UBUNTU-CVE-2021-47232

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...

CVE-2021-47370

CVE-2021-47370 affects the Linux kernel and concerns the MPTCP path: a signed/unsigned comparison in the code path that refills the TX cache can misbehave when size_goal is smaller than skb->len, causing the core TCP path to allocate an skb without the MPTCP extension. The fix rewrites the exp...

CVE-2021-47370

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure tx skbs always have the MPTCP ext Due to signed/unsigned comparison, the expression: info-sizegoal - skb-len 0 evaluates to true when the size goal is smaller than the skb size. That results in lack of tx cache...

CVE-2021-47367 virtio-net: fix pages leaking when building skb in big mode

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix pages leaking when building skb in big mode We try to use buildskb if we had sufficient tailroom. But we forget to release the unused pages chained via private in big mode which will leak pages. Fixing this by...

CVE-2021-47367 virtio-net: fix pages leaking when building skb in big mode

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix pages leaking when building skb in big mode We try to use buildskb if we had sufficient tailroom. But we forget to release the unused pages chained via private in big mode which will leak pages. Fixing this by...

CVE-2021-47367

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix pages leaking when building skb in big mode We try to use buildskb if we had sufficient tailroom. But we forget to release the unused pages chained via private in big mode which will leak pages. Fixing this by...

CVE-2021-47302 igc: Fix use-after-free error during reset

In the Linux kernel, the following vulnerability has been resolved: igc: Fix use-after-free error during reset Cleans the next descriptor to watch nexttowatch when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igcpoll runs while the controller is being reset this ca...

CVE-2021-47301 igb: Fix use-after-free error during reset

In the Linux kernel, the following vulnerability has been resolved: igb: Fix use-after-free error during reset Cleans the next descriptor to watch nexttowatch when cleaning the TX ring. Failure to do so can cause invalid memory accesses. If igbpoll runs while the controller is reset this can lead...

CVE-2021-47251

Summary: CVE-2021-47251 affects the Linux kernel’s wireless stack via mac80211, where the skb length check in ieee80211_scan_rx() was corrected. The fix replaces hard-coded header-length constants with dynamic calculation based on the frame type, preventing a validation WARN_ON in cfg80211 later....

CVE-2021-47251 mac80211: fix skb length check in ieee80211_scan_rx()

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix skb length check in ieee80211scanrx Replace hard-coded compile-time constants for header length check with dynamic determination based on the frame type. Otherwise, we hit a validation WARNON in cfg80211 later. styl...

CVE-2021-47251

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix skb length check in ieee80211scanrx Replace hard-coded compile-time constants for header length check with dynamic determination based on the frame type. Otherwise, we hit a validation WARNON in cfg80211 later. styl...

CVE-2021-47241 ethtool: strset: fix message length calculation

In the Linux kernel, the following vulnerability has been resolved: ethtool: strset: fix message length calculation Outer nest for ETHTOOLASTRSETSTRINGSETS is not accounted for. This may result in ETHTOOLMSGSTRSETGET producing a warning like: calculated message payload length 684 not sufficient...

CVE-2021-47236 net: cdc_eem: fix tx fixup skb leak

In the Linux kernel, the following vulnerability has been resolved: net: cdceem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eemtxfixup, if skbcopyexpand failed, it return NULL, usbnetstartxmit will have no chance to free original skb. fix it by free orginal skb in eemtxfixu...

CVE-2021-47236

CVE-2021-47236 : Linux kernel vulnerability in net:cdc_eem skb leak during USBNet transmission has been resolved. Root cause: in eem_tx_fixup(), original skb was not freed when skb_copy_expand() failed, allowing a leak if the clone status was not free’d. The fix frees the original skb in eem_tx_f...

CVE-2021-47236 net: cdc_eem: fix tx fixup skb leak

In the Linux kernel, the following vulnerability has been resolved: net: cdceem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eemtxfixup, if skbcopyexpand failed, it return NULL, usbnetstartxmit will have no chance to free original skb. fix it by free orginal skb in eemtxfixu...

CVE-2021-47236

In the Linux kernel, the following vulnerability has been resolved: net: cdceem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eemtxfixup, if skbcopyexpand failed, it return NULL, usbnetstartxmit will have no chance to free original skb. fix it by free orginal skb in eemtxfixu...

CVE-2021-47232

CVE-2021-47232 affects the Linux kernel CAN/J1939 subsystem. The root cause is a Use‑After‑Free caused by taking a skb from the per‑session skb queue without incrementing its refcount, which can occur concurrently due to CTS. The patch fixes this by ensuring skb refcounting is handled correctly w...

CVE-2021-47232 can: j1939: fix Use-after-Free, hold skb ref while in use

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...

CVE-2021-47232 can: j1939: fix Use-after-Free, hold skb ref while in use

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix Use-after-Free, hold skb ref while in use This patch fixes a Use-after-Free found by the syzbot. The problem is that a skb is taken from the per-session skb queue, without incrementing the ref count. This leads to...

CVE-2021-47224 net: ll_temac: Make sure to free skb when it is completely used

In the Linux kernel, the following vulnerability has been resolved: net: lltemac: Make sure to free skb when it is completely used With the skb pointer piggy-backed on the TX BD, we have a simple and efficient way to free the skb buffer when the frame has been transmitted. But in order to avoid...