CVE-2024-42318

In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on credtransfer When a process' cred struct is replaced, this almost always invokes the credprepare LSM hook; but in one special case when KEYCTLSESSIONTOPARENT updates the parent's...

CVE-2024-42314

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At addrabiopages we are accessing the extent map to calculate 'addsize' after we dropped our reference on the extent map, resulting in a use-after-free. Fix...

CVE-2024-42295

In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle inconsistent state in nilfsbtnodecreateblock Syzbot reported that a buffer state inconsistency was detected in nilfsbtnodecreateblock, triggering a kernel bug. It is not appropriate to treat this inconsistency as a...

CVE-2024-42302

In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpchandler awaits readiness of the seconda...

CVE-2024-42263

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drmsyncobjput. Fix it by...

CVE-2024-42266

In the Linux kernel, the following vulnerability has been resolved: btrfs: make cowfilerangeinline honor lockedpage on error The btrfs buffered write path runs through extentwritepage which has some tricky return value handling for writepagedelalloc. Specifically, when that returns 1, we exit, bu...

CVE-2024-42322 ipvs: properly dereference pe in ip_vs_add_service

In the Linux kernel, the following vulnerability has been resolved: ipvs: properly dereference pe in ipvsaddservice Use pe directly to resolve sparse warning: net/netfilter/ipvs/ipvsctl.c:1471:27: warning: dereference of noderef expression...

CVE-2024-42321 net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE

In the Linux kernel, the following vulnerability has been resolved: net: flowdissector: use DEBUGNETWARNONONCE The following splat is easy to reproduce upstream as well as in -stable kernels. Florian Westphal provided the following commit: d1dab4f71d37 "net: add and use skbgethashsymmetricnet" bu...

CVE-2024-42319 mailbox: mtk-cmdq: Move devm_mbox_controller_register() after devm_pm_runtime_enable()

In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Move devmmboxcontrollerregister after devmpmruntimeenable When mtk-cmdq unbinds, a WARNON message with condition pmruntimegetsync 0 occurs. According to the call tracei below: cmdqmboxshutdown mboxfreechannel...

CVE-2024-42317

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAXPAGECACHEORDER by commit 099d90642a71 "mm/filemap: make MAXPAGECACHEORD...

CVE-2024-42310 drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdvintellvdsgetmodes In cdvintellvdsgetmodes, the return value of drmmodeduplicate is assigned to mode, which will lead to a NULL pointer dereference on failure of drmmodeduplicate. Add...

CVE-2024-42308

Removed by vendor...

CVE-2024-42305

CVE-2024-42305 affects the Linux kernel ext4, where a dir-indexing edge case could trigger out-of-bounds access during directory entry splitting when the first two entries are not dot/dotdot. The description and connected material explain that make_indexed_dir() assumed the first two dirents are ...

CVE-2024-42306 udf: Avoid using corrupted block bitmap buffer

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap...

CVE-2024-42306

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap...

CVE-2024-42303

The CVE-2024-42303 issue affects the Linux kernel media imx-pxp driver. The root cause is an ERR_PTR dereference in pxp_probe() when devm_regmap_init_mmio() can fail, due to a missing check and bail‑out path. The patch adds a null/error check and exits gracefully, preventing a dereference and pot...

CVE-2024-42299

CVE-2024-42299 : In the Linux kernel, the ntfs3 log handling could panic when a mounted NTFS filesystem is moved between systems with different PAGE_SIZE because log->page_size changes in log_replay() but log->page_{mask,bits} do not. The issue caused a negative calculation in read_log_page...

CVE-2024-42296 f2fs: fix return value of f2fs_convert_inline_inode()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fsconvertinlineinode If device is readonly, make f2fsconvertinlineinode return EROFS instead of zero, otherwise it may trigger panic during writeback of inline inode's dirty page as below:...

CVE-2024-42289 scsi: qla2xxx: During vport delete send async logout explicitly

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. For all these stale I/O entries, ehabort...

CVE-2024-42284 tipc: Return non-zero value from tipc_udp_addr2str() on error

In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipcudpaddr2str on error tipcudpaddr2str should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipcmediaaddrprintf. Fix this by returni...