CVE-2024-26826

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring unneeded locks, it first try to check...

CVE-2024-26849 netlink: add nla be16/32 types to minlen array

In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nlavalidaterangeunsigned lib/nlattr.c:222 inline BUG: KMSAN: uninit-value in nlavalidateintrange lib/nlattr.c:336 inline BUG: KMSAN: uninit-value in...

CVE-2024-26843 efi: runtime: Fix potential overflow of soft-reserved region size

In the Linux kernel, the following vulnerability has been resolved: efi: runtime: Fix potential overflow of soft-reserved region size mdsize will have been narrowed if we have = 4GB worth of pages in a soft-reserved region...

CVE-2024-26844 block: Fix WARNING in _copy_from_iter

In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in copyfromiter Syzkaller reports a warning in copyfromiter because an ioviter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of...

CVE-2024-26834

The CVE refers to the Linux kernel netfilter nft_flow_offload path: when using the direct xmit path, dst_release is not invoked, leading to a kmemleak-reported unreferenced object. The vulnerability is described as resolved in the Linux kernel, with fixes implemented in the nft_flow_offload flow ...

CVE-2024-26832 mm: zswap: fix missing folio cleanup in writeback race path

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix missing folio cleanup in writeback race path In zswapwritebackentry, after we get a folio from readswapcacheasync, we grab the tree lock again to check that the swap entry was not invalidated and recycled. If it wa...

CVE-2024-26829

CVE-2024-26829 : Linux kernel vulnerability in media: ir_toy where a memleak could occur if the command path and irtoy_tx allocation are used and the command fails; the leak is mitigated by freeing the allocated buffer (buf) when irtoy_command fails. Connected advisories confirm the issue and des...

CVE-2024-26826 mptcp: fix data re-injection from stale subflow

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring unneeded locks, it first try to check...

CVE-2024-26823 irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems While refactoring the way the ITSs are probed, the handling of quirks applicable to ACPI-based platforms was lost. As a result, systems such as HIP07 lose their GIC...

CVE-2024-26822 smb: client: set correct id, uid and cruid for multiuser automounts

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the...

CVE-2024-26819

CVE-2024-26819 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2024-26820 hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Register VF in netvscprobe if NETDEVICEREGISTER missed If hvnetvsc driver is unloaded and reloaded, the NETDEVICEREGISTER handler cannot perform VF register successfully as the register call is received before netvscpro...

CVE-2024-26818

CVE-2024-26818 affects the Linux kernel (rtla/ utils.c) where a fscanf call uses mount_point with a size of MAX_PATH but the format can write up to MAX_PATH+1, risking a buffer overflow. The connected Astra/Tencent/Tenable data confirms the root cause and documents the fix: increase the mount_poi...

CVE-2024-27794

Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login...

CVE-2024-26817

CVE-2024-26817 affects the Linux kernel amdkfd component. The vulnerability arises from using kzalloc with a multiplication that can overflow; the fix replaces kzalloc with calloc to avoid integer overflow. Descriptions in connected Nessus advisories (Unity Linux UTSA advisories) reiterate the sa...

CVE-2021-47205

In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: Unregister clocks/resets when unbinding Currently, unbinding a CCU driver unmaps the device's MMIO region, while leaving its clocks/resets and their providers registered. This can cause a page fault later when some...

CVE-2021-47186

In the Linux kernel, the following vulnerability has been resolved: tipc: check for null after calling kmemdup kmemdup can return a null pointer so need to check for it, otherwise the null key will be dereferenced later in tipccryptokeyxmit as can be seen in the trace 1. 1...

CVE-2021-47201

In the Linux kernel, the following vulnerability has been resolved: iavf: free qvectors before queues in iavfdisablevf iavffreequeues clears adapter-numactivequeues, which iavffreeqvectors relies on, so swap the order of these two function calls in iavfdisablevf. This resolves a panic encountered...

CVE-2021-47200

A use after free law was found in drivers/gpu/drm/drmprime.c in the Linux kernel, occuring in mmap with drmgemttmmmap...

CVE-2021-47212

A vulnerability was found in the Linux kernel, affecting the Mellanox MLX5 driver. This issue involves improper error handling in the UCTX user context and UMEM user memory operations. When the system executes a destroy command during a fast unload flow, it should return a success code...