CVE-2024-46776 drm/amd/display: Run DC_LOG_DC after checking link->link_enc

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Run DCLOGDC after checking link-linkenc WHAT The DCLOGDC should be run after link-linkenc is checked, not before. This fixes 1 REVERSEINULL issue reported by Coverity...

CVE-2024-46773

The CVE-2024-46773 issue in the Linux kernel concerns the drm/amd/display path where a division could be performed with a zero denominator (pbn_div). The root cause is a denominator that could be zero; upstream patch adds a check before use to prevent a DIVIDE_BY_ZERO. Public documents confirm th...

CVE-2024-46773 drm/amd/display: Check denominator pbn_div before used

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check denominator pbndiv before used WHAT & HOW A denominator cannot be 0, and is checked before used. This fixes 1 DIVIDEBYZERO issue reported by Coverity...

CVE-2024-46771 can: bcm: Remove proc entry when dev is unregistered.

In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcmconnect below. 0 The repro calls connect to vxcan1, removes vxcan1, and calls connect with ifindex == 0. Calling connect for a BCM socket...

CVE-2024-46771 can: bcm: Remove proc entry when dev is unregistered.

In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcmconnect below. 0 The repro calls connect to vxcan1, removes vxcan1, and calls connect with ifindex == 0. Calling connect for a BCM socket...

CVE-2024-46771

CVE-2024-46771 (Linux kernel, can: bcm): A proc entry is created per BCM socket on connect and is leaked when the bound netdev is unregistered, due to bcm_notify/bcm_proc_read handling. Reproducer uses connect to vxcan1, unregisters dev, and a second connect attempts to allocate a proc entry with...

CVE-2024-46769 spi: intel: Add check devm_kasprintf() returned value

In the Linux kernel, the following vulnerability has been resolved: spi: intel: Add check devmkasprintf returned value intelspipopulatechip use devmkasprintf to set pdata-name. This can return a NULL pointer on failure but this returned value is not checked...

CVE-2024-46768 hwmon: (hp-wmi-sensors) Check if WMI event data exists

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore t...

CVE-2024-46767 net: phy: Fix missing of_node_put() for leds

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing ofnodeput for leds The call of ofgetchildbyname will cause refcount incremented for leds, if it succeeds, it should call ofnodeput to decrease it, fix it...

CVE-2024-46767 net: phy: Fix missing of_node_put() for leds

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing ofnodeput for leds The call of ofgetchildbyname will cause refcount incremented for leds, if it succeeds, it should call ofnodeput to decrease it, fix it...

CVE-2024-46767 net: phy: Fix missing of_node_put() for leds

In the Linux kernel, the following vulnerability has been resolved: net: phy: Fix missing ofnodeput for leds The call of ofgetchildbyname will cause refcount incremented for leds, if it succeeds, it should call ofnodeput to decrease it, fix it...

CVE-2024-46767

Technical details about CVE-2024-46767 are not provided in the connected documents. Monitor for updates.

CVE-2024-46766 ice: move netif_queue_set_napi to rtnl-protected sections

In the Linux kernel, the following vulnerability has been resolved: ice: move netifqueuesetnapi to rtnl-protected sections Currently, netifqueuesetnapi is called from icevsirebuild that is not rtnl-locked when called from the reset. This creates the need to take the rtnllock just for a single...

CVE-2024-46763

CVE-2024-46763 (Linux kernel) involves a NULL pointer dereference in fou_gro_receive() during host shutdown. The NULL pointer is sk->sk_user_data (offset 8 in struct fou), which may be NULL when udp_tunnel_sock_release() clears sk_user_data and the tunnel socket is destroyed after an RCU grace...

CVE-2024-46752 btrfs: replace BUG_ON() with error handling at update_ref_for_cow()

In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BUGON with error handling at updaterefforcow Instead of a BUGON just return an error, log an error message and abort the transaction in case we find an extent buffer belonging to the relocation tree that doesn't ha...

CVE-2024-46748 cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set the max subreq size for cache writes to MAXRWCOUNT Set the maximum size of a subrequest that writes to cachefiles to be MAXRWCOUNT so that we don't overrun the maximum write we can make to the backing filesystem...

CVE-2024-46748 cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set the max subreq size for cache writes to MAXRWCOUNT Set the maximum size of a subrequest that writes to cachefiles to be MAXRWCOUNT so that we don't overrun the maximum write we can make to the backing filesystem...

CVE-2024-46740 binder: fix UAF caused by offsets overwrite

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lac...

CVE-2024-46738 VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmciresourceremove When removing a resource from vmciresourcetable in vmciresourceremove, the search is performed using the resource handle by comparing context and resource...

CVE-2024-46732

CVE-2024-46732 affects the Linux kernel DRM/AMD display path. The root cause was failing to assign linear_pitch_alignment in VM environments, which could lead to a divide-by-zero error. The fix is to assign linear_pitch_alignment in VM contexts; multiple stable-kernel commits (c984debc133e and re...