CVE-2024-26723 lan966x: Fix crash when adding interface under a lag

In the Linux kernel, the following vulnerability has been resolved: lan966x: Fix crash when adding interface under a lag There is a crash when adding one of the lan966x interfaces under a lag interface. The issue can be reproduced like this: ip link add name bond0 type bond miimon 100 mode...

CVE-2024-26718

CVE-2024-26718 affects the Linux kernel’s dm-crypt and dm-verity components. The issue arises from a memory‑corruption scenario in tasklets: tasklet_action_common calls tasklet_trylock, then the tasklet callback, then tasklet_unlock; if the callback frees the tasklet’s containing structure (or fr...

CVE-2024-26706 parisc: Fix random data corruption from exception handler

In the Linux kernel, the following vulnerability has been resolved: parisc: Fix random data corruption from exception handler The current exception handler implementation, which assists when accessing user space memory, may exhibit random data corruption if the compiler decides to use a different...

CVE-2024-26704

CVE-2024-26704 affects the Linux kernel ext4 filesystem. The issue was a double-free of blocks in ext4_move_extents: moved_len was only updated when all moves succeeded, causing potential overlap with preallocated extents to be freed twice and triggering a zero-division in mb_update_avg_fragment_...

CVE-2024-26704 ext4: fix double-free of blocks due to wrong extents moved_len

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents movedlen In ext4moveextents, movedlen is only updated when all moves are successfully executed, and only discards originode and donorinode preallocations when movedlen is not...

CVE-2024-26699

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix array-index-out-of-bounds in dcn35clkmgr Why There is a potential memory access violation while iterating through array of dcn35 clks. How Limit iteration per array size...

CVE-2024-26697 nilfs2: fix data corruption in dsync block recovery for small block sizes

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfsrecoverycopyblock of nilfsrecoverydsyncblocks, which recovers data from logs created by data sync writes during a mount after an...

CVE-2024-26697

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfsrecoverycopyblock of nilfsrecoverydsyncblocks, which recovers data from logs created by data sync writes during a mount after an...

CVE-2024-26662

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panelcntl' could be null in 'dcn21setbacklightlevel' 'panelcntl' structure used to control the display panel could be null, dereferencing it could lead to a null pointer access. Fixes the below:...

CVE-2024-26680 net: atlantic: Fix DMA mapping for PTP hwts ring

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aqringhwtsrxalloc maps extra AQCFGRXDSDEF bytes for PTP HWTS ring but then generic aqringfree does not take this into account. Create and use a specific function to free...

CVE-2024-26677

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of delayed ACKs to not set the reference serial number as they can't be used as an RTT reference...

CVE-2024-26676

CVE-2024-26676 concerns the Linux kernel’s af_unix garbage collection. The issue arose when a socketpair self-send creates a self-referential GC candidate cycle that is not untangled due to missing MSG_OOB handling, causing a memory leak. The root cause was exposed after removing io_uring GC dead...

CVE-2024-26672 drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix variable 'mcafuncs' dereferenced before NULL check in 'amdgpumcasmugetmcaentry' Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpumca.c:377 amdgpumcasmugetmcaentry warn: variable dereferenced before check 'mcafunc...

CVE-2024-26669 net/sched: flower: Fix chain template offload

In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the 'FLOWBLOCKUNBIND'...

CVE-2024-26667 drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for valid hwpp in dpuencoderhelperphyscleanup The commit 8b45a26f2ba9 "drm/msm/dpu: reserve cdm blocks for writeback in case of YUV output" introduced a smatch warning about another conditional block in...

CVE-2023-52631

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfsloadattrlist. The "size" comes from le32tocpuattr-res.datasize so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can...

CVE-2024-26657 drm/sched: fix null-ptr-deref in init entity

In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgpucswaitioctl to the AMDGPU DRM driver on any ASICs with valid context. The bug was reported by Joonkyo Jung . For example the following code...

CVE-2024-26662

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panelcntl' could be null in 'dcn21setbacklightlevel' 'panelcntl' structure used to control the display panel could be null, dereferencing it could lead to a null pointer access. Fixes the below:...

Important: expat

Issue Overview: libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate. CVE-2024-28757 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.4.20240401 to update your system...

CVE-2024-26653 usb: misc: ljca: Fix double free in error handling path

In the Linux kernel, the following vulnerability has been resolved: usb: misc: ljca: Fix double free in error handling path When auxiliarydeviceadd returns error and then calls auxiliarydeviceuninit, callback function ljcaauxdevrelease calls kfreeauxdev-dev.platformdata to free the parameter data...