CVE-2024-26892 wifi: mt76: mt7921e: fix use-after-free in free_irq()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-free in freeirq From commit a304e1b82808 "PATCH Debug shared irqs", there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For th...

CVE-2024-26891

CVE-2024-26891 is a Linux kernel local-privilege issue in the IOMMU/VT-d path where ATS invalidation can be sent for a hotplug-disconnected device, potentially causing a hard lockup/system hang. The linked advisories show concrete fixes in Linux kernel streams for AL2 kernels: Amazon Linux 2 kern...

CVE-2024-26883

CVE-2024-26883 : In the Linux kernel, a vulnerability was fixed that affects 32-bit architectures in the stackmap handling used by BPF. The overflow risk arises when roundup_pow_of_two() is used to compute the number of hash buckets, as a 32‑bit left shift can overflow and cause undefined behavio...

CVE-2024-26880 dm: call the resume method on internal suspend

In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resume methods were not paired correctly;...

CVE-2024-26877 crypto: xilinx - call finalize with bh disabled

In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx - call finalize with bh disabled When calling cryptofinalizerequest, BH should be disabled to avoid triggering the following calltrace: ------------ cut here ------------ WARNING: CPU: 2 PID: 74 at...

CVE-2024-26877

CVE-2024-26877 concerns the Linux kernel crypto path for Xilinx/ZynqMP AES (crypto: xilinx – call finalize with bh disabled). The provided advisories describe a root-cause as performing crypto_finalize_request with BH enabled, which can trigger a call trace in crypto_finalize_request and related ...

CVE-2024-26876 drm/bridge: adv7511: fix crash on irq during probe

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: adv7511: fix crash on irq during probe Moved IRQ registration down to end of adv7511probe. If an IRQ already is pending during adv7511probe before adv7511cecinit then cecreceivedmsgts could crash using uninitialized...

CVE-2024-26874 drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicflush, it's is not...

CVE-2024-26870

CVE-2024-26870: Linux kernel NFSv4.2 fix guards a kernel BUG in mm/usercopy.c during listxattr handling. When listxattr size > 0 and nfs4_listxattr returns more bytes than requested (e.g., after generic_listxattr outputs system.nfs4_acl), a BUG at mm/usercopy.c:102 can trigger a kernel Oops. T...

CVE-2024-26869 f2fs: fix to truncate meta inode pages forcely

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to truncate meta inode pages forcely Below race case can cause data corruption: Thread A GC thread - gcdatasegment - radatablock - locked metainode page - f2fsinplacewritedata - invalidatemappingpages : fail to invalida...

CVE-2024-26868 nfs: fix panic when nfs4_ff_layout_prepare_ds() fails

In the Linux kernel, the following vulnerability has been resolved: nfs: fix panic when nfs4fflayoutprepareds fails We've been seeing the following panic in production BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0 RIP:...

CVE-2024-26863 hsr: Fix uninit-value access in hsr_get_node()

In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsrgetnode KMSAN reported the following uninit-value access issue 1: ===================================================== BUG: KMSAN: uninit-value in hsrgetnode+0xa2e/0xa40 net/hsr/hsrframereg.c:2...

CVE-2024-26862 packet: annotate data-races around ignore_outgoing

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignoreoutgoing ignoreoutgoing is read locklessly from devqueuexmitnit and packetgetsockopt Add appropriate READONCE/WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in devqueuexmitn...

CVE-2024-26860 dm-integrity: fix a memory leak when rechecking the data

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a memory leak when rechecking the data Memory for the "checksums" pointer will leak if the data is rechecked after checksum failure because the associated kfree won't happen due to 'goto skipio'. Fix this by...

CVE-2023-52644 wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled

In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue. Stop/wake queue 0 when QoS is disabl...

CVE-2024-26857 geneve: make sure to pull inner header in geneve_rx()

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneverx syzbot triggered a bug in geneverx 1 Issue is similar to the one I fixed in commit 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" We have to save...

CVE-2024-26857 geneve: make sure to pull inner header in geneve_rx()

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneverx syzbot triggered a bug in geneverx 1 Issue is similar to the one I fixed in commit 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" We have to save...

CVE-2024-26857

CVE-2024-26857 affects the Linux kernel’s geneve_rx path in drivers/net/geneve.c, where skb->network_header must be saved before calling pskb_inet_may_pull() to recompute the network header after pulling headers. The issue is tied to uninitialized values in IP_ECN_decapsulate and the chain lea...

CVE-2024-26856 net: sparx5: Fix use after free inside sparx5_del_mact_entry

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: Fix use after free inside sparx5delmactentry Based on the static analyzis of the code it looks like when an entry from the MAC table was removed, the entry was still used after being freed. More precise the vid of th...

CVE-2024-26836

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix password opcode ordering for workstations The Lenovo workstations require the password opcode to be run before the attribute value is changed if Admin password is enabled. Tested on some Thinkpads to...