UBUNTU-CVE-2021-47268

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port A pending hrtimer may expire after the kthreadworker of tcpm port is destroyed, see below kernel dump when do module unload, fix it by cancel the 2...

UBUNTU-CVE-2021-47391

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle allowing rdmaresolveip to be called twice on the same idpriv. While this cannot happen without going through the work, it violates t...

CVE-2021-47261

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function initcqfragbuf can be called to initialize the current CQ fragments buffer cq-buf, or the temporary cq-resizebuf that is filled during CQ resize operation. However, the...

CVE-2021-47296

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Fix kvmarchvcpuioctl vcpuload leak vcpuput is not called if the user copy fails. This can result in preempt notifier corruption and crashes, among other issues...

CVE-2021-47424 i40e: Fix freeing of uninitialized misc IRQ vector

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix freeing of uninitialized misc IRQ vector When VSI set up failed in i40eprobe as part of PF switch set up driver was trying to free misc IRQ vectors in i40eclearinterruptscheme and produced a kernel Oops: Trying to free...

CVE-2021-47391 RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle allowing rdmaresolveip to be called twice on the same idpriv. While this cannot happen without going through the work, it violates t...

CVE-2021-47391

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle allowing rdmaresolveip to be called twice on the same idpriv. While this cannot happen without going through the work, it violates t...

CVE-2021-47391 RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdmaaddrcancel happens before issuing more requests The FSM can run in a circle allowing rdmaresolveip to be called twice on the same idpriv. While this cannot happen without going through the work, it violates t...

CVE-2021-47390

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix stack-out-of-bounds memory access from ioapicwriteindirect KASAN reports the following issue: BUG: KASAN: stack-out-of-bounds in kvmmakevcpusrequestmask+0x174/0x440 kvm Read of size 8 at addr ffffc9001364f638 by tas...

CVE-2021-47382

The CVE-2021-47382 entry concerns the Linux kernel component s390/qeth. Root cause: a deadlock risk in qeth_do_reset() where discipline_mutex could be held on an error path, preserving the original deadlock potential when a qeth channel path is offline. The vulnerability arises from a race betwee...

CVE-2021-47362

CVE-2021-47362 affects the Linux kernel’s drm/amd/pm power management code. The vulnerability occurs during DPM initialization when set_power_state reads values from the current state; if current state is not populated, this can lead to a NULL pointer dereference. The ATCS/ACPI path for PCI speed...

CVE-2021-47362 drm/amd/pm: Update intermediate power state for SI

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, setpowerstate gets called to transition to the final power state...

CVE-2021-47350 powerpc/mm: Fix lockup on kernel exec fault

In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix lockup on kernel exec fault The powerpc kernel is not prepared to handle exec faults from kernel. Especially, the function isexecfault will return 'false' when an exec fault is taken by kernel, because the check i...

CVE-2021-47345 RDMA/cma: Fix rdma_resolve_route() memory leak

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix rdmaresolveroute memory leak Fix a memory leak when "mdaresolveroute is called more than once on the same "rdmacmid". This is possible if cmaqueryhandler triggers the RDMACMEVENTROUTEERROR flow which puts the state...

CVE-2021-47327

In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix armsmmudevice refcount leak when armsmmurpmget fails armsmmurpmget invokes pmruntimegetsync, which increases the refcount of the "smmu" even though the return value is less than 0. The reference counting issue...

CVE-2021-47248 udp: fix race between close() and udp_abort()

In the Linux kernel, the following vulnerability has been resolved: udp: fix race between close and udpabort Kaustubh reported and diagnosed a panic in udpliblookup. The root cause is udpabort racing with close. Both racing functions acquire the socket lock, but udpv6destroysock release it before...

CVE-2021-47226

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer Both Intel and AMD consider it to be architecturally valid for XRSTOR to fail with PF but nonetheless change the register state. The actual conditions under...

CVE-2021-47224 net: ll_temac: Make sure to free skb when it is completely used

In the Linux kernel, the following vulnerability has been resolved: net: lltemac: Make sure to free skb when it is completely used With the skb pointer piggy-backed on the TX BD, we have a simple and efficient way to free the skb buffer when the frame has been transmitted. But in order to avoid...

CVE-2024-35972

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix possible memory leak in bnxtrdmaauxdeviceinit If ulp = kzalloc fails, the allocated edev will leak because it is not properly assigned and the cleanup path will not be able to free it. Fix it by assigning it properly...

CVE-2024-35881

A regression flaw was found in the Linux kernel, which introduced a system hang. The issue occurred in the drm/amd/display driver when sending a DTBCLK disable message on the first commit. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...