CVE-2024-35925 block: prevent division by zero in blk_rq_stat_sum()

In the Linux kernel, the following vulnerability has been resolved: block: prevent division by zero in blkrqstatsum The expression dst-nrsamples + src-nrsamples may have zero value on overflow. It is necessary to add a check to avoid division by zero. Found by Linux Verification Center...

CVE-2024-35891

In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null pointer dereference In lan8814getsigrx and lan8814getsigtx ptpparseheader may return NULL as ptpheader due to abnormal packet type or corrupted packet. Fix this bug by adding ptpheader check...

CVE-2024-35909

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Split 64bit accesses to fix alignment issues Some of the registers are aligned on a 32bit boundary, causing alignment faults on 64bit platforms. Unable to handle kernel paging request at virtual address...

CVE-2024-35916 dma-buf: Fix NULL pointer dereference in sanitycheck()

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck If due to a memory allocation failure mockchain returns NULL, it is passed to dmafenceenableswsignaling resulting in NULL pointer dereference there. Call...

CVE-2024-35912

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks If the rx payload length check fails, or if kmemdup fails, we still need to free the command response. Fix that...

CVE-2024-35909 net: wwan: t7xx: Split 64bit accesses to fix alignment issues

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Split 64bit accesses to fix alignment issues Some of the registers are aligned on a 32bit boundary, causing alignment faults on 64bit platforms. Unable to handle kernel paging request at virtual address...

CVE-2024-35903

In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to emitpatch so it calculates the correct offset for the CALL instruction if x86calldepthemitaccounting emits code. Otherwise we will skip some instruction...

CVE-2024-35901 net: mana: Fix Rx DMA datasize and skb_over_panic

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skboverpanic managetrxbufcfg aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skboverpanic. Sample dmesg:...

CVE-2024-35897

CVE-2024-35897 affects the Linux kernel nf_tables component. The issue arises when updating the discard table flag while a basechain deletion is pending, because unregistration of hooks is deferred to the commit phase. If both commands execute together, a basechain can be deleted while its hook r...

CVE-2024-35896

CVE-2024-35896 concerns the Linux kernel’s netfilter/SockOpt path. The description shows a fix for validating user input length in nf_setsockopt, preventing a slab-out-of-bounds read traced to copy_from_sockptr_offset used during iptables/setsockopt handling. The issue manifested as a read of siz...

CVE-2024-35895 bpf, sockmap: Prevent lock inversion deadlock in map delete elem

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

CVE-2024-35893 net/sched: act_skbmod: prevent kernel-infoleak

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: prevent kernel-infoleak syzbot found that tcfskbmoddump was copying four bytes from kernel stack to user space 1. The issue here is that 'struct tcskbmod' has a four bytes hole. We need to clear the structur...

CVE-2024-35891 net: phy: micrel: Fix potential null pointer dereference

In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null pointer dereference In lan8814getsigrx and lan8814getsigtx ptpparseheader may return NULL as ptpheader due to abnormal packet type or corrupted packet. Fix this bug by adding ptpheader check...

CVE-2024-35889 idpf: fix kernel panic on unknown packet types

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpfrxprocessskbfields would return early without calling ethtypetrans to set the skb protocol / the network layer...

CVE-2024-35885

In the Linux kernel, the following vulnerability has been resolved: mlxbfgige: stop interface during shutdown The mlxbfgige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbfdriver will experience an exception right after...

CVE-2024-35874 aio: Fix null ptr deref in aio_complete() wakeup

In the Linux kernel, the following vulnerability has been resolved: aio: Fix null ptr deref in aiocomplete wakeup listdelinitcareful needs to be the last access to the wait queue entry - it effectively unlocks access. Previously, finishwait would see the empty list head and skip taking the lock,...

CVE-2024-35869 smb: client: guarantee refcounted children from parent session

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon-ses are also...

CVE-2024-35868 smb: client: fix potential UAF in cifs_stats_proc_write()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifsstatsprocwrite Skip sessions that are being teared down status == SESEXITING to avoid UAF...

CVE-2024-35860 bpf: support deferring bpf_link dealloc to after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...

CVE-2023-52671

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 Why Under some circumstances, disabling an OPTC and attempting to reclaim its OPPs for a different OPTC could cause a hang/underflow due to OPPs not being properly...