2219 matches found
CVE-2024-50280 dm cache: fix flushing uninitialized delayed_work on cache_ctr error
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix flushing uninitialized delayedwork on cachectr error An unexpected WARNON from flushwork may occur when cache creation fails, caused by destroying the uninitialized delayedwork waker in the error path of cachecreate...
PT-2024-30630 · Imagination Technologies · Powervr
Name of the Vulnerable Software and Affected Versions: PowerVR affected versions not specified Description: The issue allows software installed and run as a non-privileged user to conduct improper GPU system calls, potentially gaining access to the graphics buffers of a parent process. This is...
kernel: drm/drm_file: Fix pid refcounting race
A race condition was found in the Linux kernel. The rmfileupdatepid only increments the refcount of a struct pid after storing a pointer to it in filp-pid, dropping the dev-filelistmutex, resulting in a use-after-free vulnerability...
CVE-2024-50257 netfilter: Fix use-after-free in get_info()
In the Linux kernel, the following vulnerability has been resolved: netfilter: Fix use-after-free in getinfo ip6tablenat module unload has refcnt warning for UAF. call trace is: WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 moduleput+0x6f/0x80 Modules linked in: ip6tablenat- CPU: 1 UID: 0...
CVE-2024-50252 mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changing the remote address of an ip6gre net...
CVE-2024-50252 mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumipip: Fix memory leak when changing remote IPv6 address The device stores IPv6 addresses that are used for encapsulation in linear memory that is managed by the driver. Changing the remote address of an ip6gre net...
CVE-2024-50252
CVE-2024-50252 describes a memory leak in the Linux kernel mlxsw spectrum_ipip implementation when changing the remote IPv6 address of an ip6gre net device. The root cause is that the driver failed to add the new address to its hash table and did not remove the old one, leading to leaks and a war...
CVE-2024-50107 platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses
In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix pmccoreiounmap to call iounmap for valid addresses Commit 50c6dbdfd16e "x86/ioremap: Improve iounmap address range checks" introduces a WARN when adrress ranges of iounmap are invalid. On Thinkpad P1 G...
CVE-2024-50079
In the Linux kernel, the following vulnerability has been resolved: iouring/sqpoll: ensure task state is TASKRUNNING when running taskwork When the sqpoll is exiting and cancels pending work items, it may need to run taskwork. If this happens from within iouringcancelgeneric, then it may be under...
CVE-2024-50083 tcp: fix mptcp DSS corruption due to large pmtu xmit
In the Linux kernel, the following vulnerability has been resolved: tcp: fix mptcp DSS corruption due to large pmtu xmit Syzkaller was able to trigger a DSS corruption: TCP: requestsocksubflowv4: Possible SYN flooding on port :::20002. Sending cookies. ------------ cut here ------------ WARNING:...
CVE-2024-50079
In the Linux kernel, the following vulnerability has been resolved: iouring/sqpoll: ensure task state is TASKRUNNING when running taskwork When the sqpoll is exiting and cancels pending work items, it may need to run taskwork. If this happens from within iouringcancelgeneric, then it may be under...
CVE-2024-50079 io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work
In the Linux kernel, the following vulnerability has been resolved: iouring/sqpoll: ensure task state is TASKRUNNING when running taskwork When the sqpoll is exiting and cancels pending work items, it may need to run taskwork. If this happens from within iouringcancelgeneric, then it may be under...
CVE-2022-49018 mptcp: fix sleep in atomic at close time
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix sleep in atomic at close time Matt reported a splat at msk close time: BUG: sleeping function called from invalid context at net/mptcp/protocol.c:2877 inatomic: 1, irqsdisabled: 0, nonblock: 0, pid: 155, name:...
CVE-2022-48983 io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()
In the Linux kernel, the following vulnerability has been resolved: iouring: Fix a null-ptr-deref in iotctxexitcb Syzkaller reports a NULL deref bug as follows: BUG: KASAN: null-ptr-deref in iotctxexitcb+0x53/0xd3 Read of size 4 at addr 0000000000000138 by task file1/1955 CPU: 1 PID: 1955 Comm:...
CVE-2024-50039 net/sched: accept TCA_STAB only for root qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCASTAB only for root qdisc Most qdiscs maintain their backlog using qdiscpktlenskb on the assumption it is invariant between the enqueue and dequeue handlers. Unfortunately syzbot can crash a host rather easily...
CVE-2024-50019
In CVE-2024-50019 the IBM bulletin documents a Linux kernel issue where kthread unparked-per-CPU threads could be woken up during stop. Root cause: calling kthread_unpark unconditionally before ensuring the thread is inactive can cause a wakeup on a per-CPU kthread that has been bound via kthread...
CVE-2024-50019 kthread: unpark only parked kthread
In the Linux kernel, the following vulnerability has been resolved: kthread: unpark only parked kthread Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASKPARKED state. However...
CVE-2024-49934 fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name
In the Linux kernel, the following vulnerability has been resolved: fs/inode: Prevent dumpmapping accessing invalid dentry.dname.name It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following: ------------ cut here...
SUSE CVE-2024-47697
In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure index in rtl2830pidfilter does not exceed 31 to prevent out-of-bounds access. dev-filters is a 32-bit value, so setbit and clearbit functions should...