CVE-2024-46723 drm/amdgpu: fix ucode out-of-bounds read warning

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode may out-of-bounds...

CVE-2024-46715 driver: iio: add missing checks on iio_info's callback access

In the Linux kernel, the following vulnerability has been resolved: driver: iio: add missing checks on iioinfo's callback access Some callbacks from iioinfo structure are accessed without any check, so if a driver doesn't implement them trying to access the corresponding sysfs entries produce a...

CVE-2024-46712

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders to them using accelerated apis. Without 3d the entire content of dumb buffers stays in the guest making all of the extra...

CVE-2024-46701 libfs: fix infinite directory reads for offset dir

In the Linux kernel, the following vulnerability has been resolved: libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations from simplediroperations to simpleoffsetdiroperations, every rename happened will fill new dentry to dest dir's maple...

CVE-2024-46700

CVE-2024-46700 is rejected/not used.

CVE-2024-46693 soc: qcom: pmic_glink: Fix race during initialization

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmicglink: Fix race during initialization As pointed out by Stephen Boyd it is possible that during initialization of the pmicglink child drivers, the protection-domain notifiers fires, and the associated work is...

CVE-2024-46690 nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4deleggetattrconflict in presence of third party lease It is not safe to dereference fl-c.flcowner without first confirming fl-fllmops is the expected manager. nfsd4deleggetattrconflict tests fllmops but largely...

CVE-2024-46684 binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: fix AUXV size calculation when ELFHWCAP2 is defined createelffdpictables does not correctly account the space for the AUX vector when an architecture has ELFHWCAP2 defined. Prior to the commit 10e29251be0e...

CVE-2024-46682 nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open

In the Linux kernel, the following vulnerability has been resolved: nfsd: prevent panic for nfsv4.0 closed files in nfs4showopen Prior to commit 3f29cc82a84c "nfsd: split scstatus out of sctype" statesshow relied on sctype field to be of valid type before calling into a subfunction to show conten...

CVE-2024-45019 net/mlx5e: Take state lock during tx timeout reporter

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take state lock during tx timeout reporter mlx5esafereopenchannels requires the state lock taken. The referenced changed in the Fixes tag removed the lock to fix another issue. This patch adds it back but at a later...

CVE-2024-45017 net/mlx5: Fix IPsec RoCE MPV trace call

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec RoCE MPV trace call Prevent the call trace below from happening, by not allowing IPsec creation over a slave, if master device doesn't support IPsec. WARNING: CPU: 44 PID: 16136 at kernel/locking/rwsem.c:240...

CVE-2024-45012

The CVE-2024-45012 issue is in the Linux kernel related to the nouveau driver when SG_DEBUG is enabled with an active iommu. The crash trace shows a kernel BUG triggered in sg_init_one, indicating a failure in DMA handling within the nouveau firmware/driver path. The published fixes in connected ...

CentOS 9 : kernel-5.14.0-505.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the kernel-5.14.0-505.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in smcpnetcreatepnetidslist Many syzbot report...

CVE-2023-52915

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmasterxfer In af9035i2cmasterxfer, msg is controlled by user. When msgi.buf is null and msgi.len is zero, former checks on msgi.buf would be passed. Malicious data finally...

CVE-2024-44964

In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring qvector-vport pointers after reinitializating the structures. This is due to that all queue...

CVE-2024-44994 iommu: Restore lost return in iommu_report_device_fault()

In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommureportdevicefault When iommureportdevicefault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which...

CVE-2024-44989 bonding: fix xfrm real_dev null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm realdev null pointer dereference We shouldn't set realdev to NULL because packets can be in transit and xfrm might call xdodevoffloadok in parallel. All callbacks assume realdev is set. Example trace: kernel: BU...

CVE-2024-44985 ipv6: prevent possible UAF in ip6_xmit()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6xmit If skbexpandhead returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcureadlock to prevent a possible UAF...

CVE-2024-44979 drm/xe: Fix missing workqueue destroy in xe_gt_pagefault

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xegtpagefault On driver reload we never free up the memory for the pagefault and access counter workqueues. Add those destroy calls here. cherry picked from commit...

CVE-2024-44977 drm/amdgpu: Validate TA binary size

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442...