CVE-2024-36882

CVE-2024-36882 is a Linux kernel vulnerability in the memory management subsystem: mm/page_cache_ra_order() could reclaim file-backed pages in a way that may deadlock, resolved by using memalloc_nofs_save() in the readahead path (commit f2c817bed58d). The issue was observed during readahead and p...

CVE-2024-36881

CVE-2024-36881: Linux kernel mm/userfaultfd vulnerability where wr-protected page table entries (uffd_wp) were not cleared on close(), only on UFFDIO_UNREGISTER. The fix unregisters wr-protect bits during close() as well, eliminating potential leftovers in pgtable entries and preventing WARN repo...

CVE-2024-36880

CVE-2024-36880 details (from provided documents): In the Linux kernel, a Bluetooth subsystem issue in the qca firmware parsing was resolved by adding missing sanity checks for firmware files before download, to prevent memory access violations beyond the allocated vmalloc buffer. This vulnerabili...

CVE-2024-36033

CVE-2024-36033 refers to a vulnerability in the Linux kernel where the Bluetooth: qca driver could leak slab data when fetching the board id. The issue was fixed by adding a missing sanity check during the board-id fetch, preventing leakage of slab data when firmware is subsequently requested. Th...

CVE-2024-36032

CVE-2024-36032 relates to the Linux kernel Bluetooth QCA driver: a fix for an info leak when fetching the fw build ID. The patch adds missing sanity checks and moves the 255-byte build-id buffer off the stack to prevent leaking stack data through debugfs if the build-info reply is malformed. Astr...

CVE-2023-52882

In CVE-2023-52882, the Linux kernel vulnerability affects clk: sunxi-ng: h6 where CPUX reparenting during PLL CPUX rate change can cause instability, system crashes, or undefined behavior when CPUX clock changes while running. The issue was resolved by preventing instability when reparenting to a...

CVE-2024-36031

CVE-2024-36031 is a Linux kernel vulnerability where, during key instantiation, the expiry time of a key is unconditionally overwritten to TIME64_MAX, effectively making it permanent and breaking DNS updates. The root cause is the unconditional key_set_expiry call during instantiation; the fix re...

CVE-2024-36029

CVE-2024-36029 affects the Linux kernel’s MMC subsystem, specifically the mmc: sdhci-msm driver. The vulnerability arises because the sdhci-msm driver does not set the host->runtime_suspended flag, which protects access to the LED device registered by the generic sdhci code. As a result, acces...

CVE-2024-36030

CVE-2024-36030 refers to a Linux kernel vulnerability in the octeontx2-af driver where a double free could occur in rvu_npc_freemem() due to an extra free of memory previously released (npc_mcam_rsrcs_deinit() freed mcam->counters.bmap). The fix, as noted in the connected documents, was to del...

CVE-2024-36028

CVE-2024-36028: Linux kernel mm/hugetlb vulnerability fixed. The issue caused DEBUG_LOCKS_WARN_ON(1) during dissolve_free_hugetlb_folio(), leading to a kernel warning and panic. Connected sources attribute the root cause to a field packing problem where folio.deferred is unioned with folio._huget...

CVE-2024-3300

CVE-2024-3300 describes an unsafe ".NET" object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 that enables pre‑authentication remote code execution. The issue stems from deserializing untrusted .NET objects, allowing an attacker to execute arbitrary code before ...

CVE-2024-36021

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the...

CVE-2024-36027

CVE-2024-36027 affects the Linux kernel’s BTRFS zoned write path. The issue arises when btrfs_clear_buffer_dirty() marks an extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT and a write IO is in progress (WRITEBACK, not DIRTY); a ZEROOUT flag could be added just before bio submission, potentially clea...

CVE-2024-36026

CVE-2024-36026 affects the Linux kernel DRM/AMD PM path (drm/amd/pm). The issue causes random hangs during S4 stress tests when using SMU v13.0.4/11, as GC/RLC/PMFW can enter an invalid state and trigger hard hangs. A workaround implemented in the patch adds a GFX reset just before sending the MP...

CVE-2024-36025

CVE-2024-36025 is validated by connected MiracleLinux security advisory AXSA:2024-8783:27. Affected: Linux kernel scsi qla2xxx driver. Root cause: memory corruption from an off-by-one in qla_edif_app_getstats() where app_reply->elem[] (allocated for app_req.num_ports) could be overrun due to a...

CVE-2024-36024

Summary: CVE-2024-36024 affects the drm/amd/display path in the Linux kernel. It describes a race condition during the DMCUB handshake that can cause a hardware hang by touching INBOX1 RPTR. The documented mitigation is to disable idle reallow as part of command/gpint execution to create a necess...

CVE-2024-36023

CVE-2024-36023 is a Linux kernel vulnerability involving a null pointer dereference. The alteration was reported by Julia Lawall and has been resolved in the kernel code base, as reflected by the linked advisories and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with a base score of 5.5 ...

CVE-2024-36022

CVE-2024-36022 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-35504

CVE-2024-35504 affects FineSoft v8.0, with a cross-site scripting (XSS) vulnerability in the login page that allows an attacker to execute arbitrary scripts via a crafted payload in the URL’s errorname parameter after a failed login. The Red Hat / NVD / CVE enrichment entries confirm the issue as...

CVE-2024-36021

CVE-2024-36021 affects the Linux kernel net driver for hns3, causing a kernel crash when a devlink reload occurs during PF initialization. The root cause is devlink reload accessing hardware resources before the hardware is initialized. A patch fixes this by taking devl_lock during initialization...