UBUNTU-CVE-2024-40963

In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: make sure CBR is correctly set It was discovered that some device have CBR address set to 0 causing kernel panic when archsyncdmaforcpuall is called. This was notice in situation where the system is booted...

UBUNTU-CVE-2024-40907

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

UBUNTU-CVE-2024-40947

In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section A panic happens in imamatchpolicy: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 PGD 42f873067 P4D 0 Oops: 0000 1 SMP NOPTI CPU: 5 PID: 1286325 Com...

CVE-2024-40970 Avoid hw_desc array overrun in dw-axi-dmac

In the Linux kernel, the following vulnerability has been resolved: Avoid hwdesc array overrun in dw-axi-dmac I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput handles the hwdesc...

CVE-2024-40970 Avoid hw_desc array overrun in dw-axi-dmac

In the Linux kernel, the following vulnerability has been resolved: Avoid hwdesc array overrun in dw-axi-dmac I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput handles the hwdesc...

CVE-2024-40970

The CVE-2024-40970 entry concerns a Linux kernel vulnerability in the dw-axi-dmac component that can cause a kernel panic due to an overrun of the hw_desc array when a descriptor chain expands (example: nr_buffers=3 with 3 segments per descriptor, totaling 9). The proposed fix, as described in mu...

CVE-2024-40970

In the Linux kernel, the following vulnerability has been resolved: Avoid hwdesc array overrun in dw-axi-dmac I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput handles the hwdesc...

CVE-2024-40970 Avoid hw_desc array overrun in dw-axi-dmac

In the Linux kernel, the following vulnerability has been resolved: Avoid hwdesc array overrun in dw-axi-dmac I have a use case where nrbuffers = 3 and in which each descriptor is composed by 3 segments, resulting in the DMA channel descsallocated to be 9. Since axidescput handles the hwdesc...

CVE-2024-40968 MIPS: Octeon: Add PCIe link status check

In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon: Add PCIe link status check The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it ca...

CVE-2024-40968

In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon: Add PCIe link status check The standard PCIe configuration read-write interface is used to access the configuration space of the peripheral PCIe devices of the mips processor after the PCIe link surprise down, it ca...

CVE-2024-40963 mips: bmips: BCM6358: make sure CBR is correctly set

In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: make sure CBR is correctly set It was discovered that some device have CBR address set to 0 causing kernel panic when archsyncdmaforcpuall is called. This was notice in situation where the system is booted...

CVE-2024-40963

CVE-2024-40963 (Linux kernel, MIPS BMIPS BCM6358) : Affects devices where BMIPS CBR address can be 0, triggering kernel panic when arch_sync_dma_for_cpu_all is called. The root cause described is BMIPS_GET_CBR() returning 0 instead of a valid address and a non-failing read of read_c0_brcm_cmt_loc...

CVE-2024-40963 mips: bmips: BCM6358: make sure CBR is correctly set

In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: make sure CBR is correctly set It was discovered that some device have CBR address set to 0 causing kernel panic when archsyncdmaforcpuall is called. This was notice in situation where the system is booted...

CVE-2024-40963 mips: bmips: BCM6358: make sure CBR is correctly set

In the Linux kernel, the following vulnerability has been resolved: mips: bmips: BCM6358: make sure CBR is correctly set It was discovered that some device have CBR address set to 0 causing kernel panic when archsyncdmaforcpuall is called. This was notice in situation where the system is booted...

CVE-2024-40958

In the Linux kernel, the following vulnerability has been resolved: netns: Make getnetns handle zero refcount net Syzkaller hit a warning: refcountt: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcountwarnsaturate+0xdf/0x1d0 Modules linked in: CPU: 3 PID: 7890...

CVE-2024-40952 ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2journaldirty bdev-bdsuper has been removed and commit 8887b94d9322 change the usage from bdev-bdsuper to bassocmap-host-isb. This introduces the following NULL pointer dereference in...

CVE-2024-40907 ionic: fix kernel panic in XDP_TX action

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

CVE-2024-40907

CVE-2024-40907 affects the Linux kernel in the Ionic driver’s XDP_TX path. The driver sends a packet with a valid rx page and its DMA address; after tx completes, ionic_tx_clean() frees the page but the RX ring buffer isn’t reset to NULL, leading to a use-after-free access on a freed page and a k...

CVE-2024-40907 ionic: fix kernel panic in XDP_TX action

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...

CVE-2024-40907

In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDPTX action In the XDPTX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionictxclean frees that page. But RX ring buffer isn't reset to...