CVE-2021-47362 drm/amd/pm: Update intermediate power state for SI

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Update intermediate power state for SI Update the current state as boot state during dpm initialization. During the subsequent initialization, setpowerstate gets called to transition to the final power state...

CVE-2021-47360

In CVE-2021-47360, the Linux kernel binder subsystem is affected. During BC_FREE_BUFFER processing, cleanup of BINDER_TYPE_FDA objects may close one or more fds, and because close operations run via the task work mechanism, the thread must return to userspace for the file object to be dereference...

CVE-2020-36788 drm/nouveau: avoid a use-after-free when BO init fails

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: avoid a use-after-free when BO init fails nouveauboinit is backed by ttmboinit and ferries its return code back to the caller. On failures, ttmboinit invokes the provided destructor which should de-initialize and fre...

CVE-2021-47357 atm: iphase: fix possible use-after-free in ia_module_exit()

In the Linux kernel, the following vulnerability has been resolved: atm: iphase: fix possible use-after-free in iamoduleexit This module's remove path calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running afte...

CVE-2021-47348 drm/amd/display: Avoid HDCP over-read and corruption

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP over-read and corruption Instead of reading the desired 5 bytes of the actual target field, the code was reading 8. This could result in a corrupted value if the trailing 3 bytes were non-zero, so...

CVE-2021-47343 dm btree remove: assign new_root only when removal succeeds

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign newroot only when removal succeeds removeraw in dmbtreeremove may fail due to IO read error e.g. read the content of origin block fails during shadowing, and the value of shadowspine::root is uninitialized...

CVE-2021-47341 KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio

In the Linux kernel, the following vulnerability has been resolved: KVM: mmio: Fix use-after-free Read in kvmvmioctlunregistercoalescedmmio BUG: KASAN: use-after-free in kvmvmioctlunregistercoalescedmmio+0x7c/0x1ec arch/arm64/kvm/../../../virt/kvm/coalescedmmio.c:183 Read of size 8 at addr...

CVE-2021-47340 jfs: fix GPF in diFree

In the Linux kernel, the following vulnerability has been resolved: jfs: fix GPF in diFree Avoid passing inode with JFSSBIinode-isb-ipimap == NULL to diFree1. GFP will appear: struct inode ipimap = JFSSBIip-isb-ipimap; struct inomap imap = JFSIPipimap-iimap; JFSIP will return invalid pointer when...

CVE-2021-47340 jfs: fix GPF in diFree

In the Linux kernel, the following vulnerability has been resolved: jfs: fix GPF in diFree Avoid passing inode with JFSSBIinode-isb-ipimap == NULL to diFree1. GFP will appear: struct inode ipimap = JFSSBIip-isb-ipimap; struct inomap imap = JFSIPipimap-iimap; JFSIP will return invalid pointer when...

CVE-2021-47338 fbmem: Do not delete the mode that is still in use

In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fbdeletevideomode is not based on the result of the previous fbconmodedeleted. As a result, the mode is directly deleted, regardless of whether it is still in us...

CVE-2021-47339

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: explicitly clear ioctl input data As seen from a recent syzbot bug report, mistakes in the compat ioctl implementation can lead to uninitialized kernel stack data getting used as input for driver ioctl handlers...

CVE-2021-47338

In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fbdeletevideomode is not based on the result of the previous fbconmodedeleted. As a result, the mode is directly deleted, regardless of whether it is still in us...

CVE-2021-47337

The CVE-2021-47337 issue is in the Linux kernel SCSI core path: when an error arises during scsi_host_alloc() and the error-handling ehandler thread fails to spawn, shost->ehandler may be set to ERR_PTR(-ENOMEM) and scsi_host_dev_release() would call kthread_stop() on a NULL/invalid pointer, r...

CVE-2021-47336 smackfs: restrict bytes count in smk_set_cipso()

In the Linux kernel, the following vulnerability has been resolved: smackfs: restrict bytes count in smksetcipso Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: PATCH smackfs: restrict byt...

CVE-2021-47336

CVE-2021-47336 affects the Linux kernel via the smackfs path: the function smk_set_cipso() incorrectly handles a bytes-count restriction, due to a mistaken cross-check that applied only to the SMK_FIXED24_FMT path. The issue was addressed in the patch sequence starting with commit 7ef4c19d245f3dc...

CVE-2021-47334 misc/libmasm/module: Fix two use after free in ibmasm_init_one

In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasminitone In ibmasminitone, it calls ibmasminitremoteinputdev. Inside ibmasminitremoteinputdev, mousedev and keybddev are allocated by inputallocatedevice, and assigned to...

CVE-2021-47333

In the Linux kernel, the following vulnerability has been resolved: misc: alcorpci: fix null-ptr-deref when there is no PCI bridge There is an issue with the ASPMoptional capability checking function. A device might be attached to root complex directly, in this case, bus-selfbridge will be NULL,...

CVE-2021-47322 NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT

In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix an Oops in pnfsmarkrequestcommit when doing ODIRECT Fix an Oopsable condition in pnfsmarkrequestcommit when we're putting a set of writes on the commit list to reschedule them after a failed pNFS attempt...

CVE-2021-47321 watchdog: Fix possible use-after-free by calling del_timer_sync()

In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free by calling deltimersync This driver's remove path calls deltimer. However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running...

CVE-2021-47316 nfsd: fix NULL dereference in nfs3svc_encode_getaclres

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svcencodegetaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and dreallyispositivedentry, but that looks like overkill to me--zero status should ...