kernel

Vulnerabilities (14,255)

• CVE-2024-56665MedDec 27, 2024
  affected < 6.1.121fixed 6.1.121

  In the Linux kernel, the following vulnerability has been resolved: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog Syzbot reported [1] crash that happens for following tracing scenario: - create tracepoint perf event with attr.inherit=1, attach it to t

• CVE-2024-56664HigDec 27, 2024
  affected >= 4.20.0, < 5.10.236fixed 5.10.236

  In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditiona

• CVE-2024-56663HigDec 27, 2024
  affected >= 6.0.0, < 6.1.121fixed 6.1.121

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_L

• CVE-2024-56662HigDec 27, 2024
  affected >= 5.1.0, < 5.10.232fixed 5.10.232

  In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-o

• CVE-2024-56661MedDec 27, 2024
  affected >= 5.4.287, < 5.4.288fixed 5.4.288

  In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit, ub->ubsock->sk was NULL when attempting the atomic_dec() : atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); Fix th

• CVE-2024-56660MedDec 27, 2024
  affected >= 5.16.0, < 6.1.121fixed 6.1.121

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, prevent potential error pointer dereference The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the caller can retry. The

• CVE-2024-56659MedDec 27, 2024
  affected >= 2.6.12, < 5.4.288fixed 5.4.288

  In the Linux kernel, the following vulnerability has been resolved: net: lapb: increase LAPB_HEADER_LEN It is unclear if net/lapb code is supposed to be ready for 8021q. We can at least avoid crashes like the following : skbuff: skb_under_panic: text:ffffffff8aabe1f6 len:24 p

• CVE-2024-56658HigDec 27, 2024
  affected >= 4.4.0, < 5.10.237fixed 5.10.237

  In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dst_destroy [1] Issue is in xfrm6_net_init() and xfrm4_net_init() : They copy xfrm[46]_dst_ops_template into net->x

• CVE-2024-56657MedDec 27, 2024
  affected >= 5.13.0, < 5.15.209fixed 5.15.209

  In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Avoid WARN() for symlink errors Using WARN() for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code path is a lregiste

• CVE-2024-56656CriDec 27, 2024
  affected >= 6.8.0, < 6.12.6fixed 6.12.6

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the aggregation ID fields i

• CVE-2024-56655HigDec 27, 2024
  affected < 6.6.67fixed 6.6.67

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not defer rule destruction via call_rcu nf_tables_chain_destroy can sleep, it can't be used from call_rcu callbacks. Moreover, nf_tables_rule_release() is only safe for error unwinding

• CVE-2024-56654HigDec 27, 2024
  affected >= 6.6.0, < 6.6.67fixed 6.6.67

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is not safe since for the most part entries fetched this way shall be treate

• CVE-2024-56653HigDec 27, 2024
  affected >= 6.6.0, < 6.6.67fixed 6.6.67

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ==========================================================

• CVE-2024-56652HigDec 27, 2024
  affected >= 6.8.0, < 6.12.6fixed 6.12.6

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_sr: Remove register pool That pool implementation doesn't really work: if the krealloc happens to move the memory and return another address, the entries in the xarray become invalid, leading to use-

• CVE-2024-56651HigDec 27, 2024
  affected >= 6.0.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even in case of correct

• CVE-2024-56650HigDec 27, 2024
  affected >= 2.6.30, < 5.4.287fixed 5.4.287

  In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by ta

• CVE-2024-56649MedDec 27, 2024
  affected >= 6.4.0, < 6.6.66fixed 6.6.66

  In the Linux kernel, the following vulnerability has been resolved: net: enetc: Do not configure preemptible TCs if SIs do not support Both ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure MQPRIO. And enetc_setup_tc_mqprio() calls enetc_change_preemptible_tcs(

• CVE-2024-56648MedDec 27, 2024
  affected < 5.10.231fixed 5.10.231

  In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fill_frame_info() is relying on skb->mac_len already, extend

• CVE-2024-56647MedDec 27, 2024
  affected >= 2.6.25, < 6.1.175fixed 6.1.175

  In the Linux kernel, the following vulnerability has been resolved: net: Fix icmp host relookup triggering ip_rt_bug arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is: WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20 Modules linked in:

• CVE-2024-56646MedDec 27, 2024
  affected >= 6.9.0, < 6.12.5fixed 6.12.5

  In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid possible NULL deref in modify_prefix_route() syzbot found a NULL deref [1] in modify_prefix_route(), caused by one fib6_info without a fib6_table pointer set. This can happen for net->ipv6.fib6_nul