CVE-2024-35976 xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING

In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDPUMEM|COMPLETIONFILLRING syzbot reported an illegal copy in xsksetsockopt 1 Make sure to validate setsockopt @optlen parameter. 1 BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset...

CVE-2024-35973 geneve: fix header validation in geneve[6]_xmit_skb

In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve6xmitskb syzbot is able to trigger an uninit-value in genevexmit 1 Problem : While most ip tunnel helpers like iptunnelgetdsfield uses skbprotocolskb, true, pskbinetmaypull is only using...

CVE-2024-35967 Bluetooth: SCO: Fix not validating setsockopt user input

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported scosocksetsockopt is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49...

CVE-2024-35967 Bluetooth: SCO: Fix not validating setsockopt user input

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported scosocksetsockopt is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49...

CVE-2024-35967 Bluetooth: SCO: Fix not validating setsockopt user input

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported scosocksetsockopt is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset include/linux/sockptr.h:49...

CVE-2024-35966 Bluetooth: RFCOMM: Fix not validating setsockopt user input

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcommsocksetsockoptold is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copyfromsockptroffset...

UBUNTU-CVE-2024-35934

In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason 1 This patch returns early from...

CVE-2024-35934 net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list()

In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason 1 This patch returns early from...

CVE-2024-35934

The CVE-2024-35934 issue affects the Linux kernel net/smc subsystem. Affected component: smc_pnet-related code in net/smc (pnet IDs list creation). Root cause: excessive RTNL (rtnl) lock pressure during net namespace/pnet initialization, caused by smc_pnet_create_pnetids_list() acquiring rtnl in ...

CVE-2024-35896

In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot reports showing old bugs exposed by BPF after commit 20f2505fb436 "bpf: Try to avoid kzalloc in cgroup/s,getsockopt" setsockopt @optlen argument should be...

CVE-2024-35915 nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncidevup and ncintfpacket syzbot reported the following uninit-value access issue 12: ncirxwork parses and processes received packet. When the payload length is zero, each message type handler reads...

CVE-2024-35915

CVE-2024-35915 affects the Linux kernel NFC/NCI subsystem. The issue is an uninitialized payload read in nci_rx_work() when a received packet has a zero-length payload, leading to potential uninitialized data exposure. The patch fixes the vulnerability by validating the payload size before invoki...

CVE-2024-35892

CVE-2024-35892 stems from a Linux kernel net/sched issue where qdisc_tree_reduce_backlog() was called with the qdisc lock held while RTNL was not held, triggering a lockdep splat due to unsafe RCU usage. The fix switches from qdisc_lookup() to qdisc_lookup_rcu() to safely dereference qdisc data u...

CVE-2024-35892 net/sched: fix lockdep splat in qdisc_tree_reduce_backlog()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix lockdep splat in qdisctreereducebacklog qdisctreereducebacklog is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup syzbot reported: WARNING: suspicious RCU usage...

CVE-2024-35849

CVE-2024-35849 affects the Linux kernel btrfs_ioctl_logical_to_ino path. The issue is an information leak: a struct btrfs_data_container allocated with kvmalloc() is copied back to user space without zero-filling, exposing uninitialized memory (Bytes 40-65535) to user-space. The root cause is lac...

CVE-2024-35849 btrfs: fix information leak in btrfs_ioctl_logical_to_ino()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfsioctllogicaltoino Syzbot reported the following information leak for in btrfsioctllogicaltoino: BUG: KMSAN: kernel-infoleak in instrumentcopytouser include/linux/instrumented.h:114 inline BUG:...

CVE-2024-35841 net: tls, fix WARNIING in __sk_msg_free

In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in skmsgfree A splice with MSGSPLICEPAGES will cause tls code to use the tlsswsendmsgsplice path in the TLS sendmsg code to move the user provided pages from the msg into the msgpl. This will loop over the...

DEBIAN-CVE-2022-48689

In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report 1 showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using...

CVE-2022-48689

In the Linux kernel, the following vulnerability has been resolved: tcp: TX zerocopy should not sense pfmemalloc status We got a recent syzbot report 1 showing a possible misuse of pfmemalloc page status in TCP zerocopy paths. Indeed, for pages coming from user space or other layers, using...

UBUNTU-CVE-2022-48671

In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpusreadlock to cgroupattachtaskall syzbot is hitting percpurwsemassertheld&cpuhotpluglock warning at cpusetattach 1, for commit 4f7e7236435ca0ab "cgroup: Fix threadgrouprwsem cpusreadlock deadlock" missed tha...