CVE-2024-56673 riscv: mm: Do not call pmd dtor on vmemmap page table teardown

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Do not call pmd dtor on vmemmap page table teardown The vmemmap's, which is used for RV64 with SPARSEMEMVMEMMAP, page tables are populated using pmd page middle directory hugetables. However, the pmd allocation is not...

CVE-2024-56673

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Do not call pmd dtor on vmemmap page table teardown The vmemmap's, which is used for RV64 with SPARSEMEMVMEMMAP, page tables are populated using pmd page middle directory hugetables. However, the pmd allocation is not...

CVE-2024-56658 net: defer final 'struct net' free in netns dismantle

In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dstdestroy 1 Issue is in xfrm6netinit and xfrm4netinit : They copy xfrm46dstopstemplate into net-xfrm.xfrm46dstops. But net structure...

CVE-2024-56652 drm/xe/reg_sr: Remove register pool

In the Linux kernel, the following vulnerability has been resolved: drm/xe/regsr: Remove register pool That pool implementation doesn't really work: if the krealloc happens to move the memory and return another address, the entries in the xarray become invalid, leading to use-after-free later: BU...

CVE-2024-56612 mm/gup: handle NULL pages in unpin_user_pages()

In the Linux kernel, the following vulnerability has been resolved: mm/gup: handle NULL pages in unpinuserpages The recent addition of "pofs" pages or folios handling to gup has a flaw: it assumes that unpinuserpages handles NULL pages in the pages array. That's not the case, as I discovered when...

CVE-2024-56611 mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migratetonode assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having findvma return NULL, to then de-reference NULL. So...

CVE-2024-56611 mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migratetonode assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having findvma return NULL, to then de-reference NULL. So...

CVE-2024-56611 mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migratetonode assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having findvma return NULL, to then de-reference NULL. So...

CVE-2024-56611

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migratetonode assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having findvma return NULL, to then de-reference NULL. So...

CVE-2024-56586 f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix f2fsbugon when uninstalling filesystem call f2fsevictinode. creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the...

CVE-2024-56562 i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()

In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free initdynaddr at i3cmasterputi3caddrs if dev-boardinfo && dev-boardinfo-initdynaddr ^^^ here check "initdynaddr" i3cbussetaddrslotstatus&master-bus, dev-info.dynaddr, ... ^^^^ free "dynaddr" Fix copy/past...

CVE-2024-56551

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free +0.000021 BUG: KASAN: slab-use-after-free in drmschedentityflush+0x6cb/0x7a0 gpusched +0.000027 Read of size 8 at addr ffff8881b8605f88 by task amdpciunplug/2147 +0.000023 CPU: 6 PID: 2147...

DEBIAN-CVE-2024-53213

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation In lan78xxprobe, the buffer buf was being freed twice: once implicitly through usbfreeurbdev-urbintr with the URBFREEBUFFER flag and again explicitly by...

AZL-55407 CVE-2024-53213 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation In lan78xxprobe, the buffer buf was being freed twice: once implicitly through usbfreeurbdev-urbintr with the URBFREEBUFFER flag and again explicitly by...

UBUNTU-CVE-2024-56546

In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnxaddcbforsuspend If we fail to allocate memory for cbdata by kmalloc, the memory allocation for evedata is never freed, add the missing kfree in the error handling path...

CVE-2024-56546

In the Linux kernel, the following vulnerability has been resolved: drivers: soc: xilinx: add the missing kfree in xlnxaddcbforsuspend If we fail to allocate memory for cbdata by kmalloc, the memory allocation for evedata is never freed, add the missing kfree in the error handling path...

CVE-2024-53236

In the Linux kernel, the following vulnerability has been resolved: xsk: Free skb when TX metadata options are invalid When a new skb is allocated for transmitting an xsk descriptor, i.e., for every non-multibuf descriptor or the first frag of a multibuf descriptor, but the descriptor is later...

CVE-2024-53227 scsi: bfa: Fix use-after-free in bfad_im_module_exit()

In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfadimmoduleexit BUG: KASAN: slab-use-after-free in lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trace: dumpstacklvl+0x95/0xe0 printreport+0xcb/0x6...

CVE-2024-53218 f2fs: fix race in concurrent f2fs_stop_gc_thread

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix race in concurrent f2fsstopgcthread In my test case, concurrent calls to f2fs shutdown report the following stack trace: Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 1...

CVE-2024-53171 ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit

In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifstncendcommit After an insertion in TNC, the tree might split and cause a node to change its znode-parent. A further deletion of other nodes in the tree which also could free the...