linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-50030 | Hig | 7.8 | >= 6.8.0, < 6.11.4 | 6.11.4 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in send_recv() Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can er | |
| CVE-2024-50029 | Hig | 8.8 | >= 6.1.0, < 6.6.57 | 6.6.57 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection remains valid as it could be destroyed while hci_enhanced_setup_sync is pending on cmd_sync leading to the following tra | |
| CVE-2024-50028 | Hig | 7.8 | >= 5.9.0, < 6.11.4 | 6.11.4 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Reference count the zone in thermal_zone_get_by_id() There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has | |
| CVE-2024-50027 | Hig | 7.8 | >= 6.4.0, < 6.6.60 | 6.6.60 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: thermal: core: Free tzp copy along with the thermal zone The object pointed to by tz->tzp may still be accessed after being freed in thermal_zone_device_unregister(), so move the freeing of it to the point afte | |
| CVE-2024-50026 | Med | 5.5 | >= 5.18.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: scsi: wd33c93: Don't use stale scsi_pointer value A regression was introduced with commit dbb2da557a6a ("scsi: wd33c93: Move the SCSI pointer to private command data") which results in an oops in wd33c93_intr() | |
| CVE-2024-50025 | Med | 5.5 | >= 6.8.0, < 6.11.4 | 6.11.4 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Move flush_work initialization out of if block After commit 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue"), it can happen that a work item is sent to an uninitialized work qu | |
| CVE-2024-50024 | Hig | 7.3 | >= 2.6.32, < 4.19.323 | 4.19.323 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080 | |
| CVE-2024-50023 | Med | 5.5 | >= 6.4.0, < 6.6.57 | 6.6.57 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: phy: Remove LED entry from LEDs list on unregister Commit c938ab4da0eb ("net: phy: Manual remove LEDs to ensure correct ordering") correctly fixed a problem with using devm_ but missed removing the LED ent | |
| CVE-2024-50022 | Med | 5.5 | >= 5.17.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that | |
| CVE-2024-50021 | Med | 5.5 | >= 6.7.0, < 6.11.4 | 6.11.4 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins() This patch addresses a reference count handling issue in the ice_dpll_init_rclk_pins() function. The function calls ice_dpll_get_pins(), which | |
| CVE-2024-50020 | Med | 5.5 | >= 6.7.0, < 6.11.4 | 6.11.4 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count() This patch addresses an issue with improper reference count handling in the ice_sriov_set_msix_vec_count() function. First, the function | |
| CVE-2024-50019 | Med | 5.5 | >= 5.11.0, < 5.15.168 | 5.15.168 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: kthread: unpark only parked kthread Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASK_P | |
| CVE-2022-49033 | Med | 5.5 | >= 4.1.0, < 4.9.335 | 4.9.335 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call | |
| CVE-2022-49032 | Hig | 7.1 | >= 4.8.0, < 4.9.335 | 4.9.335 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e46 | |
| CVE-2022-49031 | Hig | 7.1 | >= 4.8.0, < 4.9.335 | 4.9.335 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4403: Fix oob read in afe4403_read_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by ta | |
| CVE-2022-49030 | Hig | 7.8 | >= 5.8.0, < 5.10.158 | 5.10.158 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_ | |
| CVE-2022-49029 | Hig | 7.8 | >= 2.6.24, < 4.9.335 | 4.9.335 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_ | |
| CVE-2022-49028 | Med | 5.5 | >= 4.5.0, < 5.10.158 | 5.10.158 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy_workqueue() in fai | |
| CVE-2022-49027 | Med | 5.5 | >= 4.6.0, < 5.10.158 | 5.10.158 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resourc | |
| CVE-2022-49026 | Hig | 7.8 | >= 4.3.0, < 5.10.158 | 5.10.158 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the s |
- affected >= 6.8.0, < 6.11.4fixed 6.11.4
In the Linux kernel, the following vulnerability has been resolved: drm/xe/ct: prevent UAF in send_recv() Ensure we serialize with completion side to prevent UAF with fence going out of scope on the stack, since we have no clue if it will fire after the timeout before we can er
- affected >= 6.1.0, < 6.6.57fixed 6.6.57
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync This checks if the ACL connection remains valid as it could be destroyed while hci_enhanced_setup_sync is pending on cmd_sync leading to the following tra
- affected >= 5.9.0, < 6.11.4fixed 6.11.4
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Reference count the zone in thermal_zone_get_by_id() There are places in the thermal netlink code where nothing prevents the thermal zone object from going away while being accessed after it has
- affected >= 6.4.0, < 6.6.60fixed 6.6.60
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Free tzp copy along with the thermal zone The object pointed to by tz->tzp may still be accessed after being freed in thermal_zone_device_unregister(), so move the freeing of it to the point afte
- affected >= 5.18.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: scsi: wd33c93: Don't use stale scsi_pointer value A regression was introduced with commit dbb2da557a6a ("scsi: wd33c93: Move the SCSI pointer to private command data") which results in an oops in wd33c93_intr()
- affected >= 6.8.0, < 6.11.4fixed 6.11.4
In the Linux kernel, the following vulnerability has been resolved: scsi: fnic: Move flush_work initialization out of if block After commit 379a58caa199 ("scsi: fnic: Move fnic_fnic_flush_tx() to a work queue"), it can happen that a work item is sent to an uninitialized work qu
- affected >= 2.6.32, < 4.19.323fixed 4.19.323
In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080
- affected >= 6.4.0, < 6.6.57fixed 6.6.57
In the Linux kernel, the following vulnerability has been resolved: net: phy: Remove LED entry from LEDs list on unregister Commit c938ab4da0eb ("net: phy: Manual remove LEDs to ensure correct ordering") correctly fixed a problem with using devm_ but missed removing the LED ent
- affected >= 5.17.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that
- affected >= 6.7.0, < 6.11.4fixed 6.11.4
In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_dpll_init_rclk_pins() This patch addresses a reference count handling issue in the ice_dpll_init_rclk_pins() function. The function calls ice_dpll_get_pins(), which
- affected >= 6.7.0, < 6.11.4fixed 6.11.4
In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper handling of refcount in ice_sriov_set_msix_vec_count() This patch addresses an issue with improper reference count handling in the ice_sriov_set_msix_vec_count() function. First, the function
- affected >= 5.11.0, < 5.15.168fixed 5.15.168
In the Linux kernel, the following vulnerability has been resolved: kthread: unpark only parked kthread Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASK_P
- affected >= 4.1.0, < 4.9.335fixed 4.9.335
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() Syzkaller reported BUG as follows: BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 Call
- affected >= 4.8.0, < 4.9.335fixed 4.9.335
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e46
- affected >= 4.8.0, < 4.9.335fixed 4.9.335
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4403: Fix oob read in afe4403_read_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by ta
- affected >= 5.8.0, < 5.10.158fixed 5.10.158
In the Linux kernel, the following vulnerability has been resolved: libbpf: Handle size overflow for ringbuf mmap The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_
- affected >= 2.6.24, < 4.9.335fixed 4.9.335
In the Linux kernel, the following vulnerability has been resolved: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails Smatch report warning as follows: drivers/hwmon/ibmpex.c:509 ibmpex_register_bmc() warn: '&data->list' not removed from list If ibmpex_find_
- affected >= 4.5.0, < 5.10.158fixed 5.10.158
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy_workqueue() in fai
- affected >= 4.6.0, < 5.10.158fixed 5.10.158
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix error handling in iavf_init_module() The iavf_init_module() won't destroy workqueue when pci_register_driver() failed. Call destroy_workqueue() when pci_register_driver() failed to prevent the resourc
- affected >= 4.3.0, < 5.10.158fixed 5.10.158
In the Linux kernel, the following vulnerability has been resolved: e100: Fix possible use after free in e100_xmit_prepare In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will resend the s
Page 569 of 713