12149 matches found
UBUNTU-CVE-2024-50037
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 "drm/fbdev-dma: Only install deferred I/O if necessary" initializes deferred I/O only if it is used. drmfbdevdmafbdestroy however calls fbdeferrediocleanup...
UBUNTU-CVE-2024-50031
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop the active perfmon before being destroyed When running kmscube with one or more performance monitors enabled via GALLIUMHUD, the following kernel panic can occur: 55.008324 Unable to handle kernel paging request at...
UBUNTU-CVE-2022-48979
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix array index out of bound error in DCN32 DML Why&How LinkCapacitySupport array is indexed with the number of voltage states and not the number of max DPPs. Fix the error by changing the array declaration to us...
CVE-2022-48990 drm/amdgpu: fix use-after-free during gpu recovery
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free during gpu recovery Why 754.862560 refcountt: underflow; use-after-free. 754.862898 Call Trace: 754.862903 754.862913 amdgpujobfreecb+0xc2/0xe1 amdgpu 754.863543 drmschedmain.cold+0x34/0x39 amdsched...
CVE-2022-48981 drm/shmem-helper: Remove errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...
CVE-2022-48981 drm/shmem-helper: Remove errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...
CVE-2022-48981
CVE-2022-48981 is a Linux kernel vulnerability related to DRM SHMEM: the error-path handling in drm/shmem-helper and the ownership of references in drm_gem_shmem_mmap() can cause a use-after-free of a GEM object. The root cause is that drm_gem_shmem_mmap() does not own a reference, potentially fr...
CVE-2022-48981 drm/shmem-helper: Remove errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove errant put in error path drmgemshmemmmap doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free...
CVE-2024-50049 drm/amd/display: Check null pointer before dereferencing se
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se WHAT & HOW se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARDNULL issue...
CVE-2024-50049
CVE-2024-50049 affects the Linux kernel DRM AMD display path. The vulnerability arises from dereferencing a se pointer that could be NULL after a prior null check in the same function, leading to a FORWARD_NULL condition. Exploitation would be LOCAL with LOW privileges and no user interaction, po...
CVE-2024-50049 drm/amd/display: Check null pointer before dereferencing se
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointer before dereferencing se WHAT & HOW se is null checked previously in the same function, indicating it might be null; therefore, it must be checked when used again. This fixes 1 FORWARDNULL issue...
CVE-2024-50037 drm/fbdev-dma: Only cleanup deferred I/O if necessary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 "drm/fbdev-dma: Only install deferred I/O if necessary" initializes deferred I/O only if it is used. drmfbdevdmafbdestroy however calls fbdeferrediocleanup...
CVE-2024-50037 drm/fbdev-dma: Only cleanup deferred I/O if necessary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 "drm/fbdev-dma: Only install deferred I/O if necessary" initializes deferred I/O only if it is used. drmfbdevdmafbdestroy however calls fbdeferrediocleanup...
CVE-2024-50037
CVE-2024-50037 affects the Linux kernel’s DRM framebuffer path (drm/fbdev-dma). The root cause was that drm_fbdev_dma_fb_destroy() unconditionally invoked fb_deferred_io_cleanup() even when struct fb_info.fbdefio was NULL, leading to a warning trace in an Apple Silicon display driver context. The...
CVE-2024-50037 drm/fbdev-dma: Only cleanup deferred I/O if necessary
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 "drm/fbdev-dma: Only install deferred I/O if necessary" initializes deferred I/O only if it is used. drmfbdevdmafbdestroy however calls fbdeferrediocleanup...
CVE-2024-50030 drm/xe/ct: prevent UAF in send_recv()
In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in sendrecv Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can erase from the xa. Also ...
CVE-2024-50030
CVE-2024-50030 refers to a Linux kernel vulnerability in drm/xe/ct where a use-after-free (UAF) could occur due to fence/timeout interactions. The fix serializes with the completion side by grabbing ct->lock after the wait to ensure correct ordering of dependent loads/stores and to prevent UAF...
CVE-2024-50030 drm/xe/ct: prevent UAF in send_recv()
In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in sendrecv Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can erase from the xa. Also ...
CVE-2024-50031 drm/v3d: Stop the active perfmon before being destroyed
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop the active perfmon before being destroyed When running kmscube with one or more performance monitors enabled via GALLIUMHUD, the following kernel panic can occur: 55.008324 Unable to handle kernel paging request at...
