CVE-2024-35895 bpf, sockmap: Prevent lock inversion deadlock in map delete elem

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

CVE-2024-35893 net/sched: act_skbmod: prevent kernel-infoleak

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: prevent kernel-infoleak syzbot found that tcfskbmoddump was copying four bytes from kernel stack to user space 1. The issue here is that 'struct tcskbmod' has a four bytes hole. We need to clear the structur...

CVE-2024-35891 net: phy: micrel: Fix potential null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null pointer dereference In lan8814getsigrx and lan8814getsigtx ptpparseheader may return NULL as ptpheader due to abnormal packet type or corrupted packet. Fix this bug by adding ptpheader check...

CVE-2024-35890

In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skbsegmentlist those skbs can be reused as-is. This is an issue as their destructor was...

CVE-2024-35891

In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null pointer dereference In lan8814getsigrx and lan8814getsigtx ptpparseheader may return NULL as ptpheader due to abnormal packet type or corrupted packet. Fix this bug by adding ptpheader check...

CVE-2024-35889

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer...

CVE-2024-35889 idpf: fix kernel panic on unknown packet types

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer...

CVE-2024-35889 idpf: fix kernel panic on unknown packet types

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer...

CVE-2024-35888

In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspanbasehdr is present in skb-head syzbot reported a problem in ip6erspanrcv 1 Issue is that ip6erspanrcv and erspanrcv no longer make sure erspanbasehdr is present in skb linear part skb-head before getting...

CVE-2024-35887

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25dsdeltimer When the ax25 device is detaching, the ax25devdevicedown calls ax25dsdeltimer to cleanup the slavetimer. When the timer handler is running, the ax25dsdeltimer that calls...

CVE-2024-35886

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2024-35885

In the Linux kernel, the following vulnerability has been resolved: mlxbfgige: stop interface during shutdown The mlxbfgige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbfdriver will experience an exception right after...

CVE-2024-35883

In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxxspiprobe In function pci1xxxxspiprobe, there is a potential null pointer that may be caused by a failed memory allocation by the function devmkzalloc. Hence, a...

CVE-2024-35884

In the Linux kernel, the following vulnerability has been resolved: udp: do not accept non-tunnel GSO skbs landing in a tunnel When rx-udp-gro-forwarding is enabled UDP packets might be GROed when being forwarded. If such packets might land in a tunnel this can cause various issues and...

CVE-2024-35883 spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe

In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxxspiprobe In function pci1xxxxspiprobe, there is a potential null pointer that may be caused by a failed memory allocation by the function devmkzalloc. Hence, a...

CVE-2024-35881

Removed by vendor...

CVE-2024-35880

In the Linux kernel, the following vulnerability has been resolved: iouring/kbuf: hold iobufferlist reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safely use the iouring lock. Rely on the fact...

CVE-2024-35880 io_uring/kbuf: hold io_buffer_list reference over mmap

In the Linux kernel, the following vulnerability has been resolved: iouring/kbuf: hold iobufferlist reference over mmap If we look up the kbuf, ensure that it doesn't get unregistered until after we're done with it. Since we're inside mmap, we cannot safely use the iouring lock. Rely on the fact...

CVE-2024-35879

In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize ofchangesetdestroy with the devlink removals In the following sequence: 1 ofplatformdepopulate 2 ofoverlayremove During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF...

CVE-2024-35878

In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf In ofmodalias, we can get passed the str and len parameters which would cause a kernel oops in vsnprintf since it only allows passing a NULL ptr when the length is also 0...