CVE-2021-47316 nfsd: fix NULL dereference in nfs3svc_encode_getaclres

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix NULL dereference in nfs3svcencodegetaclres In error cases the dentry may be NULL. Before 20798dfe249a, the encoder also checked dentry and dreallyispositivedentry, but that looks like overkill to me--zero status should ...

CVE-2021-47313

The CVE-2021-47313 entry pertains to the Linux kernel cpufreq CPPC path, where a memleak could occur due to resources not being freed on policy->init() failure during cppc_cpufreq_cpu_init. The vulnerability, and its fix, are documented across multiple connected sources (kernel patch reference...

CVE-2021-47312

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix dereference of null pointer flow In the case where chain-flags & NFTCHAINHWOFFLOAD is false then nftflowrulecreate is not called and flow is NULL. The subsequent error handling execution via label...

CVE-2021-47309 net: validate lwtstate->data before returning from skb_tunnel_info()

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate-data before returning from skbtunnelinfo skbtunnelinfo returns pointer of lwtstate-data as iptunnelinfo type without validation. lwtstate-data can have various types such as mplsiptunnelencap, etc and these...

CVE-2021-47309

In the Linux kernel, the following vulnerability has been resolved: net: validate lwtstate-data before returning from skbtunnelinfo skbtunnelinfo returns pointer of lwtstate-data as iptunnelinfo type without validation. lwtstate-data can have various types such as mplsiptunnelencap, etc and these...

CVE-2021-47307

CVE-2021-47307 affects the Linux kernel CIFS code; a NULL pointer dereference in cifs_compose_mount_options() could occur when the optional ref parameter contains a NULL node_name. The issue has been resolved in the kernel, with fixes committed in stable updates (references point to kernel commit...

CVE-2021-47307 cifs: prevent NULL deref in cifs_compose_mount_options()

In the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL deref in cifscomposemountoptions The optional @ref parameter might contain an NULL nodename, so prevent dereferencing it in cifscomposemountoptions. Addresses-Coverity: 1476408 "Explicit null dereferenced"...

CVE-2021-47305

In CVE-2021-47305, the Linux kernel’s dma-buf/sync_file implementation leaks fences on error paths due to missing dma_fence_put() calls when merging fences and in krealloc_array failure. The fix ensures i and the fences array are zero-initialized and that all fences are dma_fence_put() and the fe...

CVE-2021-47305

In the Linux kernel, the following vulnerability has been resolved: dma-buf/syncfile: Don't leak fences on merge failure Each addfence call does a dmafenceget on the relevant fence. In the error path, we weren't calling dmafenceput so all those fences got leaked. Also, in the kreallocarray failur...

CVE-2021-47303 bpf: Track subprog poke descriptors correctly and fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: bpf: Track subprog poke descriptors correctly and fix use-after-free Subprograms are calling mappoketrack, but on program release there is no hook to call mappokeuntrack. However, on program release, the aux memory and poke...

CVE-2021-47296

CVE-2021-47296 affects the Linux kernel KVM on PPC. The issue is a leak in vcpu_load due to vcpu_put not being called when a user copy fails, which can corrupt preempt notifiers and cause crashes. The vulnerability is resolved via a kernel patch (details present in the connected advisories), with...

CVE-2021-47297 net: fix uninit-value in caif_seqpkt_sendmsg

In the Linux kernel, the following vulnerability has been resolved: net: fix uninit-value in caifseqpktsendmsg When nrsegs equal to zero in iovecfromuser, the object msg-msgiter.iov is uninit stack memory in caifseqpktsendmsg which is defined in syssendmsg. So we cann't just judge...

CVE-2021-47297 net: fix uninit-value in caif_seqpkt_sendmsg

In the Linux kernel, the following vulnerability has been resolved: net: fix uninit-value in caifseqpktsendmsg When nrsegs equal to zero in iovecfromuser, the object msg-msgiter.iov is uninit stack memory in caifseqpktsendmsg which is defined in syssendmsg. So we cann't just judge...

CVE-2021-47294 netrom: Decrease sock refcount when sock timers expire

In the Linux kernel, the following vulnerability has been resolved: netrom: Decrease sock refcount when sock timers expire Commit 63346650c1a9 "netrom: switch to sock timer API" switched to use sock timer API. It replaces modtimer by skresettimer, and deltimer by skstoptimer. Function skresettime...

CVE-2021-47293 net/sched: act_skbmod: Skip non-Ethernet packets

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: Skip non-Ethernet packets Currently tcfskbmodact assumes that packets use Ethernet as their L2 protocol, which is not always the case. As an example, for CAN devices: $ ip link add dev vcan0 type vcan $ ip...

CVE-2021-47287

CVE-2021-47287 affects the Linux kernel. The issue is a memory leak in the auxiliary bus code when driver_register() fails. Specifically, if driver_register() returns an error, memory allocated for auxdrv->driver.name must be freed before returning from __auxiliary_driver_register(). The fix r...

CVE-2021-47266 RDMA/ipoib: Fix warning caused by destroying non-initial netns

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Fix warning caused by destroying non-initial netns After the commit 5ce2dced8e95 "RDMA/ipoib: Set rtnllinkops for ipoib interfaces", if the IPoIB device is moved to non-initial netns, destroying that netns lets the...

CVE-2021-47261 IB/mlx5: Fix initializing CQ fragments buffer

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function initcqfragbuf can be called to initialize the current CQ fragments buffer cq-buf, or the temporary cq-resizebuf that is filled during CQ resize operation. However, the...

CVE-2021-47261 IB/mlx5: Fix initializing CQ fragments buffer

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function initcqfragbuf can be called to initialize the current CQ fragments buffer cq-buf, or the temporary cq-resizebuf that is filled during CQ resize operation. However, the...

CVE-2021-47260 NFS: Fix a potential NULL dereference in nfs_get_client()

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential NULL dereference in nfsgetclient None of the callers are expecting NULL returns from nfsgetclient so this code will lead to an Oops. It's better to return an error pointer. I expect that this is dead code so...