UBUNTU-CVE-2021-47306

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fzaprobe fp is netdev private data and it cannot be used after freenetdev call. Using fp after freenetdev can cause UAF bug. Fix it by moving freenetdev after error message. TURBOchannel adapter"...

UBUNTU-CVE-2021-47258

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix error handling of scsihostalloc After device is initialized via deviceinitialize, or its name is set via devsetname, the device has to be freed via putdevice. Otherwise device name will be leaked because it is...

CVE-2021-47412 block: don't call rq_qos_ops->done_bio if the bio isn't tracked

In the Linux kernel, the following vulnerability has been resolved: block: don't call rqqosops-donebio if the bio isn't tracked rqqos framework is only applied on request based driver, so: 1 rqqosdonebio needn't to be called for bio based driver 2 rqqosdonebio needn't to be called for bio which...

CVE-2021-47406 ext4: add error checking to ext4_ext_replay_set_iblocks()

In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4extreplaysetiblocks If the call to ext4mapblocks fails due to an corrupted file system, ext4extreplaysetiblocks can get stuck in an infinite loop. This could be reproduced by running generic/526 wi...

CVE-2021-47406 ext4: add error checking to ext4_ext_replay_set_iblocks()

In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4extreplaysetiblocks If the call to ext4mapblocks fails due to an corrupted file system, ext4extreplaysetiblocks can get stuck in an infinite loop. This could be reproduced by running generic/526 wi...

CVE-2021-47406

In the Linux kernel, the following vulnerability has been resolved: ext4: add error checking to ext4extreplaysetiblocks If the call to ext4mapblocks fails due to an corrupted file system, ext4extreplaysetiblocks can get stuck in an infinite loop. This could be reproduced by running generic/526 wi...

CVE-2021-47392 RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix listener leak in rdmacmalistenonall failure If cmalistenonall fails it leaves the per-device ID still on the listenlist but the state is not set to RDMACMADDRBOUND. When the cmid is eventually destroyed...

CVE-2021-47361 mcb: fix error handling in mcb_alloc_bus()

In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcballocbus There are two bugs: 1 If idasimpleget fails then this code calls putdevicecarrier but we haven't yet called getdevicecarrier and probably that leads to a use after free. 2 After...

CVE-2021-47361

In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcballocbus There are two bugs: 1 If idasimpleget fails then this code calls putdevicecarrier but we haven't yet called getdevicecarrier and probably that leads to a use after free. 2 After...

CVE-2021-47361 mcb: fix error handling in mcb_alloc_bus()

In the Linux kernel, the following vulnerability has been resolved: mcb: fix error handling in mcballocbus There are two bugs: 1 If idasimpleget fails then this code calls putdevicecarrier but we haven't yet called getdevicecarrier and probably that leads to a use after free. 2 After...

CVE-2021-47361

CVE-2021-47361 – Linux kernel mcb_alloc_bus() use-after-free fix. The vulnerability arises from two bugs in mcb_alloc_bus(): (1) calling put_device(carrier) after ida_simple_get() failure without a prior get_device(), risking use-after-free; (2) not balancing device lifecycles after device_initia...

CVE-2021-47337 scsi: core: Fix bad pointer dereference when ehandler kthread is invalid

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 "scsi: core: Fix error handling of scsihostalloc" changed the allocation logic to call putdevice to perform host cleanup with the...

CVE-2021-47337

The CVE-2021-47337 issue is in the Linux kernel SCSI core path: when an error arises during scsi_host_alloc() and the error-handling ehandler thread fails to spawn, shost->ehandler may be set to ERR_PTR(-ENOMEM) and scsi_host_dev_release() would call kthread_stop() on a NULL/invalid pointer, r...

CVE-2021-47334 misc/libmasm/module: Fix two use after free in ibmasm_init_one

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasminitone In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice, and assigned to...

CVE-2021-47330 tty: serial: 8250: serial_cs: Fix a memory leak in error handling path

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: serialcs: Fix a memory leak in error handling path In the probe function, if the final 'serialconfig' fails, 'info' is leaking. Add a resource handling path to free this memory...

CVE-2021-47327

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix armsmmudevice refcount leak when armsmmurpmget fails armsmmurpmget invokes pmruntimegetsync, which increases the refcount of the "smmu" even though the return value is less than 0. The reference counting issue...

CVE-2021-47312 netfilter: nf_tables: Fix dereference of null pointer flow

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix dereference of null pointer flow In the case where chain-flags & NFTCHAINHWOFFLOAD is false then nftflowrulecreate is not called and flow is NULL. The subsequent error handling execution via label...

CVE-2021-47312

The CVE-2021-47312 issue in Linux kernel nf_tables caused a NULL pointer dereference during error handling when flow is NULL (chain flags NFT_CHAIN_HW_OFFLOAD is false). The fix ensures nft_flow_rule_destroy is only called if flow is non-null, preventing the crash in the error path. Connected ven...

CVE-2021-47298

CVE-2021-47298 concerns the Linux kernel: a bpf/sockmap path could leak a message if skb_linearize fails, resolved by freeing the msg block before returning an error. Multiple connected advisories reference the same fix in the kernel; impact is a potential memory leak (no exploitation details pro...

CVE-2021-47258

CVE-2021-47258 affects the Linux kernel scsi subsystem. The vulnerability arises from incorrect error handling in scsi_host_alloc, leading to a leaked device name if the device is not freed after initialization or when its name is set via dev_set_name. The published fixes replace kfree() with put...