CVE-2024-44989 bonding: fix xfrm real_dev null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm realdev null pointer dereference We shouldn't set realdev to NULL because packets can be in transit and xfrm might call xdodevoffloadok in parallel. All callbacks assume realdev is set. Example trace: kernel: BU...

CVE-2024-44988 net: dsa: mv88e6xxx: Fix out-of-bound access

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSAMAXPORTS the size of mv88e6xxxchip.ports array...

CVE-2024-44988 net: dsa: mv88e6xxx: Fix out-of-bound access

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSAMAXPORTS the size of mv88e6xxxchip.ports array...

CVE-2024-44987 ipv6: prevent UAF in ip6_send_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6sendskb syzbot reported an UAF in ip6sendskb 1 After ip6localout has returned, we no longer can safely dereference rt, unless we hold rcureadlock. A similar issue has been fixed in commit a688caa34beb "ipv...

CVE-2024-44986

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6finishoutput2 If skbexpandhead returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcureadlock to make sure the dst and associated idev are alive...

CVE-2024-44985 ipv6: prevent possible UAF in ip6_xmit()

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6xmit If skbexpandhead returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcureadlock to prevent a possible UAF...

CVE-2024-44984 bnxt_en: Fix double DMA unmapping for XDP_REDIRECT

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix double DMA unmapping for XDPREDIRECT Remove the dmaunmappageattrs call in the driver's XDPREDIRECT code path. This should have been removed when we let the page pool handle the DMA mapping. This bug causes the warning...

CVE-2024-44982

Summary of CVE-2024-44982 (Linux kernel): A bug in drm/msm/dpu cleanup occurs when dpu_format_populate_layout() fails, causing the FB to be prepared but not cleaned up. This leaks the GEM object pin_count and triggers a kernel crash (splat) on DRM file closure. Affected component: DRM/GPU MSM dri...

CVE-2024-44982 drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpuformatpopulatelayout fails If the dpuformatpopulatelayout fails, then FB is prepared, but not cleaned up. This ends up leaking the pincount on the GEM object and causes a splat during DRM file closur...

CVE-2024-44980

CVE-2024-44980 relates to the Linux kernel’s DRM/ XE opregion handling. The advisory reports a leak in opregion cleanup within xe_display_init_noirq/ intel_opregion_setup, traced to kmemleak_alloc/kmalloc_trace_noprof paths, resulting in an unreferenced object during probe/modprobe cleanup. The b...

CVE-2024-44979 drm/xe: Fix missing workqueue destroy in xe_gt_pagefault

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xegtpagefault On driver reload we never free up the memory for the pagefault and access counter workqueues. Add those destroy calls here. cherry picked from commit...

CVE-2024-44979 drm/xe: Fix missing workqueue destroy in xe_gt_pagefault

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix missing workqueue destroy in xegtpagefault On driver reload we never free up the memory for the pagefault and access counter workqueues. Add those destroy calls here. cherry picked from commit...

CVE-2024-44978

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xeexecqueueput Free job depends on job-vm being valid, the last xeexecqueueput can destroy the VM. Prevent UAF by freeing job before xeexecqueueput. cherry picked from commit...

CVE-2024-44978 drm/xe: Free job before xe_exec_queue_put

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Free job before xeexecqueueput Free job depends on job-vm being valid, the last xeexecqueueput can destroy the VM. Prevent UAF by freeing job before xeexecqueueput. cherry picked from commit...

CVE-2024-44977 drm/amdgpu: Validate TA binary size

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Validate TA binary size Add TA binary size validation to avoid OOB write. cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442...

CVE-2024-44976 ata: pata_macio: Fix DMA table overflow

In the Linux kernel, the following vulnerability has been resolved: ata: patamacio: Fix DMA table overflow Kolbjørn and Jonáš reported that their 32-bit PowerMacs were crashing in pata-macio since commit 09fe2bfa6b83 "ata: patamacio: Fix maxsegmentsize with PAGESIZE == 64K". For example: kernel B...

CVE-2024-44967

In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devmaddactionorreset will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so this cleanup leaves behind a...

CVE-2024-44972

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-44955

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-44960

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set up the endpoint for...