CVE-2024-26785

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix protection fault in iommufdtestsyzconviova Syzkaller reported the following bug: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 1 SMP KASAN KASAN: null-ptr-deref in range...

CVE-2024-26784 pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal

In the Linux kernel, the following vulnerability has been resolved: pmdomain: arm: Fix NULL dereference on scmiperfdomain removal On unloading of the scmiperfdomain module got the below splat, when in the DT provided to the system under test the 'power-domain-cells' property was missing. Indeed,...

CVE-2024-26783 mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeupkswapd with a wrong zone index With numa balancing on, when a numa system is running where a numa node doesn't have its local memory so it has no managed zones, the following oops has been...

CVE-2024-26750 af_unix: Drop oob_skb ref before purging queue in GC.

In the Linux kernel, the following vulnerability has been resolved: afunix: Drop oobskb ref before purging queue in GC. syzbot reported another task hung in unixgc. 0 The current while loop assumes that all of the left candidates have oobskb and calling kfreeskboobskb releases the remaining...

CVE-2024-26796

In the Linux kernel, the following vulnerability has been resolved: drivers: perf: ctrgetwidth function for legacy is not defined With parameters CONFIGRISCVPMULEGACY=y and CONFIGRISCVPMUSBI=n linux kernel crashes when you try perf record: $ perf record ls 46.749286 Unable to handle kernel NULL...

CVE-2024-26687

In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup shutdownpirq and startuppirq are not taking the irqmappingupdatelock because they can't due to lock inversion. Both are called with the irqdesc-lock being taking. The lock order,...

CVE-2024-26757

In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in mdcheckrecovery Usually if the array is not read-write, mdcheckrecovery won't register new syncthread in the first place. And if the array is read-write and syncthread is registered,...

CVE-2024-26772

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4mbfindbygoal Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a...

CVE-2024-26775 aoe: avoid potential deadlock at set_capacity

In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at setcapacity Move setcapacity outside of the section procected by &d-lock. To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- 1 lock&bdev-bdsizelock; localirqdisable; 2...

CVE-2024-26766 IB/hfi1: Fix sdma.h tx->num_descs off-by-one error

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx-numdescs off-by-one error Unfortunately the commit fd8958efe877 introduced another error causing the descs array to overflow. This reults in further crashes easily reproducible by sendmsg system call...

CVE-2024-26755 md: Don't suspend the array for interrupted reshape

In the Linux kernel, the following vulnerability has been resolved: md: Don't suspend the array for interrupted reshape mdstartsync will suspend the array if there are spares that can be added or removed from conf, however, if reshape is still in progress, this won't happen at all or data will be...

CVE-2024-26740

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: use the backlog for mirred ingress The test Davide added in commit ca22da2fbd69 "actmirred: use the backlog for nested calls to mirred ingress" hangs our testing VMs every 10 or so runs, with the familiar...

CVE-2024-26739

CVE-2024-26739 affects the Linux kernel net/sched component (act_mirred) where overriding the skb return value after routing could lead to Use-After-Free if tcf_mirred_forward() had been called. The fix moves the retval override to the error path that actually requires it, preventing UaF when the...

CVE-2024-26738 powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: DLPAR add doesn't completely initialize pcicontroller When a PCI device is dynamically added, the kernel oopses with a NULL pointer dereference: BUG: Kernel NULL pointer dereference on read at 0x00000030...

CVE-2024-26726

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extentmap for free space inode on write error While running the CI for an unrelated change I hit the following panic with generic/648 on btrfsholesspacecache. assertion failed: blockstart != EXTENTMAPHOLE, in...

CVE-2024-26707

In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARNONCE in sendhsrsupervisionframe Syzkaller reported 1 hitting a warning after failing to allocate resources for skb in hsrinitskb. Since a WARNONCE call will not help much in this case, it might be prudent to...

CVE-2024-26696

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfslookupdirtydatabuffers Syzbot reported a hang issue in migratepagesbatch called by mbind and nilfslookupdirtydatabuffers called in the log writer of nilfs2. While migratepagesbatch locks a folio and waits...

CVE-2024-26725 dpll: fix possible deadlock during netlink dump operation

In the Linux kernel, the following vulnerability has been resolved: dpll: fix possible deadlock during netlink dump operation Recently, I've been hitting following deadlock warning during dpll pin dump: 52804.637962 ====================================================== 52804.638536 WARNING:...

CVE-2024-26725 dpll: fix possible deadlock during netlink dump operation

In the Linux kernel, the following vulnerability has been resolved: dpll: fix possible deadlock during netlink dump operation Recently, I've been hitting following deadlock warning during dpll pin dump: 52804.637962 ====================================================== 52804.638536 WARNING:...

CVE-2024-26719 nouveau: offload fence uevents work to workqueue

In the Linux kernel, the following vulnerability has been resolved: nouveau: offload fence uevents work to workqueue This should break the deadlock between the fctx lock and the irq lock. This offloads the processing off the work from the irq into a workqueue...