdrr and dcstatedestruct dcstatedestruct nulls the resource context of the DC state. The pipe context passed to dcn35setdrr is a member of this resource context. If dcstatedestruct is...

UBUNTU-CVE-2024-46812

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration Why Coverity reports Memory - illegal accesses. How Skip inactive planes...

UBUNTU-CVE-2024-46811

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index may exceed array range within fpuupdatebwboundingbox Why Coverity reports OVERRUN warning. soc.numstates could be 40. But array range of bwparams-clktable.entries is 8. How Assert if soc.numstates great...

CVE-2024-46867

In CVE-2024-46867, the Linux kernel component drm/xe/client exhibited a deadlock and an atomic sleep issue in show_meminfo when the bo (buffer object) being destroyed had the last reference. The root cause was the destruction path attempting to grab the same spinlock, risking a sleep in atomic co...

CVE-2024-46867 drm/xe/client: fix deadlock in show_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in showmeminfo There is a real deadlock as well as sleeping in atomic bug in here, if the bo put happens to be the last ref, since bo destruction wants to grab the same spinlock and sleeping locks. Fix...

CVE-2024-46866 drm/xe/client: add missing bo locking in show_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in showmeminfo bomeminfo wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab...

CVE-2024-46866 drm/xe/client: add missing bo locking in show_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in showmeminfo bomeminfo wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab...

CVE-2024-46866 drm/xe/client: add missing bo locking in show_meminfo()

In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in showmeminfo bomeminfo wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab...

CVE-2024-46866

The CVE-2024-46866 issue in the Linux kernel affects the drm/xe client, specifically the bo_meminfo path. Root cause: bo_meminfo() inspects bo state (tt and ttm resource) without consistently holding the bo lock, allowing state changes that can cause NPD or UAF. Mitigation implemented by grabbing...

CVE-2024-46851

The CVE-2024-46851 issue appears in the Linux kernel DRM/AMD display code: a race between dcn10_set_drr() and dc_state_destruct() can occur if dc_state_destruct() nulls the DC state resource context while IRQ processing calls dcn10_set_drr(). The pipe context passed to dcn10_set_drr() is part of ...

CVE-2024-46851 drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn10setdrr and dcstatedestruct dcstatedestruct nulls the resource context of the DC state. The pipe context passed to dcn10setdrr is a member of this resource context. If dcstatedestruct is...

CVE-2024-46851 drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn10setdrr and dcstatedestruct dcstatedestruct nulls the resource context of the DC state. The pipe context passed to dcn10setdrr is a member of this resource context. If dcstatedestruct is...