CVE-2024-56582

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfsencodedreadendio Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN:...

CVE-2024-53227

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfadimmoduleexit BUG: KASAN: slab-use-after-free in lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: dumpstacklvl+0x95/0xe0 printreport+0xcb/0x6...

CVE-2024-56672

CVE-2024-56672 affects the Linux kernel blk-cgroup component. The issue is a use-after-free (UAF) in blkcg_unpin_online() where blkcg_parent(blkcg) is read after blkcg_destroy_blkgs(blkcg) could free the blkcg. The fix reads the parent pointer before destroying the blkcg’s blkg’s, preventing UAF....

CVE-2024-56653

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtkprocesscoredump hcidevcdappend may lead to the release of the skb, so it cannot be accessed once it is called. ================================================================== BUG: KASAN:...

CVE-2024-56652 drm/xe/reg_sr: Remove register pool

In the Linux kernel, the following vulnerability has been resolved: drm/xe/regsr: Remove register pool That pool implementation doesn't really work: if the krealloc happens to move the memory and return another address, the entries in the xarray become invalid, leading to use-after-free later: BU...

CVE-2024-56642

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanupbearer. syzkaller reported a use-after-free of UDP kernel socket in cleanupbearer without repro. 01 When bearerdisable calls tipcudpdisable, cleanup of the UDP kernel socket is...

CVE-2024-56603

CVE-2024-56603 affects the Linux kernel in the net/af_can path. On error in can_create(), the code frees the allocated sk object, but sock_init_data() had already attached it to the sock, leaving a dangling sk pointer and introducing a potential use‑after‑free. The connected advisories confirm a ...

CVE-2024-56582 btrfs: fix use-after-free in btrfs_encoded_read_endio()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfsencodedreadendio Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN:...

CVE-2024-56582 btrfs: fix use-after-free in btrfs_encoded_read_endio()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfsencodedreadendio Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN:...

CVE-2024-56556

CVE-2024-56556 targets the Linux kernel binder: a race in binder_add_freeze_work() where proc->inner_lock is dropped while acquiring node->lock, allowing binder_node_release() to race and trigger a use-after-free. Impact is local privilege escalation/high, as indicated by multiple advisorie...

CVE-2024-56554 binder: fix freeze UAF in binder_release_work()

In the Linux kernel, the following vulnerability has been resolved: binder: fix freeze UAF in binderreleasework When a binder reference is cleaned up, any freeze work queued in the associated process should also be removed. Otherwise, the reference is freed while its ref-freeze.work is still queu...

CVE-2024-53170

In the Linux kernel, the following vulnerability has been resolved: block: fix uaf for flush rq while iterating tags blkmqclearflushrqmapping is not called during scsi probe, by checking blkqueueinitdone. However, QUEUEFLAGINITDONE is cleared in delgendisk by commit aec89dc5d421 "block: keep...

CVE-2024-53171

In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifstncendcommit After an insertion in TNC, the tree might split and cause a node to change its znode-parent. A further deletion of other nodes in the tree which also could free the...

CVE-2024-53166

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfqlimitdepth Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd-lock, however bfqlimitdepth is deferencing bfqq from bic without the lock, this can lead to UAF if t...

CVE-2024-56541

The CVE-2024-56541 entry concerns the Linux kernel wireless driver ath12k (wifi) where a use-after-free occurs during module removal. Specifically, ath12k_core_deinit() calls ath12k_mac_destroy() which unregisters ah->hw from mac80211 and frees ah->hw and related ar structures; then ath12k_...

CVE-2024-56541

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix use-after-free in ath12kdpcccleanup During ath12k module removal, in ath12kcoredeinit, ath12kmacdestroy un-registers ah-hw from mac80211 and frees the ah-hw as well as all the ar's in it. After this...

CVE-2024-53237

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix use-after-free in deviceforeachchild Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in deviceforeachchild+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/498...

CVE-2024-53227

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfadimmoduleexit BUG: KASAN: slab-use-after-free in lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: dumpstacklvl+0x95/0xe0 printreport+0xcb/0x6...

CVE-2024-53227 scsi: bfa: Fix use-after-free in bfad_im_module_exit()

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfadimmoduleexit BUG: KASAN: slab-use-after-free in lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: dumpstacklvl+0x95/0xe0 printreport+0xcb/0x6...

CVE-2024-53171 ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit

In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifstncendcommit After an insertion in TNC, the tree might split and cause a node to change its znode-parent. A further deletion of other nodes in the tree which also could free the...