1747 matches found
CVE-2024-50002 static_call: Handle module init failure correctly in static_call_del_module()
In the Linux kernel, the following vulnerability has been resolved: staticcall: Handle module init failure correctly in staticcalldelmodule Module insertion invokes staticcalladdmodule to initialize the static calls in a module. staticcalladdmodule invokes staticcallinit, which allocates a struct...
CVE-2024-50000 net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix NULL deref in mlx5etirbuilderalloc In mlx5etirbuilderalloc kvzalloc may return NULL which is dereferenced on the next line in a reference to the modify field. Found by Linux Verification Center linuxtesting.org wit...
CVE-2024-49998
CVE-2024-49998 affects the Linux kernel net: dsa shutdown sequence, specifically lan9303. Two shutdown-time races are described: (1) a driver data pointer (dev_get_drvdata) may be accessed after shutdown, risking an NPD if the remove path runs; (2) concurrent zeroization of conduit->dsa_ptr ca...
CVE-2024-49996
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's size from ReparseDataLength. Function...
CVE-2024-49994
In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blkioctldiscard but for secure erase. Same problem: uint64t r2 = 512,...
CVE-2024-49994 block: fix integer overflow in BLKSECDISCARD
In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blkioctldiscard but for secure erase. Same problem: uint64t r2 = 512,...
CVE-2024-49990 drm/xe/hdcp: Check GSC structure validity
In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Check GSC structure validity Sometimes xegsc is not initialized when checked at HDCP capability check. Add gsc structure check to avoid null pointer error...
CVE-2024-49985 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transf...
CVE-2024-49976 tracing/timerlat: Drop interface_lock in stop_kthread()
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interfacelock in stopkthread stopkthread is the offline callback for "trace/osnoise:online", since commit 5bfbcd1ee57b "tracing/timerlat: Add interfacelock around clearing of kthread in stopkthread", the...
CVE-2024-49969 drm/amd/display: Fix index out of bounds in DCN30 color transformation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the cm3helpertranslatecurvetohwformat function in the DCN30 color management module. The issue...
CVE-2024-49969 drm/amd/display: Fix index out of bounds in DCN30 color transformation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the cm3helpertranslatecurvetohwformat function in the DCN30 color management module. The issue...
CVE-2024-49962
In the Linux kernel, the following vulnerability has been resolved: ACPICA: check null return of ACPIALLOCATEZEROED in acpidbconverttopackage ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0 ACPIALLOCATEZEROED may fail, elements might be NULL and will cause NULL pointer dereference later...
CVE-2024-49954 static_call: Replace pointless WARN_ON() in static_call_module_notify()
In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace pointless WARNON in staticcallmodulenotify staticcallmodulenotify triggers a WARNON, when memory allocation fails in staticcalladdmodule. That's not really justified, because the failure case must be correctly...
CVE-2024-49952 netfilter: nf_tables: prevent nf_skb_duplicated corruption
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prevent nfskbduplicated corruption syzbot found that nfdupipv4 or nfdupipv6 could write per-cpu variable nfskbduplicated in an unsafe way 1. Disabling preemption as hinted by the splat is not enough, we have ...
CVE-2024-49950
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2capconnect Syzbot reported BUG: KASAN: slab-use-after-free in l2capconnect.constprop.0+0x10d8/0x1270 net/bluetooth/l2capcore.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CP...
CVE-2024-49934
CVE-2024-49934 concerns the Linux kernel vulnerability in the fs/inode path where dump_mapping() could access invalid dentry.d_name.name, potentially causing a crash during hot-remove of a memory device (e.g., hugetlb). The connected documents describe the root cause as unsafe filename retrieval ...
CVE-2024-49934 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
In the Linux kernel, the following vulnerability has been resolved: fs/inode: Prevent dumpmapping accessing invalid dentry.dname.name It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following: ------------ cut here...
CVE-2024-49931 wifi: ath12k: fix array out-of-bound access in SoC stats
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix array out-of-bound access in SoC stats Currently, the ath12ksocdpstats::halreoerror array is defined with a maximum size of DPREODSTRINGMAX. However, the ath12kdprxprocess function access...