CVE-2022-49020 net/9p: Fix a potential socket leak in p9_socket_open

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix a potential socket leak in p9socketopen Both p9fdcreatetcp and p9fdcreateunix will call p9socketopen. If the creation of p9transfd fails, p9fdcreatetcp and p9fdcreateunix will return an error directly instead of...

CVE-2024-50033 slip: make slhc_remember() more robust against malicious packets

In the Linux kernel, the following vulnerability has been resolved: slip: make slhcremember more robust against malicious packets syzbot found that slhcremember was missing checks against malicious packets 1. slhcremember only checked the size of the packet was at least 20, which is not good...

DEBIAN-CVE-2024-49978

In the Linux kernel, the following vulnerability has been resolved: gso: fix udp gso fraglist segmentation after pull from fraglist Detect gso fraglist skbs with corrupted geometry see below and pass these to skbsegment instead of skbsegmentlist, as the first can segment them correctly. Valid...

DEBIAN-CVE-2024-49946

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

CVE-2024-49864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpcopensocket, it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in...

DEBIAN-CVE-2024-49864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpcopensocket, it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in...

UBUNTU-CVE-2024-49864

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpcopensocket, it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in...

CVE-2024-49946

CVE-2024-49946 affects the Linux kernel PPP stack. The issue arises in ppp_channel_bridge_input() when packets are backlogged to a socket owned by a user process and the code path can call sk_backlog_rcv()/__release_sock()/release_sock() in process context. This creates an inconsistent lock state...

CVE-2024-49946 ppp: do not assume bh is held in ppp_channel_bridge_input()

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in pppchannelbridgeinput Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the...

CVE-2024-49938 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Use skbsetlength for resetting urb before resubmit Syzbot points out that skbtrim has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly ju...

CVE-2024-49864 rxrpc: Fix a race between socket set up and I/O thread creation

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpcopensocket, it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in...

CVE-2024-49864 rxrpc: Fix a race between socket set up and I/O thread creation

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpcopensocket, it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in...

SUSE CVE-2024-47710

In the Linux kernel, the following vulnerability has been resolved: sockmap: Add a condresched in sockhashfree Several syzbot soft lockup reports all have in common sockhashfree If a map with a large number of buckets is destroyed, we need to yield the cpu when needed...

SUSE CVE-2024-47713

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...

AZL-51213 CVE-2024-47710 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: sockmap: Add a condresched in sockhashfree Several syzbot soft lockup reports all have in common sockhashfree If a map with a large number of buckets is destroyed, we need to yield the cpu when needed...

AZL-51156 CVE-2024-47713 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211dostop Since 'devqueuexmit' should be called with interrupts enabled, the following backtrace: ieee80211dostop ... spinlockirqsave&local-queuestopreasonlock, flags...

AZL-50659 CVE-2024-47684 affecting package kernel for versions less than 6.6.56.1-5

In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcprtodeltaus We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcprearmrto. Initially hittin...

CVE-2024-47709

Concretely, CVE-2024-47709 concerns the Linux kernel bcm driver path: after remove_proc_entry() bcm_notify() previously left bo->bcm_proc_read set, causing bcm_release() to trigger an extra remove_proc_entry(). The fix clears bo->bcm_proc_read after remove_proc_entry() in bcm_notify(), prev...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the skb cb in the tipc component not being reacquired after tipcmsgvalidate, resulting in a post-release reu...

CVE-2022-49020: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: net/9p: Fix a potential socket leak in p9socketopen Both p9fdcreatetcp and p9fdcreateunix will call p9socketopen. If the creation of p9transfd fails, p9fdcreatetcp and p9fdcreateunix will return an error directly instead of...