CVE-2024-27070 f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free issue in f2fsfilemapfault syzbot reports a f2fs bug as below: BUG: KASAN: slab-use-after-free in f2fsfilemapfault+0xd1/0x2c0 fs/f2fs/file.c:49 Read of size 8 at addr ffff88807bb22680 by task...

CVE-2024-27069 ovl: relax WARN_ON in ovl_verify_area()

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27069

CVE-2024-27069 affects the Linux kernel overlayfs ovl_verify_area path. The issue was a WARN_ON assertion triggered by syzbot’s copy-up loop when a lower file’s size changes underneath overlayfs. The documented fix relaxes the WARN_ON in ovl_verify_area and aligns error handling (returning EIO fo...

CVE-2024-27069

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27069 ovl: relax WARN_ON in ovl_verify_area()

In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARNON in ovlverifyarea syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This type of use case is documented to cause...

CVE-2024-27059

CVE-2024-27059 refers to a Linux kernel vulnerability in the usb-storage isd200 sub-driver. The issue arises from using ATA ID values HEADS and SECTORS to derive cylinder/head for READ/WRITE CDBs; division/modulus by zero could occur if either value is 0. The fix blocks binding to devices with AT...

CVE-2024-26956

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submitbhwbc". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one...

CVE-2024-26956

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submitbhwbc". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one...

UBUNTU-CVE-2024-26956

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submitbhwbc". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one...

CVE-2024-26956 nilfs2: fix failure to detect DAT corruption in btree and direct mappings

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submitbhwbc". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one...

CVE-2024-26956

CVE-2024-26956 covers a kernel vulnerability in nilfs2 within the Linux kernel. The issue has two flaws: (1) nilfs_get_block() may misinterpret a DAT-corrupted data block as existing, due to DAT translation returning -ENOENT; and (2) after this inconsistency, the caller may request a read on an u...

CVE-2022-48643 netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix nftcountersenabled underflow at nftablesaddchain syzbot is reporting underflow of nftcountersenabled counter at nftablesaddchain 1, for commit 43eb8949cfdffa76 "netfilter: nftables: do not leave chain sta...

CVE-2022-48643 netfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix nftcountersenabled underflow at nftablesaddchain syzbot is reporting underflow of nftcountersenabled counter at nftablesaddchain 1, for commit 43eb8949cfdffa76 "netfilter: nftables: do not leave chain sta...

CVE-2022-48643

The CVE-2022-48643 issue in the Linux kernel concerns nf_tables counters underflow when nft_counters_enabled is decremented in the error path of nft_basechain_init during nf_tables_addchain(). Syzbot reported an underflow after adding a chain; the root cause was nf_tables_chain_destroy() decremen...

SUSE CVE-2024-26883

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on rounduppowoftwo to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arche...

CVE-2024-26862

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignoreoutgoing ignoreoutgoing is read locklessly from devqueuexmitnit and packetgetsockopt Add appropriate READONCE/WRITEONCE annotations. syzbot reported: BUG: KCSAN: data-race in devqueuexmitn...

CVE-2024-26875

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix uaf in pvr2contextsetnotify Syzbot reported BUG: KASAN: slab-use-after-free in pvr2contextsetnotify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read of size 4 at addr ffff888113aeb0d8 by task...

CVE-2024-26884

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on rounduppowoftwo to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches,...

CVE-2024-26882

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: make sure to pull inner header in iptunnelrcv Apply the same fix than ones found in : 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" 1ca1ba465e55 "geneve: make sure to pull inner header in...

CVE-2024-26901

In the Linux kernel, the following vulnerability has been resolved: dosysnametohandle: use kzalloc to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in dosysnametohandle and issued the following report 1. 1 "BUG: KMSAN: kernel-infoleak in instrumentcopytouser...