CVE-2021-47337

The CVE-2021-47337 issue is in the Linux kernel SCSI core path: when an error arises during scsi_host_alloc() and the error-handling ehandler thread fails to spawn, shost->ehandler may be set to ERR_PTR(-ENOMEM) and scsi_host_dev_release() would call kthread_stop() on a NULL/invalid pointer, r...

CVE-2021-47336

CVE-2021-47336 affects the Linux kernel via the smackfs path: the function smk_set_cipso() incorrectly handles a bytes-count restriction, due to a mistaken cross-check that applied only to the SMK_FIXED24_FMT path. The issue was addressed in the patch sequence starting with commit 7ef4c19d245f3dc...

CVE-2021-47336 smackfs: restrict bytes count in smk_set_cipso()

In the Linux kernel, the following vulnerability has been resolved: smackfs: restrict bytes count in smksetcipso Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: PATCH smackfs: restrict byt...

CVE-2021-47334 misc/libmasm/module: Fix two use after free in ibmasm_init_one

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasminitone In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice, and assigned to...

CVE-2021-47333

In the Linux kernel, the following vulnerability has been resolved: misc: alcorpci: fix null-ptr-deref when there is no PCI bridge There is an issue with the ASPMoptional capability checking function. A device might be attached to root complex directly, in this case, bus-selfbridge will be NULL,...

CVE-2021-47322 NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix an Oops in pnfsmarkrequestcommit when doing ODIRECT Fix an Oopsable condition in pnfsmarkrequestcommit when we're putting a set of writes on the commit list to reschedule them after a failed pNFS attempt...

CVE-2021-47321 watchdog: Fix possible use-after-free by calling del_timer_sync()

In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling deltimersync This driver's remove path calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running...

CVE-2021-47316 nfsd: fix NULL dereference in nfs3svc_encode_getaclres

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svcencodegetaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and dreallyispositivedentry, but that looks like overkill to me--zero status should ...

CVE-2021-47316 nfsd: fix NULL dereference in nfs3svc_encode_getaclres

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svcencodegetaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and dreallyispositivedentry, but that looks like overkill to me--zero status should ...

CVE-2021-47313

The CVE-2021-47313 entry pertains to the Linux kernel cpufreq CPPC path, where a memleak could occur due to resources not being freed on policy->init() failure during cppc_cpufreq_cpu_init. The vulnerability, and its fix, are documented across multiple connected sources (kernel patch reference...

CVE-2021-47312

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix dereference of null pointer flow In the case where chain-flags & NFTCHAINHWOFFLOAD is false then nftflowrulecreate is not called and flow is NULL. The subsequent error handling execution via label...

CVE-2021-47309

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate-data before returning from skbtunnelinfo skbtunnelinfo returns pointer of lwtstate-data as iptunnelinfo type without validation. lwtstate-data can have various types such as mplsiptunnelencap, etc and these...

CVE-2021-47309 net: validate lwtstate->data before returning from skb_tunnel_info()

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate-data before returning from skbtunnelinfo skbtunnelinfo returns pointer of lwtstate-data as iptunnelinfo type without validation. lwtstate-data can have various types such as mplsiptunnelencap, etc and these...

CVE-2021-47307 cifs: prevent NULL deref in cifs_compose_mount_options()

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifscomposemountoptions The optional @ref parameter might contain an NULL nodename, so prevent dereferencing it in cifscomposemountoptions. Addresses-Coverity: 1476408 "Explicit null dereferenced"...

CVE-2021-47307

CVE-2021-47307 affects the Linux kernel CIFS implementation. The issue is a NULL dereference in cifs_compose_mount_options() when the optional ref parameter contains a NULL node_name. The vulnerability was fixed in the Linux kernel (details in the cited commits). CVSS data in the document set sho...

CVE-2021-47305

In CVE-2021-47305, the Linux kernel’s dma-buf/sync_file implementation leaks fences on error paths due to missing dma_fence_put() calls when merging fences and in krealloc_array failure. The fix ensures i and the fences array are zero-initialized and that all fences are dma_fence_put() and the fe...

CVE-2021-47305

In the Linux kernel, the following vulnerability has been resolved: dma-buf/syncfile: Don't leak fences on merge failure Each addfence call does a dmafenceget on the relevant fence. In the error path, we weren't calling dmafenceput so all those fences got leaked. Also, in the kreallocarray failur...

CVE-2021-47303 bpf: Track subprog poke descriptors correctly and fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: bpf: Track subprog poke descriptors correctly and fix use-after-free Subprograms are calling mappoketrack, but on program release there is no hook to call mappokeuntrack. However, on program release, the aux memory and poke...

CVE-2021-47297 net: fix uninit-value in caif_seqpkt_sendmsg

In the Linux kernel, the following vulnerability has been resolved: net: fix uninit-value in caifseqpktsendmsg When nrsegs equal to zero in iovecfromuser, the object msg-msgiter.iov is uninit stack memory in caifseqpktsendmsg which is defined in syssendmsg. So we cann't just judge...

CVE-2021-47296

CVE-2021-47296 corresponds to a Linux kernel KVM PPC issue: vcpu_load leak where vcpu_put is not called if a user copy fails, risking preempt notifier corruption and system crashes. Connected documents (Astra Linux bulletin and related security advisories) confirm a patch has been applied to fix ...