CVE-2024-35810 drm/vmwgfx: Fix the lifetime of the bo cursor memory

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix the lifetime of the bo cursor memory The cleanup can be dispatched while the atomic update is still active, which means that the memory acquired in the atomic update needs to not be invalidated by the cleanup. The...

CVE-2024-35804 KVM: x86: Mark target gfn of emulated atomic instruction as dirty

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM...

CVE-2024-35804 KVM: x86: Mark target gfn of emulated atomic instruction as dirty

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM...

CVE-2024-35804

CVE-2024-35804 affects the Linux kernel KVM/x86 emulation of atomic CMPXCHG. The root cause was that marking the guest page dirty during emulated atomic access could be dropped when converting the CMPXCHG to a user access, risking guest memory corruption during live migration. The fix ensures the...

CVE-2024-35804

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM...

CVE-2024-35804 KVM: x86: Mark target gfn of emulated atomic instruction as dirty

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM...

PT-2024-29137

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0 Description The issue is related to the kernel map pages function, which is a debug function that clears the valid bit in page table entries for deallocated pages to detect illegal memory accesses to freed...

atomic:FuzzTest: Crash with empty stacktrace

Detailed Report: https://oss-fuzz.com/testcase?key=5424612509810688 Project: atomic Fuzzing Engine: libFuzzer Fuzz Target: FuzzTest Job Type: libfuzzerasanatomic Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: NULL Sanitizer: address ASAN Recommended...

PT-2024-28514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A concurrency issue exists in the io uring/io-wq component of the Linux kernel. The io worker-flags structure can be accessed through multiple data paths, leading to data races—where...

UBUNTU-CVE-2024-27034

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cprwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cprwsem during f2fswriterawpages, otherwise data will be corrupted if partial blocks were...

DEBIAN-CVE-2024-26959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26939

In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to be idle. 161.359441 ODEBUG: free active...

UBUNTU-CVE-2024-26959

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26959 Bluetooth: btnxpuart: Fix btnxpuart_close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26959 Bluetooth: btnxpuart: Fix btnxpuart_close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26959

CVE-2024-26959 affects the Linux kernel Bluetooth subsystem (btnxpuart). The issue is a scheduling while atomic BUG in btnxpuart_close that could leave the transmit queue unpurged and skb release unsafe. The fixed path is in btnxpuart_close, with related call chain through tty/serdev/uart during ...

CVE-2024-26959 Bluetooth: btnxpuart: Fix btnxpuart_close

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

CVE-2024-26959: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuartclose Fix scheduling while atomic BUG in btnxpuartclose, properly purge the transmit queue and free the receive skb. 10.973809 BUG: scheduling while atomic: kworker/u9:0/80/0x00000002...

kernel: af_unix: Fix data-race around unix_tot_inflight

A data race condition was found in the Linux kernel's AFUNIX socket implementation. The unixtotinflight variable is modified under spinlockunixgclock but read without synchronization in unixreleasesock. This was detected by KCSAN Kernel Concurrency Sanitizer. The fix adds READONCE to ensure prope...