6318 matches found
CVE-2024-42249 spi: don't unoptimize message in spi_async()
In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spiasync Calling spimaybeunoptimizemessage in spiasync is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the...
CVE-2024-42249
In the Linux kernel, the following vulnerability has been resolved: spi: don't unoptimize message in spiasync Calling spimaybeunoptimizemessage in spiasync is wrong because the message is likely to be in the queue and not transferred yet. This can corrupt the message while it is being used by the...
CVE-2024-42250
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tree is ensured to be pinned there, while...
CVE-2024-42248 tty: serial: ma35d1: Add a NULL check for of_node
In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for ofnode The pdev-dev.ofnode can be NULL if the "serial" node is absent. Add a NULL check to return an error in such cases...
CVE-2024-42248
In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for ofnode The pdev-dev.ofnode can be NULL if the "serial" node is absent. Add a NULL check to return an error in such cases...
CVE-2024-42245 Revert "sched/fair: Make sure to try to detach at least one movable task"
In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignore env.maxloop if all tasks examined to...
CVE-2024-42244
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 "USB: serial: use generic method if no alternative is provided in usb serial layer", USB serial core calls the generic resume implementation when the driver has...
CVE-2024-42241
In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-sized page cache can't be supported by xarray. For example, 512MB page cache on ARM64 when the base page size is 64KB can't be supported by...
CVE-2024-42239
In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpftimercancel when callback is being cancelled Given a schedule: timer1 cb timer2 cb bpftimercanceltimer2; bpftimercanceltimer1; Both bpftimercancel calls would wait for the other callback to finish executing,...
CVE-2024-42240
In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entrySYSENTERcompat uses CLEARBRANCHHISTORY and calls the clearbhbloop before the TF flag...
CVE-2024-42238
In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Return error if block header overflows file Return an error from csdsppowerup if a block header is longer than the amount of data left in the file. The previous code in csdspload and csdsploadcoeff would loop whi...
CVE-2024-42235
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crsttablefree basecrstfree crsttablefree used to work with NULL pointers before the conversion to ptdescs. Since crsttablefree can be called with a NULL pointer error handling in crsttableupgrad...
CVE-2024-42236 usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usbstringcopy Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form if str0 - 1 == '\n' followed...
CVE-2024-42234 mm: fix crashes from deferred split racing folio migration
In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been seeing elusive "Bad page state"s often on flags when freeing, yet the flags shown are not bad: PGlocked had been set and cleared??, and...
CVE-2024-42233 filemap: replace pte_offset_map() with pte_offset_map_nolock()
In the Linux kernel, the following vulnerability has been resolved: filemap: replace pteoffsetmap with pteoffsetmapnolock The vmf-ptl in filemapfaultrecheckptenone is still set from handleptefault. But at the same time, we did a pteunmapvmf-pte. After a pteunmapvmf-pte unmap and rcureadunlock, th...
CVE-2024-42232
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayedwork and cephmoncstop The way the delayed work is handled in cephmoncstop is prone to races with monfault and possibly also finishhunting. Both of these can requeue the delayed work which wouldn't...
CVE-2024-42233
In the Linux kernel, the following vulnerability has been resolved: filemap: replace pteoffsetmap with pteoffsetmapnolock The vmf-ptl in filemapfaultrecheckptenone is still set from handleptefault. But at the same time, we did a pteunmapvmf-pte. After a pteunmapvmf-pte unmap and rcureadunlock, th...
Advisory ROSA-SA-2024-2463
software: zlib 1.2.11 OS: ROSA-CHROME packageevrstring: zlib-1.2.11-5 CVE-ID: CVE-2023-45853 BDU-ID: 2023-07116 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the zipOpenNewFileInZip464 function of the MiniZip package of the zlib library relates to an integer overflow when processing file name...
Advisory ROSA-SA-2024-2462
Software: gstreamer1.0-plugins-good 1.19.1 OS: ROSA-CHROME packageevrstring: gstreamer1.0-plugins-good-1.19.1-4 CVE-ID: CVE-2022-2122 BDU-ID: 2022-06453 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the qtdemuxinflate function of the Gstreamer multimedia framework is caused by an integer overflow...