CVE-2024-26922

CVE-2024-26922 affects the Linux kernel DRM/AMDGPU code. The issue concerns validating the parameters of bo mapping operations for AMDGPU, specifically amdgpu_vm_bo_(map/replace_map/clearing_mappings). A single common verification point is used to verify these parameters. Impact is listed as loca...

CVE-2024-26923

CVE-2024-26923 in the Linux kernel exposes a race in the AF_UNIX garbage collector during connect() handling. An embryo enqueued during GC may be reachable via a peer with SCM_RIGHTS, causing two consecutive scan passes to observe different child sets and inflate the inflight count, which can lea...

CVE-2024-26926

CVE-2024-26926 concerns the Linux kernel Binder subsystem. The vulnerability stems from the binder_get_object() path where an explicit offset alignment check was removed during a series of commits that altered how binder objects are copied. The checks performed via binder_alloc_copy_from_buffer()...

CVE-2024-26643

The CVE-2024-26643 entry concerns the Linux kernel netfilter nf_tables: a race that could allow the rhashtable set GC to collect elements from anonymous sets with timeouts during release from the commit path. The issue is tied to anonymous sets with timeouts and is mitigated by setting the dead f...

CVE-2023-52494

CVE-2023-52494 concerns the Linux kernel bus: mhi driver. The vulnerability arises from an unaligned event ring read pointer reading 128-bit elements (struct mhi_ring_element). Although the code validates the pointer is within the buffer, an unaligned pointer could lead to DoS or ring-buffer memo...

CVE-2024-26642

Technical details about CVE-2024-26642 are not publicly available in the provided documents. No affected products, impact, or remediation details are disclosed here. Monitor for updates.

CVE-2023-52495

CVE-2023-52495 affects the Linux kernel PMIC GLINK altmode driver (qcom) and is caused by an incomplete port sanity check. The driver supports at most two ports; a notification for an unsupported port could access memory beyond the port array, risking memory corruption. The issue is addressed by ...

CVE-2024-26921

CVE-2024-26921 affects the Linux kernel inet_defrag path. The issue arises when ip_local_out() and similar calls pass skb->sk as an argument and the skb is a fragment undergoing reassembly; if reassembly happens before the call returns, the socket (skb->sk) must not be released. This can oc...

CVE-2024-26925

CVE-2024-26925 affects the Linux kernel netfilter nf_tables module. The root cause is releasing the commit mutex during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), which allows an async GC worker to collect expired objects and acquire the released commit lock within the ...

CVE-2024-27000

Summary: CVE-2024-27000 is a Linux kernel vulnerability in the serial mxs-auart driver where uart_handle_cts_change() could be invoked without holding uport->lock, risking mis-synchronization. The issue is resolved by adding a spinlock around changing the CTS state. The described scenario invo...

CVE-2024-26965

CVE-2024-26965 affects the Linux kernel clk/qcom:mmcc-msm8974. The issue stems from frequency table arrays not being terminated with an empty element, which can lead to out-of-bounds traversal by qcom_find_freq() or qcom_find_freq_floor(). The fix adds a terminating empty entry at the end of the ...

CVE-2024-26955

CVE-2024-26955 is a Linux kernel vulnerability in nilfs2. The issue arises when nilfs_get_block() can return success in a state where both searching and inserting a block fail due to a race, potentially leading to a read of an unmapped buffer and triggering a BUG_ON in submit_bh_wbc() via BH_Mapp...

CVE-2024-26951

CVE-2024-26951 (Linux kernel, WireGuard) : The bug occurs in the netlink dump when peers are removed with wg_peer_remove_all(): a cursored peer that has been removed can lead to iterating freed peers, causing a use-after-free. The fix changes the check from an empty peer_list to the dedicated is_...

CVE-2024-27075

CVE-2024-27075 targets Linux kernel media/dvb-frontends, specifically the stv0367 driver. The root cause is a stack-frame growth issue (stack frame size 3624 exceeds 2048) exposed by clang/KASAN_STACK, due to temporary i2c_msg structures on the stack in stv0367ter_set_frontend. The fix reworks st...

CVE-2024-27410

CVE-2024-27410 is a Linux kernel issue in the wifi nl80211 path. The vulnerability arises when changing the mesh ID and the interface type (iftype) in a single operation, which can cause data overwrite in the wdev->u union and lead cfg80211_change_iface() to misbehave during a switch to mesh m...

CVE-2024-27065

CVE-2024-27065 is a Linux kernel issue affecting nf_tables: the verifier could incorrectly compare internal table flags during updates. The public advisories in connected documents reference a fix that “restores skipping transaction if table update does not modify flags,” applied as part of kerne...

CVE-2023-52486

CVE-2023-52486 - Linux kernel / DRM framebuffer use-after-unref issue . The bug occurs in the DRM mode page flip path: after a deadlock and a retry, the code forgets to reset the framebuffer reference to NULL, so if an error happens again before re-acquiring the fb lookup, it may unref the same f...

CVE-2024-26992

Summary (CVE-2024-26992): The Linux kernel KVM x86/pmu feature disabled adaptive PEBS due to architecturally broken implementation and potential leakage of host addresses (LBRs) to guests. The report enumerates several contributing issues: Bug 1, improper handling of IA32_FIXED_CTR_CTRL upper bit...

CVE-2024-27389

CVE-2024-27389 affects the Linux kernel pstore code path: when unloading a modular pstore backend with records in pstorefs, dput() double‑drops trigger a warning due to a reference counting issue. The fix is to use d_invalidate() and remove checks for error codes that cannot occur, updating the i...

CVE-2024-38629

In CVE-2024-38629, the Linux kernel’s dmaengine: idxd driver had a use-after-free risk where ida_destroy(&file_ida) could run after file_ida was already destroyed during WQ cdev teardown, risking a kernel panic. The fix removes ida_destroy(&file_ida) since file_ida is allocated on cdev open and f...

CVE-2023-52497

CVE-2023-52497 is a Linux kernel vulnerability in the EROFS (Enhanced Read-Only File System) related to in-place LZ4 decompression. The issue arises because EROFS could map two buffers for in-place decompression, while LZ4 expects the compressed data to be at the end of the decompressed buffer, r...

CVE-2024-27034

CVE-2024-27034 affects the f2fs compression path in the Linux kernel. The root cause is a race where, when overwriting a compressed cluster with a normal cluster, cp_rwsem is unlocked too early during f2fs_write_raw_pages(), risking data corruption if partial blocks are persisted before CP & SPOR...

CVE-2024-27007

The CVE-2024-27007 issue affects the Linux kernel’s userfaultfd handling, specifically the UFFDIO_MOVE path. The root cause described across connected docs is a change to the src_folio (mapping/index) after clearing the page tables and ensuring it is not pinned, introduced by a commit intended to...

CVE-2024-27066

CVE-2024-27066 concerns a Linux kernel vulnerability in virtio packed handling of indirect descriptor tables. When using_dma_api and premapped are true, the code path that performs do_unmap can be skipped, preventing vring_unmap_extra_packed from being invoked during detach_buf_packed. This leave...

CVE-2024-26812

VFIO PCI: Create persistent INTx handler. The described issue allowed signaling an INTx eventfd with a NULL context via SET_IRQS or unmask irqfd even when the IRQ handler was unregistered. The connected documents state that the fix moves INTx interrupt handler configuration to track the lifetime ...

CVE-2021-46965

CVE-2021-46965 : Linux kernel mtd/physmap/physmap-bt1-rom vulnerability where casting &data to (char ) caused unintentional stack access; the fix corrects the byte offset calculation (data is u32) to prevent out-of-bounds/stacks access. Affected code and root cause are documented in the upstream ...

CVE-2024-27397

CVE-2024-27397 affects the Linux kernel nf_tables in netfilter. The root cause is a race where set elements could expire during unfinished control-plane transactions. The fix adds a timestamp field at the start of a transaction and stores it per-netns, updating the set backends’ insert, deactivat...

CVE-2024-36904

The provided connected advisories confirm CVE-2024-36904 affects the Linux kernel TCP TIME-WAIT handling. Specifically, a race window during connect() could allow refcount mismanagement in tcp_twsk_unique() if a TIME-WAIT sk is reused with zero refcnt, potentially leading to a use-after-free. The...

CVE-2024-27036

CVE-2024-27036 affects the Linux kernel CIFS writeback path. The vulnerability arises when cifs_extend_writeback() considers an extra folio but would overrun the wsize, causing the xarray scanning loop to rely on xas_pause(), which advances the counter and can skip a page. The fix is to call xas_...

CVE-2023-52656

CVE-2023-52656 is a Linux kernel issue where io_uring code related to SCM_RIGHTS was removed after dropping support for passing io_uring fds over SCM_RIGHTS. The vulnerability stems from dead code eliminated in the io_uring path, with advisories from Astra Linux and Nessus-based advisories descri...

CVE-2024-27035

In CVE-2024-27035, the Linux kernel f2fs compress path fixes a bug where a data block in a compressed cluster may not be persisted with metadata during checkpoint, risking data corruption after SPOR. The patch ensures the compressed page is written during checkpoint. Affected component: fs/f2fs/c...

CVE-2021-46974

CVE-2021-46974: In the Linux kernel BPF verifier, the masking/negation logic when the off_reg is in the dst register was incorrect, potentially producing wrong pointer arithmetic results. The fix unconditionally applies the final bitwise and into AX from off_reg, then moves src→dst and uses AX as...

CVE-2024-26654

Summary (CVE-2024-26654) : In the Linux kernel, the ALSA: sh: aica path could dereference a freed aica_channel due to a race between mod_timer/del_timer during PCM close, causing a use-after-free (UAF). Connected advisories confirm affected kernel families include Astra Linux advisories for Linux...

CVE-2021-46969

CVE-2021-46969 affects the Linux kernel bus: mhi: core. The vulnerability arises when mhi_queue incorrectly returns an error if the doorbell is not accessible in a non-M0 state (e.g., M3). The device is awakened to M0 before updating the doorbell, and treating this as an error delayed the doorbel...

CVE-2024-26656

CVE-2024-26656 affects the Linux kernel AMDGPU DRM driver. The issue is a use-after-free in the amdgpu_hmm_unregister path triggered during amdgpu_gem_userptr_ioctl when an invalid address/size is supplied, causing a bad access during amdgpu_gem_object_free. The provided traces show a fault path ...

CVE-2024-27401

CVE-2024-27401 affects the Linux kernel’s firewire nosy code path. The vulnerability arises because packet_buffer_get could read beyond the user-supplied length if the head packet length exceeded user_length, potentially allowing a user-space overflow. The fix ensures the function returns 0 when ...

CVE-2024-26870

CVE-2024-26870: Linux kernel NFSv4.2 fix guards a kernel BUG in mm/usercopy.c during listxattr handling. When listxattr size > 0 and nfs4_listxattr returns more bytes than requested (e.g., after generic_listxattr outputs system.nfs4_acl), a BUG at mm/usercopy.c:102 can trigger a kernel Oops. T...

CVE-2024-39508

CVE-2024-39508 affects the Linux kernel io-uring I/O-queue (io-wq) by a data race on io_worker->flags. The issue, exposed under KCSAN as a race between io_worker_handle_work and io_wq_activate_free_worker, arises from concurrent reads/writes to that flags field across multiple code paths. The ...

CVE-2021-47055

CVE-2021-47055 affects the Linux kernel MTD subsystem. The root cause is that MEMLOCK, MEMUNLOCK, and OTPLOCK modify protection bits and thus require write permission; MEMLOCK/MEMUNLOCK may be write-only on some hardware (e.g., SPI-NOR with WP# tied to GND) and OTPLOCK is always write-once. MEMSE...

CVE-2021-47040

CVE-2021-47040 relates to the Linux kernel io_uring subsystem. The vulnerability stems from overflow checks in provide_buffers() for io_provide_buffers_prep(), with prior attempts not addressing the overflow/sign-extension issue. It was resolved by introducing robust overflow checks via helper fu...

CVE-2023-52453

CVE-2023-52453 affects the Linux kernel; the issue is in the hisi_acc_vfio_pci code during PRE_COPY migration, where saving/resume data pointers were not updated correctly based on the fd offset. This can cause migration data corruption and, when the device boots on the destination, errors such a...

CVE-2021-47014

CVE-2021-47014 affects the Linux kernel’s net/sched code, specifically the act_ct action used during IP fragment handling. The root cause was a wild memory access that occurred when a temporarily stored IP fragment was reassembled: restoring skb->cb could overwrite FRAG_CB(), causing invalid m...

CVE-2021-47011

The CVE-2021-47011 issue affects the Linux kernel memory control slab (memcg). The root cause was that some corner allocations (e.g., SLUB allocations larger than order-1 pages and buddy-allocated pages) continued to hold a reference to the memory cgroup, allowing KMEM pages (and thus kernel stac...

CVE-2024-26610

Mode C: The CVE-2024-26610 vulnerability affects the Linux kernel’s iwlwifi component (iwl_fw_ini_trigger_tlv::data) where data is a __le32*; copying to data + offset with a byte-based offset can overflow the buffer, causing memory corruption. Connected Astra Linux advisory confirms a fix in the ...

CVE-2021-47004

CVE-2021-47004 affects Linux kernel f2fs by fixing a get_victim() GC bug in CP-disabling mode. Two issues when using LFS or SSR/AT_SSR to pick a victim: (1) GC could choose a section with checkpointed data if only current-segment checks were performed; the fix adds section-level validation so a v...

CVE-2024-26619

CVE-2024-26619 concerns the Linux kernel on riscv, where a use-after-free was introduced by the order of kfree calls during module loading. The vulnerability is resolved by reversing the free order, preventing use-after-free conditions. The available details identify the affected component as the...

CVE-2024-26611

CVE-2024-26611 : In the Linux kernel, the ZC XDP path briefly mishandles memory when bpf_xdp_adjust_tail() shrinks a packet with MEM_TYPE_XSK_BUFF_POOL, causing a NULL pointer dereference in __xdp_return() when the xdp_buff argument is NULL. The issue arises in the non-linear XDP RX path for zero...

CVE-2023-52482

CVE-2023-52482 is a Linux kernel issue where x86 SRSO mitigation was added to address speculative return stack overflow on Hygon processors. The connected Nessus entry for MiracleLinux 9 references kernel commits that implement x86 srso mitigation for Hygon and notes this CVE’s resolution, aligni...

CVE-2024-26617

CVE-2024-26617 (Linux kernel) : The vulnerability stems from fs/proc/task_mmu where the mmu notification mechanism was moved inside the mm lock, preventing a race with components that depend on the notifier to invalidate memory ranges. The patch tightens the notifier scope inside the mm lock, red...

CVE-2024-26616

CVE-2024-26616 affects the Linux kernel Btrfs file system, specifically the scrub path. The bug occurs when a converted ext4-converted Btrfs with chunk layout causes Scrub to split a bio and free resources twice, leading to a use-after-free in scrub_read_endio/scrub_submit_initial_read. The root ...