CVE-2024-49959

In the Linux kernel, the following vulnerability has been resolved: jbd2: stop waiting for space when jbd2cleanupjournaltail returns error In jbd2logwaitforspace, we might call jbd2cleanupjournaltail to recover some journal space. But if an error occurs while executing jbd2cleanupjournaltail e.g....

CVE-2024-49958

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our customers reported a crash and a corrupted ocfs2 filesystem. The crash was due to the detection of corruption. Upon troubleshooting, the fsck -fn outp...

CVE-2024-49957

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process, if journalreset fails because of too short journal, then lead to jbd2journalload fails with NULL jsbbuffer. Subsequently, ocfs2journalshutdown calls...

CVE-2024-49956

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix double destroyworkqueue error When gfs2fillsuper fails, destroyworkqueue is called within gfs2glhashclear, and the subsequent code path calls destroyworkqueue on the same work queue again. This issue can be fixed by...

CVE-2024-49954 static_call: Replace pointless WARN_ON() in static_call_module_notify()

In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in staticcallmodulenotify staticcallmodulenotify triggers a WARNON, when memory allocation fails in staticcalladdmodule. That's not really justified, because the failure case must be correctly...

CVE-2024-49955

In the Linux kernel, the following vulnerability has been resolved: ACPI: battery: Fix possible crash when unregistering a battery hook When a battery hook returns an error when adding a new battery, then the battery hook is automatically unregistered. However the battery hook provider cannot kno...

CVE-2024-49954

In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in staticcallmodulenotify staticcallmodulenotify triggers a WARNON, when memory allocation fails in staticcalladdmodule. That's not really justified, because the failure case must be correctly...

CVE-2024-49953

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash caused by calling xfrmstatedelete twice The km.state is not checked in driver's delayed work. When xfrmstatecheckexpire is called, the state can be reset to XFRMSTATEEXPIRED, even if it is XFRMSTATEDEAD...

CVE-2024-49951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible crash on mgmtindexremoved If mgmtindexremoved is called while there are commands queued on cmdsync it could lead to crashes like the bellow trace: 0x0000053D: listdelentryvalidorreport+0x98/0xdc...

CVE-2024-49952

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption syzbot found that nfdupipv4 or nfdupipv6 could write per-cpu variable nfskbduplicated in an unsafe way 1. Disabling preemption as hinted by the splat is not enough, we have ...

CVE-2024-49952 netfilter: nf_tables: prevent nf_skb_duplicated corruption

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption syzbot found that nfdupipv4 or nfdupipv6 could write per-cpu variable nfskbduplicated in an unsafe way 1. Disabling preemption as hinted by the splat is not enough, we have ...

CVE-2024-49950

CVE-2024-49950 affects the Linux kernel Bluetooth L2CAP implementation (l2cap_connect), with a slab-use-after-free/KASAN issue reported in l2cap_connect.constprop.0. Connected advisories (Unity Linux UTSA-2026-005148, Azure Linux CVE advisory, MiracleLinux AXSA:2025-10392) confirm the fix has bee...

CVE-2024-49950

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2capconnect Syzbot reported BUG: KASAN: slab-use-after-free in l2capconnect.constprop.0+0x10d8/0x1270 net/bluetooth/l2capcore.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CP...

CVE-2024-49947

In the Linux kernel, the following vulnerability has been resolved: net: test for not too small csumstart in virtionethdrtoskb syzbot was able to trigger this warning 1, after injecting a malicious packet through afpacket, setting skb-csumstart and thus the transport header to an incorrect value...

CVE-2024-49946 ppp: do not assume bh is held in ppp_channel_bridge_input()

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

CVE-2024-49946 ppp: do not assume bh is held in ppp_channel_bridge_input()

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

CVE-2024-49944 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start

In the Linux kernel, the following vulnerability has been resolved: sctp: set skstate back to CLOSED if autobind fails in sctplistenstart In sctplistenstart invoked by sctpinetlisten, it should set the skstate back to CLOSED if sctpautobind fails due to whatever reason. Otherwise, next time when...

CVE-2024-49942 drm/xe: Prevent null pointer access in xe_migrate_copy

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...

CVE-2024-49943

CVE-2024-49943 affects the Linux kernel DRM XE driver (guc_submit_wedged_fini). A missing locking around wedged_fini permits a use-after-free when a non-wedged queue is dereferenced concurrently with an async queue destroy. The fix is to hold the submission_state lock during the wedge-status chec...

CVE-2024-49942

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xemigratecopy xemigratecopy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xemigratecopy. To avoid this situation,...