CVE-2024-47735 RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix spinunlockirqrestore called with IRQs enabled Fix missuse of spinlockirq/spinunlockirq when spinlockirqsave/spinlockirqrestore was hold. This was discovered through the lock debugging, and the corresponding log is a...

CVE-2024-47731 drivers/perf: Fix ali_drw_pmu driver interrupt status clearing

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: Fix alidrwpmu driver interrupt status clearing The alibabauncorepmu driver forgot to clear all interrupt status in the interrupt processing function. After the PMU counter overflow interrupt occurred, an interrupt...

CVE-2024-47729 drm/xe: Use reserved copy engine for user binds on faulting devices

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

CVE-2024-47729 drm/xe: Use reserved copy engine for user binds on faulting devices

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use reserved copy engine for user binds on faulting devices User binds map to engines with can fault, faults depend on user binds completion, thus we can deadlock. Avoid this by using reserved copy engine for user binds o...

CVE-2024-47728 bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero former ARGPTRTOLONG,INT args in case of error For all non-tracing helpers which formerly had ARGPTRTOLONG,INT as input arguments, zero the value for the case of an error as otherwise it could leak memory. For tracing, i...

CVE-2024-47724 wifi: ath11k: use work queue to process beacon tx event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: use work queue to process beacon tx event Commit 3a415daa3e8b "wifi: ath11k: add P2P IE in beacon template" from Feb 28, 2024 linux-next, leads to the following Smatch static checker warning:...

CVE-2024-47723 jfs: fix out-of-bounds in dbNextAG() and diAlloc()

In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG and diAlloc In dbNextAG , there is no check for the case where bmp-dbnumag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should ...

CVE-2024-47723 jfs: fix out-of-bounds in dbNextAG() and diAlloc()

In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG and diAlloc In dbNextAG , there is no check for the case where bmp-dbnumag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should ...

CVE-2024-47719 iommufd: Protect against overflow of ALIGN() during iova allocation

In the Linux kernel, the following vulnerability has been resolved: iommufd: Protect against overflow of ALIGN during iova allocation Userspace can supply an iova and uptr such that the target iova alignment becomes really big and ALIGN overflows which corrupts the selected area range during...

CVE-2024-47716 ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros

In the Linux kernel, the following vulnerability has been resolved: ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros Floating point instructions in userspace can crash some arm kernels built with clang/LLD 17.0.6: BUG: unsupported FP instruction in kernel mode FPEXC == 0xc0000780 Internal...

CVE-2024-47715 wifi: mt76: mt7915: fix oops on non-dbdc mt7986

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 mt7915bandconfig sets bandidx = 1 on the main phy for mt7986 with MT7975ONEADIE or MT7976ONEADIE. Commit 0335c034e726 "wifi: mt76: fix race condition related to checking tx queue fi...

CVE-2024-47713

CVE-2024-47713 is a Linux kernel vulnerability in wifi/mac80211: two-phase skb reclamation is needed in ieee80211_do_stop to ensure work is done with interrupts enabled. The patch moves the actual skb work outside the IRQ-disabled region to avoid warning and potential issues when backtracing thro...

CVE-2024-47710 sock_map: Add a cond_resched() in sock_hash_free()

In the Linux kernel, the following vulnerability has been resolved: sockmap: Add a condresched in sockhashfree Several syzbot soft lockup reports all have in common sockhashfree If a map with a large number of buckets is destroyed, we need to yield the cpu when needed...

CVE-2024-47710

CVE-2024-47710 : Linux kernel vulnerability where destroying a sock_map with many buckets could trigger soft lockups. The fix adds a cond_resched() in sock_hash_free() to yield the CPU when needed, addressing repeated syzbot soft lockup reports. Affected component: sock_map/sock_hash_free in Linu...

CVE-2024-47708

CVE-2024-47708 : In the Linux kernel, the netkit driver missed assigning the required bpf_net_context during XDP-redirect handling, causing a NULL pointer dereference when NETKIT_REDIRECT invokes skb_do_redirect() and accesses per-CPU variables. The fix is to set the bpf_net_context before callin...

CVE-2024-47705 block: fix potential invalid pointer dereference in blk_add_partition

In the Linux kernel, the following vulnerability has been resolved: block: fix potential invalid pointer dereference in blkaddpartition The blkaddpartition function initially used a single if-condition ISERRpart to check for errors when adding a partition. This was modified to handle the specific...

CVE-2024-47704 drm/amd/display: Check link_res->hpo_dp_link_enc before using it

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check linkres-hpodplinkenc before using it WHAT & HOW Functions dpenablelinkphy and dpdisablelinkphy can pass linkres without initializing hpodplinkenc and it is necessary to check for null before dereferencing...

CVE-2024-47704 drm/amd/display: Check link_res->hpo_dp_link_enc before using it

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check linkres-hpodplinkenc before using it WHAT & HOW Functions dpenablelinkphy and dpdisablelinkphy can pass linkres without initializing hpodplinkenc and it is necessary to check for null before dereferencing...

CVE-2024-47703

CVE-2024-47703 — Linux kernel (BPF-LSM return value) details . A BPF program attached to the file_alloc_security LSM hook could cause a kernel panic if the LSM returns a positive value, which the kernel could misinterpret as a file pointer. The issue arises because the positive return was not val...

CVE-2024-47703 bpf, lsm: Add check for BPF LSM return value

In the Linux kernel, the following vulnerability has been resolved: bpf, lsm: Add check for BPF LSM return value A bpf prog returning a positive number attached to fileallocsecurity hook makes kernel panic. This happens because file system can not filter out the positive number returned by the LS...