CVE-2024-27017 netfilter: nft_set_pipapo: walk over current view on netlink dump

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftsetpipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it to infer what view of the datastructure ...

CVE-2024-27016

CVE-2024-27016 affects the Linux kernel netfilter flowtable path and is mitigated by a fix that ensures sufficient room to access the PPPoE header’s protocol field. The patch validates the protocol field before the flowtable lookup and uses a helper to access it, preventing out-of-bounds access. ...

CVE-2024-27016 netfilter: flowtable: validate pppoe header

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate pppoe header Ensure there is sufficient room to access the protocol field of the PPPoe header. Validate it once before the flowtable lookup, then use a helper function to access protocol field...

CVE-2024-27015 netfilter: flowtable: incorrect pppoe tuple

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple pppoe traffic reaching ingress path does not match the flowtable entry because the pppoe header is expected to be at the network header offset. This bug causes a mismatch in the flow...

CVE-2024-27014 net/mlx5e: Prevent deadlock while disabling aRFS

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent deadlock while disabling aRFS When disabling aRFS under the priv-statelock, any scheduled aRFS works are canceled using the cancelworksync function, which waits for the work to end if it has already started...

CVE-2024-27012 netfilter: nf_tables: restore set elements when delete set fails

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: restore set elements when delete set fails From abort path, nftmapelemactivate needs to restore refcounters to the original state. Currently, it uses the set-ops-walk to iterate over these set elements. The...

CVE-2024-27009 s390/cio: fix race condition during online processing

In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix race condition during online processing A race condition exists in ccwdevicesetonline that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts...

CVE-2024-27008 drm: nv04: Fix out of bounds access

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource dcb-or value is assigned in fabricatedcboutput, there may be out of bounds access to dacusers array in case dcb-or is zero because ffsdcb-or is used as index there. The 'or...

CVE-2024-27007 userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change srcfolio after ensuring it's unpinned in UFFDIOMOVE Commit d7a08838ab74 "mm: userfaultfd: fix unexpected change to srcfolio when UFFDIOMOVE fails" moved the srcfolio-mapping, index changing to after clearing t...

CVE-2024-27007 userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change srcfolio after ensuring it's unpinned in UFFDIOMOVE Commit d7a08838ab74 "mm: userfaultfd: fix unexpected change to srcfolio when UFFDIOMOVE fails" moved the srcfolio-mapping, index changing to after clearing t...

CVE-2024-27007

The CVE-2024-27007 issue affects the Linux kernel, specifically the userfaultfd path for UFFDIO_MOVE. The root cause was an incorrect update of src_folio (mapping/index) before the page-table is cleared and after unpin, risking memory corruption and swapout/migration failure. A fix was implemente...

CVE-2024-27005 interconnect: Don't access req_list while it's being manipulated

In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access reqlist while it's being manipulated The icclock mutex was split into separate icclock and iccbwlock mutexes in 1 to avoid lockdep splats. However, this didn't adequately protect access to...

CVE-2024-27005

In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access reqlist while it's being manipulated The icclock mutex was split into separate icclock and iccbwlock mutexes in 1 to avoid lockdep splats. However, this didn't adequately protect access to...

CVE-2024-27002 clk: mediatek: Do a runtime PM get on controllers during probe

In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: Do a runtime PM get on controllers during probe mt8183-mfgcfg has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack: CPU0: genpdlock -- clkpreparelock...

CVE-2024-27002

CVE-2024-27002 affects the Linux kernel mediatek clock controllers. Root cause: a mutual dependency between mt8183-mfgcfg and genpd during probing could deadlock with a runtime PM path. The fix: perform a runtime PM get on controllers during probe to ensure clk_register() does not acquire the gen...

CVE-2024-27000 serial: mxs-auart: add spinlock around changing cts state

In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uarthandlectschange function in serialcore expects the caller to hold uport-lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded ...

CVE-2024-26998 serial: core: Clearing the circular buffer before NULLifying it

In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uartttyportshutdown under the spin lock. However, the PM or other timer based callbacks may still trigger after this event withou...

CVE-2024-26997 usb: dwc2: host: Fix dereference issue in DDMA completion flow.

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow...

CVE-2024-26997 usb: dwc2: host: Fix dereference issue in DDMA completion flow.

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow...

CVE-2024-26997

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow...