CVE-2021-47395

In the Linux kernel, the following vulnerability has been resolved: mac80211: limit injected vht mcs/nss in ieee80211parsetxradiotap Limit max values for vht mcs and nss in ieee80211parsetxradiotap routine in order to fix the following warning reported by syzbot: WARNING: CPU: 0 PID: 10717 at...

CVE-2021-47395 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap

In the Linux kernel, the following vulnerability has been resolved: mac80211: limit injected vht mcs/nss in ieee80211parsetxradiotap Limit max values for vht mcs and nss in ieee80211parsetxradiotap routine in order to fix the following warning reported by syzbot: WARNING: CPU: 0 PID: 10717 at...

CVE-2021-47395 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap

In the Linux kernel, the following vulnerability has been resolved: mac80211: limit injected vht mcs/nss in ieee80211parsetxradiotap Limit max values for vht mcs and nss in ieee80211parsetxradiotap routine in order to fix the following warning reported by syzbot: WARNING: CPU: 0 PID: 10717 at...

CVE-2021-47395

CVE-2021-47395 : Linux kernel/mac80211 vulnerability where the rate limiting for injected VHT MCS/NSS in ieee80211_parse_tx_radiotap was tightened to fix a syzkaller warning. Affected component: mac80211 (ieee80211_parse_tx_radiotap, ieee80211_rate_set_vht). Reported impact in the public docs is ...

CVE-2021-47370 mptcp: ensure tx skbs always have the MPTCP ext

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure tx skbs always have the MPTCP ext Due to signed/unsigned comparison, the expression: info-sizegoal - skb-len 0 evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache...

CVE-2021-47370 mptcp: ensure tx skbs always have the MPTCP ext

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure tx skbs always have the MPTCP ext Due to signed/unsigned comparison, the expression: info-sizegoal - skb-len 0 evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache...

CVE-2021-47370

CVE-2021-47370 affects the Linux kernel and concerns the MPTCP path: a signed/unsigned comparison in the code path that refills the TX cache can misbehave when size_goal is smaller than skb->len, causing the core TCP path to allocate an skb without the MPTCP extension. The fix rewrites the exp...

CVE-2021-47370

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure tx skbs always have the MPTCP ext Due to signed/unsigned comparison, the expression: info-sizegoal - skb-len 0 evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache...

CVE-2021-47344 media: zr364xx: fix memory leak in zr364xx_start_readpipe

In the Linux kernel, the following vulnerability has been resolved: media: zr364xx: fix memory leak in zr364xxstartreadpipe syzbot reported memory leak in zr364xx driver. The problem was in non-freed urb in case of usbsubmiturb fail. backtrace: kmalloc include/linux/slab.h:561 inline...

CVE-2021-47339 media: v4l2-core: explicitly clear ioctl input data

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47280 drm: Fix use-after-free read in drm_getunique()

In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drmgetunique There is a time-of-check-to-time-of-use error in drmgetunique due to retrieving filepriv-master prior to locking the device's master mutex. An example can be seen in the crash report o...

CVE-2021-47280 drm: Fix use-after-free read in drm_getunique()

In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drmgetunique There is a time-of-check-to-time-of-use error in drmgetunique due to retrieving filepriv-master prior to locking the device's master mutex. An example can be seen in the crash report o...

CVE-2021-47280

In the Linux kernel, the following vulnerability has been resolved: drm: Fix use-after-free read in drmgetunique There is a time-of-check-to-time-of-use error in drmgetunique due to retrieving filepriv-master prior to locking the device's master mutex. An example can be seen in the crash report o...

CVE-2021-47249 net: rds: fix memory leak in rds_recvmsg

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix memory leak in rdsrecvmsg Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rdsrecvmsgstruct socket sock, struct msghdr msg, sizet size, int msgflags ... if...

CVE-2021-47249

CVE-2021-47249 concerns a memory-leak in the Linux kernel’s net: rds path, fixed by correcting refcount handling in rds_recvmsg. The issue occurred when an error happened in rds_cmsg_recv(): after a successful rds_next_incoming(rs, &inc) the code would increment inc’s refcount, but on failure to ...

CVE-2021-47249

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix memory leak in rdsrecvmsg Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rdsrecvmsgstruct socket sock, struct msghdr msg, sizet size, int msgflags ... if...

CVE-2021-47249 net: rds: fix memory leak in rds_recvmsg

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix memory leak in rdsrecvmsg Syzbot reported memory leak in rds. The problem was in unputted refcount in case of error. int rdsrecvmsgstruct socket sock, struct msghdr msg, sizet size, int msgflags ... if...

CVE-2021-47240 net: qrtr: fix OOB Read in qrtr_endpoint_post

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...

CVE-2021-47240

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix OOB Read in qrtrendpointpost Syzbot reported slab-out-of-bounds Read in qrtrendpointpost. The problem was in wrong size type: if len != ALIGNsize, 4 + hdrlen goto err; If size from qrtrhdr is 4294967293 0xfffffffd,...