CVE-2021-47614

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a user-after-free in addpbleprm When irdmahmcsdone fails, 'chunk' is freed while its still on the PBLE info list. Add the chunk entry to the PBLE info list only after successful setting of the SD in irdmahmcsdone...

CVE-2021-47613 i2c: virtio: fix completion handling

In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: fix completion handling The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers. However, this is not true, since the notify callback could be called...

CVE-2021-47613

In the Linux kernel, the following vulnerability has been resolved: i2c: virtio: fix completion handling The driver currently assumes that the notify callback is only received when the device is done with all the queued buffers. However, this is not true, since the notify callback could be called...

CVE-2021-47611

CVE-2021-47611 affects the Linux kernel (mac80211) where parsing of extended elements could proceed without verifying that the extended element ID is present. The fix Verifies the extended element ID before parsing to prevent malformed element handling. The documented impact is LOCAL, with attack...

CVE-2021-47611 mac80211: validate extended element ID is present

In the Linux kernel, the following vulnerability has been resolved: mac80211: validate extended element ID is present Before attempting to parse an extended element, verify that the extended element ID is present...

CVE-2021-47611

In the Linux kernel, the following vulnerability has been resolved: mac80211: validate extended element ID is present Before attempting to parse an extended element, verify that the extended element ID is present...

CVE-2021-47610

CVE-2021-47610: In the Linux kernel, a NULL pointer dereference in the DRM MSM GEM submit path (msm_ioctl_gem_submit) could trigger a kernel panic (Oops) and crash the system. The vulnerability arises from dereferencing a NULL in msm_ioctl_gem_submit, leading to a trace via kref_put and drm ioctl...

CVE-2021-47609 firmware: arm_scpi: Fix string overflow in SCPI genpd driver

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpipd-name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name...

CVE-2021-47609

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: Fix string overflow in SCPI genpd driver Without the bound checks for scpipd-name, it could result in the buffer overflow when copying the SCPI device name from the corresponding device tree node as the name...

CVE-2021-47610

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix null ptr access msmioctlgemsubmit Fix the below null pointer dereference in msmioctlgemsubmit: 26545.260705: Call trace: 26545.263223: krefput+0x1c/0x60 26545.266452: msmioctlgemsubmit+0x254/0x744 26545.270937:...

CVE-2021-47606

In the Linux kernel, the following vulnerability has been resolved: net: netlink: afnetlink: Prevent empty skb by adding a check on len. Adding a check on len parameter to avoid empty skb. This prevents a division error in netemenqueue function which is caused when skb-len=0 and skb-datalen=0 in...

CVE-2021-47605 vduse: fix memory corruption in vduse_dev_ioctl()

In the Linux kernel, the following vulnerability has been resolved: vduse: fix memory corruption in vdusedevioctl The "config.offset" comes from the user. There needs to a check to prevent it being out of bounds. The "config.offset" and "dev-configsize" variables are both type u32. So if the offs...

CVE-2021-47604 vduse: check that offset is within bounds in get_config()

In the Linux kernel, the following vulnerability has been resolved: vduse: check that offset is within bounds in getconfig This condition checks "len" but it does not check "offset" and that could result in an out of bounds read if "offset dev-configsize". The problem is that since both variables...

CVE-2021-47603 audit: improve robustness of the audit queue handling

In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditdthread could get blocked attempting to send audit records to the userspace audit daemon. With...

CVE-2021-47603

In the Linux kernel, the following vulnerability has been resolved: audit: improve robustness of the audit queue handling If the audit daemon were ever to get stuck in a stopped state the kernel's kauditdthread could get blocked attempting to send audit records to the userspace audit daemon. With...

CVE-2021-47602

In the Linux kernel, the following vulnerability has been resolved: mac80211: track only QoS data frames for admission control For admission control, obviously all of that only works for QoS data frames, otherwise we cannot even access the QoS field in the header. Syzbot reported see below an...

CVE-2021-47601 tee: amdtee: fix an IS_ERR() vs NULL bug

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an ISERR vs NULL bug The getfreepages function does not return error pointers it returns NULL so fix this condition to avoid a NULL dereference...

CVE-2021-47601 tee: amdtee: fix an IS_ERR() vs NULL bug

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix an ISERR vs NULL bug The getfreepages function does not return error pointers it returns NULL so fix this condition to avoid a NULL dereference...

CVE-2021-47600 dm btree remove: fix use after free in rebalance_children()

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: fix use after free in rebalancechildren Move dmtmunlock after dmtmdec...

CVE-2021-47599

In the Linux kernel, the following vulnerability has been resolved: btrfs: use latestdev in btrfsshowdevname The test case btrfs/238 reports the warning below: WARNING: CPU: 3 PID: 481 at fs/btrfs/super.c:2509 btrfsshowdevname+0x104/0x1e8 btrfs CPU: 2 PID: 1 Comm: systemd Tainted: G W O...