PT-2025-3662

The vulnerable software is the Linux kernel. The issue arose from a regression in the kernel's memory management subsystem, specifically in the handling of write-sealed memfd mappings. The problem was introduced by a commit that moved a check for mapping writability before the shmem mmap hook was...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-48879: efi: fix NULL-deref in init error path bsc1229556. CVE-2022-48956: ipv6: avoid use-after-free in ip6fragment bsc1231893. CVE-2022-48959: net: dsa:...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.16.24 security update

Red Hat build of MicroShift release 4.16.24 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives ...

runc: file descriptor leak

A file descriptor leak issue was found in the runc package. While a user performs OCLOEXEC all file descriptors before executing the container code, the file descriptor is open when performing setcwd2, which means that the reference can be kept alive in the container by configuring the working...

ext4 kernel DoS

The vulnerability of the ext4 kernel component of the Linux operating system is related to errors in resource management within the EXT4DESCPERBLOCK function. Exploiting this vulnerability can allow an attacker to cause a service failure...

CLSA-2024-1731603213 Fix of 76 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-44946 - kcm: Serialise kcmsendmsg for the same socket. CVE-url: https://ubuntu.com/security/CVE-2024-42292 - kobjectuevent: Fix OOB access within zapmodaliasenv CVE-url: https://ubuntu.com/security/CVE-2024-41042 - netfilter: nftables: prefer...

kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list

A vulnerability was found in the Linux kernel's DMA engine component in the irqprocessworklist function. A possible use-after-free condition can occur during list iteration, which is because a descriptor may be freed while another thread is reusing it, potentially leading to access to freed memor...

dwc2 Kernel DoS

The vulnerability of the dwc2 component in the Linux operating system’s kernel is related to improper validation of input data in the dwc2cmplhostisocdmadesc function. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: usb: gadget: core: Check for unset descriptor

A flaw was found in the USB gadget core component of the Linux kernel. This vulnerability occurs when a USB gadget does not properly set up its endpoint descriptor or provides malformed descriptors. A local attacker with the ability to connect a specially crafted USB gadget could trigger a null...

kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors

In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev-bos without checking if it was allocated and initialized. If...

kernel: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds

A vulnerability was found in the Linux kernel's cachefiles component, regarding the handling of anonymous file descriptors. This issue occurs when an anonymous fd is exposed to userland before confirming the success of the copytouser operation, which can lead to a use-after-free condition...

kernel: filelock: Fix fcntl/close race recovery compat path

A vulnerability was found in the Linux kernel in the fcntlsetlk64 function where a potential race condition can be triggered when a file descriptor is closed during a fcntl operation's execution. This can lead to system instability or crashes...

kernel: drm/amdgpu: fix deadlock while reading mqd from debugfs

A flaw was found in the drm/amdgpu subsystem in the Linux kernel, involving a deadlock occurring when reading the Memory Queue Descriptor MQD from debugfs. This issue could cause the system to hang during debug operations...

btrfs: fix race setting file private on concurrent lseek using same fd

...

DEBIAN-CVE-2024-50206

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: fix memory corruption during fq dma init The loop responsible for allocating up to MTKFQDMALENGTH buffers must only touch as many descriptors, otherwise it ends up corrupting unrelated memory. Fix the lo...

DEBIAN-CVE-2024-50187

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in vc4perfmonclosefile, the active performance monitor's...

UBUNTU-CVE-2024-50187

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in vc4perfmonclosefile, the active performance monitor's...

CVE-2024-50187 drm/vc4: Stop the active perfmon before being destroyed

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Stop the active perfmon before being destroyed Upon closing the file descriptor, the active performance monitor is not stopped. Although all perfmons are destroyed in vc4perfmonclosefile, the active performance monitor's...

PT-2024-37068

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns a memory mismanagement problem in the Linux kernel's nvme-pci descriptor table. Specifically, the HMB descriptor table is sized to match the maximum number of...

SUSE CVE-2024-49872

In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfdpinfolios alloc race panic If memfdpinfolios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfdallocfoliomemfd, startidx; if ISERRfolio ret =...