linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,255)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-53193 | Hig | 7.8 | >= 6.10.0, < 6.11.11 | 6.11.11 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider Some heap space is allocated for the flexible structure `struct clk_hw_onecell_data` and its flexible-array member `hws` through th | |
| CVE-2024-53192 | Hig | 7.8 | >= 6.10.0, < 6.11.11 | 6.11.11 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Flexible-array member `hws` in `struct clk_hw_onecell_data` is annotated with the `counted_by()` attribute. This means that when | |
| CVE-2024-53191 | Hig | 7.8 | >= 6.3.0, < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is | |
| CVE-2024-53190 | Med | 5.5 | >= 2.6.38, < 6.1.120 | 6.1.120 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Syzkaller reported a hung task with uevent_show() on stack trace. That specific issue was addressed by another commit [0], but ev | |
| CVE-2024-53189 | Med | 5.5 | >= 6.11.0, < 6.11.11 | 6.11.11 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan The channels array in the cfg80211_scan_request has a __counted_by attribute attached to it, which points to the n_channels variable. This att | |
| CVE-2024-53188 | Hig | 7.8 | >= 6.3.0, < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix crash when unbinding If there is an error during some initialization related to firmware, the function ath12k_dp_cc_cleanup is called to release resources. However this is released again when | |
| CVE-2024-53187 | Med | 5.5 | >= 5.1.0, < 6.11.11 | 6.11.11 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: io_uring: check for overflows in io_pin_pages WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-n | |
| CVE-2024-53186 | Cri | 9.8 | < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work( | |
| CVE-2024-53185 | Hig | 7.5 | < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix NULL ptr deref in crypto_aead_setkey() Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses | |
| CVE-2024-53184 | Med | 5.5 | >= 3.6.0, < 4.19.325 | 4.19.325 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_ | |
| CVE-2024-53183 | Med | 5.5 | >= 2.6.22, < 4.19.325 | 4.19.325 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in a crash: RIP: 0033 | |
| CVE-2024-53182 | Hig | 7.8 | >= 6.12.0, < 6.12.2 | 6.12.2 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" This reverts commit bc3b1e9e7c50e1de0f573eea3871db61dd4787de. The bic is associated with sync_bfqq, and bfq_release_process_ref ca | |
| CVE-2024-53181 | Med | 5.5 | >= 4.17.0, < 4.19.325 | 4.19.325 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the vector_device instance. Otherwise, removing a vector device will result in a crash: R | |
| CVE-2024-53180 | Med | 5.5 | >= 5.14.0, < 5.15.174 | 5.15.174 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Add sanity NULL check for the default mmap fault handler A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_pa | |
| CVE-2024-53179 | Cri | 9.8 | >= 3.12.0, < 6.6.70 | 6.6.70 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A tas | |
| CVE-2024-53178 | Hig | 7.5 | >= 6.1.0, < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: smb: Don't leak cfid when reconnect races with open_cached_dir open_cached_dir() may either race with the tcon reconnection even before compound_send_recv() or directly trigger a reconnection via SMB2_open_init | |
| CVE-2024-53177 | Cri | 9.8 | < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in | |
| CVE-2024-53176 | Cri | 9.8 | >= 6.1.0, < 6.6.64 | 6.6.64 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry The unmount process (cifs_kill_sb() calling close_all_cached_dirs()) can race with various cached directory operations, which ultimately re | |
| CVE-2024-53175 | Med | 5.5 | >= 6.1.0, < 6.1.120 | 6.1.120 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled properly since ipc sysctls and mq sysctls is not released proper | |
| CVE-2024-53174 | Hig | 7.8 | >= 4.20.0, < 5.4.287 | 5.4.287 | Dec 27, 2024 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp` will not be freed. Therefore, the reference count for `cp` can drop |
- affected >= 6.10.0, < 6.11.11fixed 6.11.11
In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix memory corruption bug in struct loongson2_clk_provider Some heap space is allocated for the flexible structure `struct clk_hw_onecell_data` and its flexible-array member `hws` through th
- affected >= 6.10.0, < 6.11.11fixed 6.11.11
In the Linux kernel, the following vulnerability has been resolved: clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access Flexible-array member `hws` in `struct clk_hw_onecell_data` is annotated with the `counted_by()` attribute. This means that when
- affected >= 6.3.0, < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix warning when unbinding If there is an error during some initialization related to firmware, the buffers dp->tx_ring[i].tx_status are released. However this is released again when the device is
- affected >= 2.6.38, < 6.1.120fixed 6.1.120
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures Syzkaller reported a hung task with uevent_show() on stack trace. That specific issue was addressed by another commit [0], but ev
- affected >= 6.11.0, < 6.11.11fixed 6.11.11
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan The channels array in the cfg80211_scan_request has a __counted_by attribute attached to it, which points to the n_channels variable. This att
- affected >= 6.3.0, < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix crash when unbinding If there is an error during some initialization related to firmware, the function ath12k_dp_cc_cleanup is called to release resources. However this is released again when
- affected >= 5.1.0, < 6.11.11fixed 6.11.11
In the Linux kernel, the following vulnerability has been resolved: io_uring: check for overflows in io_pin_pages WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-n
- affected < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in SMB request handling A race condition exists between SMB request handling in `ksmbd_conn_handler_loop()` and the freeing of `ksmbd_conn` in the workqueue handler `handle_ksmbd_work(
- affected < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix NULL ptr deref in crypto_aead_setkey() Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses
- affected >= 3.6.0, < 4.19.325fixed 4.19.325
In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash: RIP: 0033:blk_mq_
- affected >= 2.6.22, < 4.19.325fixed 4.19.325
In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in a crash: RIP: 0033
- affected >= 6.12.0, < 6.12.2fixed 6.12.2
In the Linux kernel, the following vulnerability has been resolved: Revert "block, bfq: merge bfq_release_process_ref() into bfq_put_cooperator()" This reverts commit bc3b1e9e7c50e1de0f573eea3871db61dd4787de. The bic is associated with sync_bfqq, and bfq_release_process_ref ca
- affected >= 4.17.0, < 4.19.325fixed 4.19.325
In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the vector_device instance. Otherwise, removing a vector device will result in a crash: R
- affected >= 5.14.0, < 5.15.174fixed 5.15.174
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Add sanity NULL check for the default mmap fault handler A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before passing to virt_to_pa
- affected >= 3.12.0, < 6.6.70fixed 6.6.70
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A tas
- affected >= 6.1.0, < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: smb: Don't leak cfid when reconnect races with open_cached_dir open_cached_dir() may either race with the tcon reconnection even before compound_send_recv() or directly trigger a reconnection via SMB2_open_init
- affected < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-after-free due to open_cached_dir error paths If open_cached_dir() encounters an error parsing the lease from the server, the error handling may race with receiving a lease break, resulting in
- affected >= 6.1.0, < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry The unmount process (cifs_kill_sb() calling close_all_cached_dirs()) can race with various cached directory operations, which ultimately re
- affected >= 6.1.0, < 6.1.120fixed 6.1.120
In the Linux kernel, the following vulnerability has been resolved: ipc: fix memleak if msg_init_ns failed in create_ipc_ns Percpu memory allocation may failed during create_ipc_ns however this fail is not handled properly since ipc sysctls and mq sysctls is not released proper
- affected >= 4.20.0, < 5.4.287fixed 5.4.287
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp` will not be freed. Therefore, the reference count for `cp` can drop
Page 548 of 713