CVE-2024-35928

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-35943 pmdomain: ti: Add a null pointer check to the omap_prm_domain_init

In the Linux kernel, the following vulnerability has been resolved: pmdomain: ti: Add a null pointer check to the omapprmdomaininit devmkasprintf returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity...

CVE-2024-35940 pstore/zone: Add a null pointer check to the psz_kmsg_read

In the Linux kernel, the following vulnerability has been resolved: pstore/zone: Add a null pointer check to the pszkmsgread kasprintf returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity...

CVE-2024-35939 dma-direct: Leak pages on dma_set_decrypted() failure

In the Linux kernel, the following vulnerability has been resolved: dma-direct: Leak pages on dmasetdecrypted failure On TDX it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers...

CVE-2024-35938 wifi: ath11k: decrease MHI channel buffer length to 8KB

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: decrease MHI channel buffer length to 8KB Currently buflen field of ath11kmhiconfigqca6390 is assigned with 0, making MHI use a default size, 64KB, to allocate channel buffers. This is likely to fail in some scenari...

CVE-2024-35932 drm/vc4: don't check if plane->state->fb == state->fb

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: don't check if plane-state-fb == state-fb Currently, when using non-blocking commits, we can see the following kernel warning: 110.908514 ------------ cut here ------------ 110.908529 refcountt: underflow; use-after-free...

CVE-2024-35932

CVE-2024-35932 affects the Linux kernel DRM VC4 driver. The issue is in non-blocking commits where the check plane->state->fb == state->fb is not reliably protected, causing potential refcount underflow across prepare_fb/cleanup_fb. The root cause is that drm_plane.state should not be ac...

CVE-2024-35924 usb: typec: ucsi: Limit read size on v1.2

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGEIN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI...

CVE-2024-35921 media: mediatek: vcodec: Fix oops when HEVC init fails

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed i...

CVE-2024-35920

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctxlist, to avoid accessing a NULL pointer within the 'vpudecipihandler' function when the ctxlist has been deleted due to an unexpected...

CVE-2024-35889

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer...

CVE-2024-35866

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsdumpfullkey Skip sessions that are being teared down status == SESEXITING to avoid UAF...

CVE-2024-35902

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix possible cp null dereference cp might be null, calling cp-cpconn would produce null dereference Simon Horman adds: Analysis: cp is a parameter of rdsrdmamap and is not reassigned. The following call-sites pass a NULL...

CVE-2024-35910 tcp: properly terminate timers for kernel sockets

In the Linux kernel, the following vulnerability has been resolved: tcp: properly terminate timers for kernel sockets We had various syzbot reports about tcp timers firing after the corresponding netns has been dismantled. Fortunately Josef Bacik could trigger the issue more often, and could test...

CVE-2024-35898

CVE-2024-35898 affects the Linux kernel’s netfilter nft_tables flowtable type lookup. The issue is a data race where nft_unregister_flowtable_type() in nf_flow_inet_module_exit() can run concurrently with __nft_flowtable_type_get() in nf_tables_newflowtable(), and there was no protection while it...

CVE-2024-35892

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix lockdep splat in qdisctreereducebacklog qdisctreereducebacklog is called with the qdisc lock held, not RTNL. We must use qdisclookuprcu instead of qdisclookup syzbot reported: WARNING: suspicious RCU usage...

CVE-2024-35878 of: module: prevent NULL pointer dereference in vsnprintf()

In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf In ofmodalias, we can get passed the str and len parameters which would cause a kernel oops in vsnprintf since it only allows passing a NULL ptr when the length is also 0...

CVE-2024-35877 x86/mm/pat: fix VM_PAT handling in COW mappings

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VMPAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE or, in fact, all PTEs can be replaced during write faults to point at anon folios. Reliably recovering the correc...

CVE-2024-35874 aio: Fix null ptr deref in aio_complete() wakeup

In the Linux kernel, the following vulnerability has been resolved: aio: Fix null ptr deref in aiocomplete wakeup listdelinitcareful needs to be the last access to the wait queue entry - it effectively unlocks access. Previously, finishwait would see the empty list head and skip taking the lock,...

CVE-2024-35818

A vulnerability was found in the Linux kernel's LoongArch architecture. This issue occurs due to an improperly defined ioaw hook, which could affect memory writes. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...