CVE-2024-50127

CVE-2024-50127 : The Linux kernel patch for the taprio_change() use-after-free fixes a dangling admin pointer caused by sched switch/removal via advance_sched(). The critical section protected by q->current_entry_lock is too small to prevent the scenario, and KASAN can detect the issue. The fi...

CVE-2024-50117

In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad data in response to an ATIF method call this causes a NULL pointer dereference in the caller. ? showregs arch/x86/kernel/dumpstack.c:478 discriminator 1 ...

CVE-2024-50113 firewire: core: fix invalid port index for parent device

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix invalid port index for parent device In a commit 24b7f8e5cd65 "firewire: core: use helper functions for self ID sequence", the enumeration over self ID sequence was refactored with some helper functions with...

CVE-2024-50113

In CVE-2024-50113, the Linux kernel FireWire (OHCI) core had a bug in the self-ID enumeration path that could assign an invalid port index to a parent device when multiple-port nodes were connected. The issue manifested when any extra node device with three or more ports attached to a 1394 OHCI c...

CVE-2024-50114

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM: BUG: KASAN: slab-use-after-free in kvmputkvm+0x300/0xe68...

CVE-2024-50112 x86/lam: Disable ADDRESS_MASKING in most cases

In the Linux kernel, the following vulnerability has been resolved: x86/lam: Disable ADDRESSMASKING in most cases Linear Address Masking LAM has a weakness related to transient execution as described in the SLAM paper1. Unless Linear Address Space Separation LASS is enabled this weakness may be...

CVE-2024-50109 md/raid10: fix null ptr dereference in raid10_size()

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null ptr dereference in raid10size In raid10run if raid10setqueuelimits succeed, the return value is set to zero, and if following procedures failed raid10run will return zero while mddev-private is still NULL,...

CVE-2024-50105

CVE-2024-50105 relates to the Linux kernel ASoC Qualcomm Soundwire path. The SC7280 Soundwire runtime stream allocation was not updated when allocation was moved to per-machine soundcard drivers, risking NULL pointer dereference or uninitialized memory during playback. The fix (commit 15c7fab0e04...

CVE-2024-50097 net: fec: don't save PTP state if PTP is unsupported

In the Linux kernel, the following vulnerability has been resolved: net: fec: don't save PTP state if PTP is unsupported Some platforms such as i.MX25 and i.MX27 do not support PTP, so on these platforms fecptpinit is not called and the related members in fep are not initialized. However,...

CVE-2024-50090

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix overflow in oa batch buffer By default xebbcreatejob appends a MIBATCHBUFFEREND to batch buffer, this is not a problem if batch buffer is only used once but oa reuses the batch buffer for the same metric and at eac...

PT-2024-36841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically in the DRM device, known as "drm: zynqmp kms". The issue involved preventing userspace accesses to the DRM device from...

CVE-2024-50073

In the Linux kernel, the following vulnerability has been resolved: tty: ngsm: Fix use-after-free in gsmcleanupmux BUG: KASAN: slab-use-after-free in gsmcleanupmux+0x77b/0x7b0 drivers/tty/ngsm.c:3160 ngsm Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc N...

CVE-2024-50083 tcp: fix mptcp DSS corruption due to large pmtu xmit

In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: requestsocksubflowv4: Possible SYN flooding on port :::20002. Sending cookies. ------------ cut here ------------ WARNING:...

CVE-2024-50067 uprobe: avoid out-of-bounds memory access of fetching args

In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-space strings, arrays can be very large,...

CVE-2024-50066 mm/mremap: fix move_normal_pmd/retract_page_tables race

In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix movenormalpmd/retractpagetables race In mremap, movepagetables looks at the type of the PMD entry and the specified address range to figure out by which method the next chunk of page table entries should be moved. ...

CVE-2024-49909

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn32setoutputtransferfunc This commit adds a null check for the setoutputgamma function pointer in the dcn32setoutputtransferfunc function. Previously, setoutputgamma was...

CVE-2024-49888

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a sdiv overflow issue Zac Ecob reported a problem where a bpf program may cause kernel crash due to the following error: Oops: divide error: 0000 1 PREEMPT SMP KASAN PTI The failure is due to the below signed divide:...

CVE-2024-49927

In the Linux kernel, the following vulnerability has been resolved: x86/ioapic: Handle allocation failures gracefully Breno observed panics when using failslab under certain conditions during runtime: can not alloc irqpinlist -1,0,20 Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can...

CVE-2024-49924

In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafbtask In the pxafbprobe function, it calls the pxafbinitfbinfo function, after which &fbi-;task is associated with pxafbtask. Moreover, within this pxafbinitfbinfo function, the...

CVE-2024-49912

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle null 'streamstatus' in 'planeschangedforexistingstream' This commit adds a null check for 'streamstatus' in the function 'planeschangedforexistingstream'. Previously, the code assumed 'streamstatus' could ...