kernel

Vulnerabilities (14,254)

• CVE-2024-50154CriNov 7, 2024
  affected >= 4.2.0, < 5.4.293fixed 5.4.293

  In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tc

• CVE-2024-50153MedNov 7, 2024
  affected < 5.10.229fixed 5.10.229

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in target_alloc_device() There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod] ... kasan_rep

• CVE-2024-50152CriNov 7, 2024
  affected < 6.6.59fixed 6.6.59

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix possible double free in smb2_set_ea() Clang static checker(scan-build) warning： fs/smb/client/smb2ops.c:1304:2: Attempt to free released memory. 1304 | kfree(ea); | ^~~~~

• CVE-2024-50151HigNov 7, 2024
  affected >= 5.0.0, < 5.4.285fixed 5.4.285

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, either enforced by the server or when using 'seal' mount option, the client will squash all compound request buffers down for encryp

• CVE-2024-50150HigNov 7, 2024
  affected >= 4.19.0, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to its parent device, but without keeping a reference to it. When registering the altmode, get a reference to the parent an

• CVE-2024-50149MedNov 7, 2024
  affected >= 6.10.0, < 6.11.6fixed 6.11.6

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't free job in TDR Freeing job in TDR is not safe as TDR can pass the run_job thread resulting in UAF. It is only safe for free job to naturally be called by the scheduler. Rather free job in TDR, ad

• CVE-2024-50148MedNov 7, 2024
  affected >= 2.6.12, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as follows: KASAN: maybe wild-memory-access in range [0xdead...108-0xdead...10f] CPU: 3 UID: 0 PID: 2805 Comm: rmmod Tainted: G

• CVE-2024-50147MedNov 7, 2024
  affected >= 6.1.0, < 6.1.115fixed 6.1.115

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command bitmask initialization Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit isn't Initialize during command bitmask Initialization, only during MANAGE_PAGES. In additio

• CVE-2024-50146MedNov 7, 2024
  affected >= 5.12.0, < 6.1.123fixed 6.1.123

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't call cleanup on profile rollback failure When profile rollback fails in mlx5e_netdev_change_profile, the netdev profile var is left set to NULL. Avoid a crash when unloading the driver by not c

• CVE-2024-50145HigNov 7, 2024
  affected >= 5.19.0, < 6.1.115fixed 6.1.115

  In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() build_skb() returns NULL in case of a memory allocation failure so handle it inside __octep_oq_process_rx() to avoid NULL pointer deref

• CVE-2024-50144MedNov 7, 2024
  affected >= 6.11.0, < 6.11.6fixed 6.11.6

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put() with fence_fini() Currently we can call fence_fini() twice if something goes wrong when sending the GuC CT for the tlb request, since we signal the fence and return an error, le

• CVE-2024-50143HigNov 7, 2024
  affected >= 2.6.12, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch repro

• CVE-2024-50142MedNov 7, 2024
  affected >= 2.6.12, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot c

• CVE-2024-50141HigNov 7, 2024
  affected >= 5.14.0, < 5.15.171fixed 5.15.171

  In the Linux kernel, the following vulnerability has been resolved: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context PRMT needs to find the correct type of block to translate the PA-VA mapping for EFI runtime services. The issue arises because the PRMT is f

• CVE-2024-50140MedNov 7, 2024
  affected >= 6.4.0, < 6.6.59fixed 6.6.59

  In the Linux kernel, the following vulnerability has been resolved: sched/core: Disable page allocation in task_tick_mm_cid() With KASAN and PREEMPT_RT enabled, calling task_work_add() in task_tick_mm_cid() may cause the following splat. [ 63.696416] BUG: sleeping function c

• CVE-2024-50139HigNov 7, 2024
  affected >= 6.3.0, < 6.6.59fixed 6.6.59

  In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift expon

• CVE-2024-50138MedNov 5, 2024
  affected >= 5.8.0, < 6.1.115fixed 6.1.115

  In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT

• CVE-2024-50137MedNov 5, 2024
  affected >= 6.4.0, < 6.6.86fixed 6.6.86

  In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") was added. Add the

• CVE-2024-50136MedNov 5, 2024
  affected < 6.1.115fixed 6.1.115

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a subsequent attempt at eswitch enabling might trigger warnings of the sort: [ 682.589148] ------------[ cut here ]---

• CVE-2024-50135MedNov 5, 2024
  affected >= 4.6.0, < 6.6.59fixed 6.6.59

  In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix race condition between reset and nvme_dev_disable() nvme_dev_disable() modifies the dev->online_queues field, therefore nvme_pci_update_nr_queues() should avoid racing against it, otherwise we cou