CVE-2024-56597 jfs: fix shift-out-of-bounds in dbSplit

In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmtbudmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself...

CVE-2024-56597

CVE-2024-56597 is a confirmed Linux kernel vulnerability affecting the JFS filesystem logic. The issue is a shift-out-of-bounds in jfs/dbSplit, triggered when dmt_budmin is less than zero, leading to errors in later stages. The fix adds a pre-check in dbAllocCtl to return an error earlier, preven...

CVE-2024-56581

CVE-2024-56581 affects the Linux kernel’s Btrfs code. The issue is a use-after-free in btrfs_ref_tree_mod() after inserting a new ref entry into a block entry’s rb-tree when an unexpected action (BTRFS_DROP_DELAYED_REF) is encountered. The error path freed the ref entry without removing it from t...

CVE-2024-56581 btrfs: ref-verify: fix use-after-free after invalid ref action

In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfsreftreemod after we successfully inserted the new ref entry local variable 'ref' into the respective block entry's rbtree local variable 'be', if we find an...

CVE-2024-56581 btrfs: ref-verify: fix use-after-free after invalid ref action

In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfsreftreemod after we successfully inserted the new ref entry local variable 'ref' into the respective block entry's rbtree local variable 'be', if we find an...

CVE-2024-56580 media: qcom: camss: fix error path on configuration of power domains

In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: fix error path on configuration of power domains There is a chance to meet runtime issues during configuration of CAMSS power domains, because on the error path devpmdomaindetach is unexpectedly called with NU...

CVE-2024-56573

In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdlineptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. cmdline refers to the pool allocation that should be freed whe...

CVE-2024-56552 drm/xe/guc_submit: fix race around suspend_pending

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gucsubmit: fix race around suspendpending Currently in some testcases we can trigger: xe 0000:03:00.0: drm Assertion execqueuedestroyedq failed! .... WARNING: CPU: 18 PID: 2640 at drivers/gpu/drm/xe/xegucsubmit.c:1826...

CVE-2024-56552

In Linux kernel DRM/XE GuC submission path, CVE-2024-56552 stems from a race between suspend_pending, disable_scheduling, and queue destruction. When suspending a queue and then closing it, the close path can signal suspendFence after the disable_scheduling response, which may clear suspend_pendi...

CVE-2024-56546

In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnxaddcbforsuspend If we fail to allocate memory for cbdata by kmalloc, the memory allocation for evedata is never freed, add the missing kfree in the error handling path...

CVE-2024-53177

In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to opencacheddir error paths If opencacheddir encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in opencacheddir freeing the...

DEBIAN-CVE-2024-53165

In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in registerintccontroller In the error handling for this function, d is freed without ever removing it from intclist which would lead to a use after free. To fix this, let's only add it to the lis...

UBUNTU-CVE-2024-56540

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Prevent recovery invocation during probe and resume Refactor IPC send and receive functions to allow correct handling of operations that should not trigger a recovery process. Expose ivpusendreceiveinternal, which is...

UBUNTU-CVE-2024-56546

In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnxaddcbforsuspend If we fail to allocate memory for cbdata by kmalloc, the memory allocation for evedata is never freed, add the missing kfree in the error handling path...

CVE-2024-56546 drivers: soc: xilinx: add the missing kfree in xlnx_add_cb_for_suspend()

In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnxaddcbforsuspend If we fail to allocate memory for cbdata by kmalloc, the memory allocation for evedata is never freed, add the missing kfree in the error handling path...

CVE-2024-56546

CVE-2024-56546 affects the Linux kernel in drivers/soc/xilinx, specifically xlnx_add_cb_for_suspend. The issue arises if kmalloc fails to allocate cb_data, because the error path does not free eve_data (missing kfree), potentially causing a memory leak and impacting availability. The patch adds t...

CVE-2024-56540 accel/ivpu: Prevent recovery invocation during probe and resume

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Prevent recovery invocation during probe and resume Refactor IPC send and receive functions to allow correct handling of operations that should not trigger a recovery process. Expose ivpusendreceiveinternal, which is...

CVE-2024-53199

CVE-2024-53199 affects the Linux kernel ASoC: imx-audmix driver. The bug was that devm_kasprintf() can return NULL on failure and imx_audmix_probe() did not check for it, risking a NULL pointer dereference. A NULL-check was added in imx_audmix_probe() to mitigate. The public-facing details specif...

CVE-2024-53177

CVE-2024-53177 affects the Linux kernel SMB client cache code. The vulnerability arises from a use-after-free in smb2_cached_lease_break/open_cached_dir error handling, where freeing a cfid could race with a pending lease-break work item. The fix updates open_cached_dir() to drop references inste...

CVE-2024-53177 smb: prevent use-after-free due to open_cached_dir error paths

In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to opencacheddir error paths If opencacheddir encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in opencacheddir freeing the...