CVE-2024-56558 nfsd: make sure exp active before svc_export_show

In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svcexportshow The function eshow was called with protection from RCU. This only ensures that exp will not be freed. Therefore, the reference count for exp can drop to zero, which will trigger a...

CVE-2024-56550 s390/stacktrace: Use break instead of return statement

In the Linux kernel, the following vulnerability has been resolved: s390/stacktrace: Use break instead of return statement archstackwalkusercommon contains a return statement instead of a break statement in case storeip fails while trying to store a callchain entry of a user space process. This m...

DEBIAN-CVE-2024-53232

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Implement blocking domain This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug iommugroupsetdomainnofail attaching the default domain fails when the platform no...

UBUNTU-CVE-2024-53195

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Get rid of userspaceirqchipinuse Improper use of userspaceirqchipinuse led to syzbot hitting the following WARNON in kvmtimerupdateirq: WARNING: CPU: 0 PID: 3281 at arch/arm64/kvm/archtimer.c:459...

UBUNTU-CVE-2024-53222

In the Linux kernel, the following vulnerability has been resolved: zram: fix NULL pointer in compalgorithmshow LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ 3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0...

UBUNTU-CVE-2024-53166

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfqlimitdepth Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd-lock, however bfqlimitdepth is deferencing bfqq from bic without the lock, this can lead to UAF if t...

CVE-2024-56549 cachefiles: Fix NULL pointer dereference in object->file

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object-file At present, the object-file has the NULL pointer dereference problem in ondemand-mode. The root cause is that the allocated fd and object-file lifetime are inconsistent, and...

CVE-2024-56548 hfsplus: don't query the device logical block size multiple times

In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOPSETBLOCKSIZE. While this may cause other issues like IO being rejected, in t...

CVE-2024-56541 wifi: ath12k: fix use-after-free in ath12k_dp_cc_cleanup()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix use-after-free in ath12kdpcccleanup During ath12k module removal, in ath12kcoredeinit, ath12kmacdestroy un-registers ah-hw from mac80211 and frees the ah-hw as well as all the ar's in it. After this...

CVE-2024-53210 s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSGPEEK causes memory leak in iucvsockdestruct Passing MSGPEEK flag to skbrecvdatagram increments skb refcount skb-users and iucvsockrecvmsg does not decrement skb refcount at exit. This results in skb memory leak in...

CVE-2024-53206 tcp: Fix use-after-free of nreq in reqsk_timer_handler().

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsktimerhandler. The cited commit replaced inetcskreqskqueuedropandput with inetcskreqskqueuedrop and reqskput in reqsktimerhandler. Then, oreq should be passed to reqskput instead of req;...

CVE-2024-53175 ipc: fix memleak if msg_init_ns failed in create_ipc_ns

In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msginitns failed in createipcns Percpu memory allocation may failed during createipcns however this fail is not handled properly since ipc sysctls and mq sysctls is not released properly. Fix this by release...

CVE-2024-53173 NFSv4.0: Fix a use-after-free problem in the asynchronous open()

In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfsreleaseseqid in...

UBUNTU-CVE-2024-53153

In the Linux kernel, the following vulnerability has been resolved: PCI: qcom-ep: Move controller cleanups to qcompcieperstdeassert Currently, the endpoint cleanup function dwpcieepcleanup and EPF deinit notify function pciepcdeinitnotify are called during the execution of qcompcieperstassert i.e...

CVE-2024-53150

The CVE-2024-53150 issue affects the Linux kernel USB-audio (ALSA: usb-audio). The root cause is that the driver does not validate the bLength field of descriptors while traversing clock-related descriptors, allowing a bogus shorter descriptor to cause out-of-bounds reads. The public patch adds s...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50035)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50035 advisory. - In the Linux kernel, the following vulnerability has been resolved: ppp: fix pppasyncencode illegal access...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-47698)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47698 advisory. - In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: f...

Medium: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: iouring: fix possible deadlock in ioregisteriowqmaxworkers CVE-2024-41080 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points CVE-2024-4999...

kernel: netfilter: flowtable: initialise extack before use

A flaw was found in the Linux kernel's netfilter flowtable feature. A local attacker could exploit a missing initialization of the extack structure, leading to a denial of service. This vulnerability could allow an attacker with local access to crash the system...

kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook

A flaw was found in the Linux kernel. A highly privileged user on a Network File System NFS client can bypass intended security restrictions and modify security labels on files located on an NFS filesystem. This issue occurs even when root squashing, a security feature designed to limit root user...