CVE-2024-26848

In the Linux kernel, the following vulnerability has been resolved: afs: Fix endless loop in directory parsing If a directory has a block with only ".afsXXXX" files in it from uncompleted silly-rename, these .afsXXXX files are skipped but without advancing the file position in the dircontext. Thi...

CVE-2024-26878

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquotfreeinode quotaoff dropdquotref removedquotref dquots = idquotinode dquots = idquotinode srcureadlock dquotscnt != NULL 1...

CVE-2024-26909

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmicglinkaltmode: fix drm bridge use-after-free A recent DRM series purporting to simplify support for "transparent bridges" and handling of probe deferrals ironically exposed a use-after-free issue on pmicglinkaltmode...

UBUNTU-CVE-2024-26914

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix incorrect mpccombine array size why MAXSURFACES is per stream, while MAXPLANES is per asic. The mpccombine is an array that records all the planes per asic. Therefore MAXPLANES should be used as the array siz...

CVE-2024-26920 tracing/trigger: Fix to return error if failed to alloc snapshot

In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix registersnapshottrigger to return error code if it failed to allocate a snapshot instead of 0 success. Unless that, it will register snapshot trigger without an...

CVE-2024-26912

The connected Nessus entry for CVE-2024-26912 provides concrete details: in the Linux kernel, the Nouveau driver leaked several GSP-RM DMA buffers (nvkm_gsp_mem objects) that were never deallocated. Some buffers could be freed soon after GSP-RM initialization, while others remained until driver u...

CVE-2023-52645

CVE-2023-52645 is a Linux kernel race condition affecting mediatek power domains managed by genpd. The issue arises if power domains are registered first with genpd and later powered on in the driver’s probe, creating a potential race with genpd’s on/off operations. The described fix involves seq...

CVE-2024-31463 Ironic-image allows unauthenticated local access to Ironic API

Ironic-image is an OpenStack Ironic deployment packaged and configured by Metal3. When the reverse proxy mode is enabled by the IRONICREVERSEPROXYSETUP variable set to true, 1 HTTP basic credentials are validated on the HTTPD side in a separate container, not in the Ironic service itself and 2...

DEBIAN-CVE-2024-26893

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chanfree callback function, defined by each transport. Since multiple protocols might share the same...

CVE-2024-26858

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadatamap Just simply reordering the functions mlx5eptpmetadatamapput and mlx5eptpsqtrackmetadata in the mlx5etxwqecomplete...

CVE-2024-26848

In the Linux kernel, the following vulnerability has been resolved: afs: Fix endless loop in directory parsing If a directory has a block with only ".afsXXXX" files in it from uncompleted silly-rename, these .afsXXXX files are skipped but without advancing the file position in the dircontext. Thi...

CVE-2024-26884

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on rounduppowoftwo to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches,...

CVE-2024-26900

In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev-serial If kobjectadd is fail in bindrdevtoarray, 'rdev-serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 size 49152: comm "mdadm", pid 789, jiffies 4294716910...

UBUNTU-CVE-2024-26881

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices The HIP08 devices does not register the ptp devices, so the hdev-ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3RXDTSVLDB bit, so, if...

CVE-2024-26909

CVE-2024-26909 affects the Linux kernel’s soc/qcom/pmic_glink_altmode code and its DRM bridge handling. The issue is a use-after-free that can occur during probe deferral when the dp-hpd bridge is registered before all resources are acquired, creating a race where a previously registered bridge p...

CVE-2024-26900 md: fix kmemleak of rdev->serial

In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev-serial If kobjectadd is fail in bindrdevtoarray, 'rdev-serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 size 49152: comm "mdadm", pid 789, jiffies 4294716910...

CVE-2024-26897 wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9kwmieventtasklet until init is complete The ath9kwmieventtasklet used in ath9khtc assumes that all the data structures have been fully initialised by the time it runs. However, because of the order i...

CVE-2024-26890

CVE-2024-26890 affects the Linux kernel Bluetooth stack, specifically the btrtl driver when used with hci_h5. The issue arises from missing private-hci data allocation after hci_dev, causing a slab-out-of-bounds write (8 bytes) during btrtl_initialize, detectable via KASAN. The root cause is memo...

CVE-2024-26886 Bluetooth: af_bluetooth: Fix deadlock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: afbluetooth: Fix deadlock Attemting to do socklock on .recvmsg may cause a deadlock as shown bellow, so instead of using socksock this uses skreceivequeue.lock on btsockioctl to avoid the UAF: INFO: task kworker/u9:1:1...

CVE-2024-26883 bpf: Fix stackmap overflow check on 32-bit arches

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on rounduppowoftwo to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arche...