CVE-2024-40937 gve: Clear napi->skb before dev_kfree_skb_any()

In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi-skb before devkfreeskbany gverxfreeskb incorrectly leaves napi-skb referencing an skb after it is freed with devkfreeskbany. This can result in a subsequent call to napigetfrags returning a dangling pointer. Fix...

CVE-2024-40935 cachefiles: flush all requests after setting CACHEFILES_DEAD

In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILESDEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILESDEAD, the cachefilesdaemonwrite will always return -EIO, so t...

CVE-2024-40933

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: mlx90635: Fix ERRPTR dereference in mlx90635probe When devmregmapiniti2c fails, regmapee could be error pointer, instead of checking for ISERRregmapee, regmap is checked which looks like a copy paste error...

CVE-2024-40930

Vulnerability CVE-2024-40930 in the Linux kernel’s wifi cfg80211 HE operation element parsing due to insufficient length validation. The issue arises during parsing of HE operation elements, potentially allowing malformed input to be processed because the length check was not performed prior to p...

CVE-2024-40930

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate HE operation element parsing Validate that the HE operation element has the correct length before parsing it...

CVE-2024-40929

CVE-2024-40929 : Linux kernel vulnerability in wifi/iwlwifi/mvm where the ssids pointer could be accessed when n_ssids is 0, causing an out-of-bounds read. The fix adds a check for n_ssids before dereferencing the ssids pointer. Documented impact per CVE: LOCAL access with LOW privileges required...

CVE-2024-40929

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check nssids before accessing the ssids In some versions of cfg80211, the ssids poinet might be a valid one even though nssids is 0. Accessing the pointer in this case will cuase an out-of-bound access. Fix th...

CVE-2024-40923 vmxnet3: disable rx data ring on dma allocation failure

In the Linux kernel, the following vulnerability has been resolved: vmxnet3: disable rx data ring on dma allocation failure When vmxnet3rqcreate fails to allocate memory for rq-dataring.base, the subsequent call to vmxnet3rqdestroyallrxdataring does not reset rq-dataring.descsize for the data rin...

CVE-2024-40924

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm-boundlist. Then it tries to rewrite the PTEs via a stale CPU...

CVE-2024-40922 io_uring/rsrc: don't lock while !TASK_RUNNING

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: don't lock while !TASKRUNNING There is a report of iorsrcrefquiesce locking a mutex while not TASKRUNNING, which is due to forgetting restoring the state back after ioruntaskworksig and attempts to break out of the...

CVE-2024-40919

In the Linux kernel, the following vulnerability has been resolved: bnxten: Adjust logging of firmware messages in case of released token in hwrmsend In case of token is released due to token-state == BNXTHWRMDEFERRED, released token set to NULL is used in log messages. This issue is expected to ...

CVE-2024-40919 bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Adjust logging of firmware messages in case of released token in hwrmsend In case of token is released due to token-state == BNXTHWRMDEFERRED, released token set to NULL is used in log messages. This issue is expected to ...

CVE-2024-40917

CVE-2024-40917 affects the Linux kernel memory management (memblock) related to NUMA/node handling. The issue stems from memblock_validate_numa_coverage() allowing a NUMA_NO_NODE condition and memblock_alloc_range_nid() warning about MAX_NUMNODES, leading to a NULL dereference in memmap_init() wh...

CVE-2024-40916

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variant...

CVE-2024-40902

CVE-2024-40902: Linux kernel vulnerability in jfs xattr handling where printing an oversized xattr in hex could read past the buffer, risking kernel memory. A fix restricts the debug hex dump size in kernel logs. Public-coverage in Astra Linux and CIRCL references confirms the same vulnerability ...

CVE-2024-40901

CVE-2024-40901 affects the Linux kernel SCSI MPT3SAS path. The issue is a potential out-of-bounds access from test_bit()/set_bit() on a single word, where operations can exceed word boundaries. Mitigation implemented by ensuring allocations are at least sizeof(unsigned long) to provide space for ...

CVE-2024-39510 cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()

In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefilesondemanddaemonread We got the following issue in a fuzz test of randomly issuing the restore command: ================================================================== BUG: KASAN:...

CVE-2024-39506 liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet

In the Linux kernel, the following vulnerability has been resolved: liquidio: Adjust a NULL pointer handling path in liovfrepcopypacket In liovfrepcopypacket pginfo-page is compared to a NULL value, but then it is unconditionally passed to skbaddrxfrag which looks strange and could lead to null...

CVE-2024-39505 drm/komeda: check for error-valued pointer

In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komedapipelinegetstate may return an error-valued pointer, thus check the pointer for negative or null value before dereferencing...

CVE-2024-39505 drm/komeda: check for error-valued pointer

In the Linux kernel, the following vulnerability has been resolved: drm/komeda: check for error-valued pointer komedapipelinegetstate may return an error-valued pointer, thus check the pointer for negative or null value before dereferencing...