CVE-2021-47485 IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields

In the Linux kernel, the following vulnerability has been resolved: IB/qib: Protect from buffer overflow in struct qibusersdmapkt fields Overflowing either addrlimit or bytestogo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on...

CVE-2021-47486

CVE-2021-47486 affects the Linux kernel’s RISC-V BPF JIT: when NR_JIT_ITERATIONS is reached and jit_data->header is NULL, bpf_jit_binary_free() dereferences a NULL and can crash. The fix is a NULL-argument check before calling bpf_jit_binary_free(), per the provided description. Public details...

CVE-2021-47484 octeontx2-af: Fix possible null pointer dereference.

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Fix possible null pointer dereference. This patch fixes possible null pointer dereference in files "rvudebugfs.c" and "rvunix.c"...

CVE-2021-47482 net: batman-adv: fix error handling

In the Linux kernel, the following vulnerability has been resolved: net: batman-adv: fix error handling Syzbot reported ODEBUG warning in batadvncmeshfree. The problem was in wrong error handling in batadvmeshinit. Before this patch batadvmeshinit was calling batadvmeshfree in case of any...

CVE-2021-47483 regmap: Fix possible double-free in regcache_rbtree_exit()

In the Linux kernel, the following vulnerability has been resolved: regmap: Fix possible double-free in regcacherbtreeexit In regcacherbtreeinserttoblock, when 'present' realloc failed, the 'blk' which is supposed to assign to 'rbnode-block' will be freed, so 'rbnode-block' points a freed memory,...

CVE-2021-47481 RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR Normally the zero fill would hide the missing initialization, but an errant set to descsize in regcreate causes a crash: BUG: unable to handle page fault for address:...

CVE-2021-47479 staging: rtl8712: fix use-after-free in rtl8712_dl_fw

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix use-after-free in rtl8712dlfw Syzbot reported use-after-free in rtl8712dlfw. The problem was in race condition between r871xudevremove -ndoopen callback. It's easy to see from crash log, that driver accesses...

CVE-2021-47479 staging: rtl8712: fix use-after-free in rtl8712_dl_fw

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix use-after-free in rtl8712dlfw Syzbot reported use-after-free in rtl8712dlfw. The problem was in race condition between r871xudevremove -ndoopen callback. It's easy to see from crash log, that driver accesses...

CVE-2021-47471

In the Linux kernel, the following vulnerability has been resolved: drm: mxsfb: Fix NULL pointer dereference crash on unload The mxsfb-crtc.funcs may already be NULL when unloading the driver, in which case calling mxsfbirqdisable via drmirquninstall from mxsfbunload leads to NULL pointer...

CVE-2021-47463

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix NULL page-mapping dereference in pageissecretmem Check for a NULL page-mapping before dereferencing the mapping in pageissecretmem, as the page's mapping can be nullified while gup is running, e.g. by reclaim or...

CVE-2021-47463

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix NULL page-mapping dereference in pageissecretmem Check for a NULL page-mapping before dereferencing the mapping in pageissecretmem, as the page's mapping can be nullified while gup is running, e.g. by reclaim or...

CVE-2021-47452

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip netdev events generated on netns removal syzbot reported following harmless WARN: WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468 nftnetdevunregisterhooks net/netfilter/nftablesapi.c:230 inline...

CVE-2021-47457

In the Linux kernel, the following vulnerability has been resolved: can: isotp: isotpsendmsg: add result check for waiteventinterruptible Using waiteventinterruptible to wait for complete transmission, but do not check the result of waiteventinterruptible which can be interrupted. It will result ...

CVE-2021-47453

In the Linux kernel, the following vulnerability has been resolved: ice: Avoid crash from unnecessary IDA free In the remove path, there is an attempt to free the auxidx IDA whether it was allocated or not. This can potentially cause a crash when unloading the driver on systems that do not...

CVE-2021-47450

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix host stage-2 PGD refcount The KVM page-table library refcounts the pages of concatenated stage-2 PGDs individually. However, when running KVM in protected mode, the host's stage-2 PGD is currently managed by EL2 a...

CVE-2021-47454

In the Linux kernel, the following vulnerability has been resolved: powerpc/smp: do not decrement idle task preempt count in CPU offline With PREEMPTCOUNT=y, when a CPU is offlined and then onlined again, we get: BUG: scheduling while atomic: swapper/1/0/0x00000000 no locks held by swapper/1/0...

CVE-2021-47441

In the Linux kernel, the following vulnerability has been resolved: mlxsw: thermal: Fix out-of-bounds memory accesses Currently, mlxsw allows cooling states to be set above the maximum cooling state supported by the driver: cat /sys/class/thermal/thermalzone2/cdev0/type mlxswfan cat...

CVE-2021-47444

In the Linux kernel, the following vulnerability has been resolved: drm/edid: In connectorbadedid cap numofext by numblocks read In commit e11f5bd8228f "drm: Add support for DP 1.4 Compliance edid corruption test" the function connectorbadedid started assuming that the memory for the EDID passed ...

CVE-2021-47445

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix null pointer dereference on pointer edp The initialization of pointer dev dereferences pointer edp before edp is null checked, so there is a potential null pointer deference issue. Fix this by only dereferencing edp...

CVE-2021-47459

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939netdevstart: fix UAF for rxkref of j1939priv It will trigger UAF for rxkref of j1939priv as following. cpu0 cpu1 j1939skbindsocket0, ndev0, ... j1939netdevstart j1939skbindsocket1, ndev0, ... j1939netdevstart...