CVE-2024-44999

A use-after-free vulnerability was found in the Linux kernel's GPRS Tunneling Protocol GTP driver, specifically in the gtpdevxmit function. This issue is due to the IPv4 or IPv6 headers not being properly pulled into the skb-head before being accessed. This led to the use of uninitialized values,...

CVE-2024-44964

In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring qvector-vport pointers after reinitializating the structures. This is due to that all queue...

CVE-2024-44954

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below so pu...

CVE-2024-44973

In the Linux kernel, the following vulnerability has been resolved: mm, slub: do not call doslabfree for kfence object In 782f8906f805 the freeing of kfence objects was moved from deep inside doslabfree to the wrapper functions outside. This is a nice change, but unfortunately it missed one spot ...

CVE-2024-44997

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkwed: fix use-after-free panic in mtkwedsetuptcblockcb When there are multiple ap interfaces on one band and with WED on, turning the interface down will cause a kernel panic on MT798X. Previously, cbpriv was fre...

CVE-2024-44998

In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeuerx We can't dereference "skb" after calling vcc-push because the skb is released...

CVE-2024-44974

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp selectlocaladdress and selectsignaladdress both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the...

CVE-2024-44978

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xeexecqueueput Free job depends on job-vm being valid, the last xeexecqueueput can destroy the VM. Prevent UAF by freeing job before xeexecqueueput. cherry picked from commit...

CVE-2024-44984

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double DMA unmapping for XDPREDIRECT Remove the dmaunmappageattrs call in the driver's XDPREDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning...

CVE-2024-45002

In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool-data" allocation fails then there is no need to call osnoisefreetop and, in fact, doing so will lead to a NULL dereference...

CVE-2024-44982

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpuformatpopulatelayout fails If the dpuformatpopulatelayout fails, then FB is prepared, but not cleaned up. This ends up leaking the pincount on the GEM object and causes a splat during DRM file closur...

CVE-2024-44977

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442...

CVE-2024-45007 char: xillybus: Don't destroy workqueue from work item running on it

In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref decrement, destroyworkqueue may be called from within a work item for destroying its own workqueue. This illegal situation is averted by...

CVE-2024-45002 rtla/osnoise: Prevent NULL dereference in error handling

In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool-data" allocation fails then there is no need to call osnoisefreetop and, in fact, doing so will lead to a NULL dereference...

CVE-2024-45002 rtla/osnoise: Prevent NULL dereference in error handling

In the Linux kernel, the following vulnerability has been resolved: rtla/osnoise: Prevent NULL dereference in error handling If the "tool-data" allocation fails then there is no need to call osnoisefreetop and, in fact, doing so will lead to a NULL dereference...

CVE-2024-44999 gtp: pull network headers in gtp_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtpdevxmit syzbot/KMSAN reported use of uninit-value in getdevxmit 1 We must make sure the IPv4 or Ipv6 header is pulled in skb-head before accessing fields in them. Use pskbinetmaypull to fix this...

CVE-2024-44998

In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeuerx We can't dereference "skb" after calling vcc-push because the skb is released...

CVE-2024-44994 iommu: Restore lost return in iommu_report_device_fault()

In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommureportdevicefault When iommureportdevicefault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which...

CVE-2024-44994

In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommureportdevicefault When iommureportdevicefault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which...

CVE-2024-44993

In CVE-2024-44993, the Linux kernel DRM v3d driver exposes an out-of-bounds read in v3d_csd_job_run() when UBSAN is enabled on Raspberry Pi 5. The UAPI supplies seven configuration registers, but the code reads an eighth element of a __u32 array, triggering a local read violation in v3d_csd_job_r...