CVE-2024-46850 drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid race between dcn35setdrr and dcstatedestruct dcstatedestruct nulls the resource context of the DC state. The pipe context passed to dcn35setdrr is a member of this resource context. If dcstatedestruct is...

CVE-2024-46836 usb: gadget: aspeed_udc: validate endpoint index for ast udc

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeedudc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis...

CVE-2024-46833 net: hns3: void array out of bound when loop tnl_num

In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnlnum When query reg inf of SSU, it loops tnlnum times. However, tnlnum comes from hardware and the length of array is a fixed value. To void array out of bound, make sure the loop ti...

CVE-2024-46832 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed

In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call getc0compareint if timer irq is installed This avoids warning: 0.118053 BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Caused by getc0compareint on secondary CPU. We al...

CVE-2024-46817

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when stream nums greater than 6 Why Coverity reports OVERRUN warning. Should abort amdgpudm initialize. How Return failure to amdgpudminit...

CVE-2024-46816

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when link nums greater than maxlinks Why Coverity report OVERRUN warning. There are only maxlinks elements within dc-links. link count could up to AMDGPUDMMAXDISPLAYINDEX 31. How Make sur...

CVE-2024-46816 drm/amd/display: Stop amdgpu_dm initialize when link nums greater than max_links

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpudm initialize when link nums greater than maxlinks Why Coverity report OVERRUN warning. There are only maxlinks elements within dc-links. link count could up to AMDGPUDMMAXDISPLAYINDEX 31. How Make sur...

CVE-2024-46812

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration Why Coverity reports Memory - illegal accesses. How Skip inactive planes...

CVE-2022-48945 media: vivid: fix compose size exceed boundary

In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix compose size exceed boundary syzkaller found a bug: BUG: unable to handle page fault for address: ffffc9000a3b1000 PF: supervisor write access in kernel mode PF: errorcode0x0002 - not-present page PGD 100000067...

CVE-2024-46783

In the Linux kernel, the following vulnerability has been resolved: tcpbpf: fix return value of tcpbpfsendmsg When we cork messages in psock-cork, the last message triggers the flushing will result in sending a skmsg larger than the current message size. In this case, in tcpbpfsendverdict, 'copie...

CVE-2024-46717

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix incorrect page release Under the following conditions: 1 No skb created yet 2 headersize == 0 no SHAMPO header 3 headerindex + 1 % MLX5ESHAMPOWQHEADERPERPAGE == 0 this is the last page fragment of a SHAMPO...

CVE-2024-46797

CVE-2024-46797 : In the Linux kernel (PowerPC/MCS qspinlock), a deadlock can occur when an interrupt happens in queued_spin_lock_slowpath() after qnodesp->count is incremented but before node->lock is initialized. This can allow a CPU to see stale lock values and write the wrong qnode’s nex...

CVE-2024-46784 net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix error handling in manacreatetxq/rxq's NAPI cleanup Currently napidisable gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It causes kernel panic. ?...

CVE-2024-46776 drm/amd/display: Run DC_LOG_DC after checking link->link_enc

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Run DCLOGDC after checking link-linkenc WHAT The DCLOGDC should be run after link-linkenc is checked, not before. This fixes 1 REVERSEINULL issue reported by Coverity...

CVE-2024-46767 net: phy: Fix missing of_node_put() for leds

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing ofnodeput for leds The call of ofgetchildbyname will cause refcount incremented for leds, if it succeeds, it should call ofnodeput to decrease it, fix it...

CVE-2024-46767

Technical details about CVE-2024-46767 are not provided in the connected documents. Monitor for updates.

CVE-2024-46766 ice: move netif_queue_set_napi to rtnl-protected sections

In the Linux kernel, the following vulnerability has been resolved: ice: move netifqueuesetnapi to rtnl-protected sections Currently, netifqueuesetnapi is called from icevsirebuild that is not rtnl-locked when called from the reset. This creates the need to take the rtnllock just for a single...

CVE-2024-46740 binder: fix UAF caused by offsets overwrite

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lac...

CVE-2024-46726 drm/amd/display: Ensure index calculation will not overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow WHY & HOW Make sure vmid0p72idx, vnom0p8idx and vmax0p9idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGEROVERFLOW issues...

CVE-2024-46726 drm/amd/display: Ensure index calculation will not overflow

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow WHY & HOW Make sure vmid0p72idx, vnom0p8idx and vmax0p9idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGEROVERFLOW issues...