CVE-2024-49965 ocfs2: remove unreasonable unlock in ocfs2_read_blocks

In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove unreasonable unlock in ocfs2readblocks Patch series "Misc fixes for ocfs2readblocks", v5. This series contains 2 fixes for ocfs2readblocks. The first patch fix the issue reported by syzbot, which detects bad unlock...

CVE-2024-49965 ocfs2: remove unreasonable unlock in ocfs2_read_blocks

In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove unreasonable unlock in ocfs2readblocks Patch series "Misc fixes for ocfs2readblocks", v5. This series contains 2 fixes for ocfs2readblocks. The first patch fix the issue reported by syzbot, which detects bad unlock...

CVE-2024-49961 media: i2c: ar0521: Use cansleep version of gpiod_set_value()

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ar0521: Use cansleep version of gpiodsetvalue If we use GPIO reset from I2C port expander, we must use cansleep variant of GPIO functions. This was not done in ar0521poweron/ar0521poweroff functions. Let's fix that...

CVE-2024-49959 jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error

In the Linux kernel, the following vulnerability has been resolved: jbd2: stop waiting for space when jbd2cleanupjournaltail returns error In jbd2logwaitforspace, we might call jbd2cleanupjournaltail to recover some journal space. But if an error occurs while executing jbd2cleanupjournaltail e.g....

CVE-2024-49955

CVE-2024-49955 : In the Linux kernel, ACPI battery handling fixes a crash when unregistering a battery hook. If a battery hook returns an error while adding a battery, the hook is auto-unregistered; the provider cannot detect this, and later calls to battery_hook_unregister() on an already-unregi...

CVE-2024-49951

The CVE-2024-49951 entry describes a Linux kernel vulnerability in the Bluetooth MGMT layer where mgmt_index_removed can crash if called while commands are queued on cmd_sync. The issue can lead to a crash trace in mgmt_pending_remove, mgmt_remove_adv_monitor_complete, and hci_cmd_sync_work, due ...

CVE-2024-49940

CVE-2024-49940 (Linux kernel) affects the l2tp code path and describes a tunnel refcount underflow window during session creation and tunnel refcount handling. Root cause details: a backpointer from a session to its tunnel is set in l2tp_session_create before the tunnel refcount is incremented by...

CVE-2024-49933

CVE-2024-49933 is a Linux kernel issue related to blk_iocost where UBSAN detected shift-out-of-bounds in ioc_forgive_debts() (shift exponent 80 on a 64-bit type). The connected Astra Linux bulletin confirms the same vulnerability and describes the concrete out-of-bounds shifts in block/blk-iocost...

CVE-2024-49917

CVE-2024-49917 concerns the Linux kernel’s drm/amd/display path. The vulnerability is due to a potential NULL pointer dereference in dcn30_init_hw when either dc->clk_mgr or dc->clk_mgr->funcs is NULL. The fixed commits add explicit NULL checks to prevent accessing clk_mgr/clk_mgr->fu...

CVE-2024-49916 drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr and clkmgr-funcs in dcn401inithw This commit addresses a potential null pointer dereference issue in the dcn401inithw function. The issue could occur when dc-clkmgr or dc-clkmgr-funcs is...

CVE-2024-49915 drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clkmgr in dcn32inithw This commit addresses a potential null pointer dereference issue in the dcn32inithw function. The issue could occur when dc-clkmgr is null. The fix adds a check to ensure...

CVE-2024-49914 drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for pipectx-planestate in dcn20programpipe This commit addresses a null pointer dereference issue in the dcn20programpipe function. The issue could occur when pipectx-planestate is null. The fix ad...

CVE-2024-49911 drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn20setoutputtransferfunc This commit adds a null check for the setoutputgamma function pointer in the dcn20setoutputtransferfunc function. Previously, setoutputgamma was...

CVE-2024-49900 jfs: Fix uninit-value access of new_ea in ea_buffer

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of newea in eabuffer syzbot reports that lzo1x1docompress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x1docompress+0x19f9/0x2510...

CVE-2024-49898 drm/amd/display: Check null-initialized variables

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null-initialized variables WHAT & HOW drrtiming and subvppipe are initialized to null and they are not always assigned new values. It is necessary to check for null before dereferencing. This fixes 2...

CVE-2024-49894 drm/amd/display: Fix index out of bounds in degamma hardware format translation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue in cmhelpertranslatecurvetodegammahwformat function. The issue could occur when the index 'i' exceeds the number of...

CVE-2024-49894 drm/amd/display: Fix index out of bounds in degamma hardware format translation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue in cmhelpertranslatecurvetodegammahwformat function. The issue could occur when the index 'i' exceeds the number of...

CVE-2024-49887

CVE-2024-49887 targets the f2fs file system in the Linux kernel. Root cause: when injecting a fault for “no free segment,” the kernel could panic in __allocate_new_segment / get_new_segment, triggering a serious system halt. The description notes the issue was resolved by a fix that prevents pani...

CVE-2024-49877 ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2setbufferuptodate When doing cleanup, if flags without OCFS2BHREADAHEAD, it may trigger NULL pointer dereference in the following ocfs2setbufferuptodate if bh is NULL...

CVE-2024-49869 btrfs: send: fix buffer overflow detection when copying path to cache entry

In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 "btrfs: send: annotate struct namecacheentry with countedby" we annotated the variable length array "name" from the...