kernel

Vulnerabilities (14,254)

• CVE-2024-49952HigOct 21, 2024
  affected >= 4.3.0, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling preemption as hinted b

• CVE-2024-49951HigOct 21, 2024
  affected >= 6.0.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace: 0x0000053D: __list_del_entr

• CVE-2024-49950HigOct 21, 2024
  affected >= 3.8.0, < 5.15.174fixed 5.15.174

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by

• CVE-2024-49949MedOct 21, 2024
  affected < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect mal

• CVE-2024-49948MedOct 21, 2024
  affected >= 3.9.0, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_GSO_DODGY, assuming skb->len is bigger than hdr_len. virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure

• CVE-2024-49947MedOct 21, 2024
  affected < 6.6.55fixed 6.6.55

  In the Linux kernel, the following vulnerability has been resolved: net: test for not too small csum_start in virtio_net_hdr_to_skb() syzbot was able to trigger this warning [1], after injecting a malicious packet through af_packet, setting skb->csum_start and thus the transpor

• CVE-2024-49946MedOct 21, 2024
  affected >= 5.11.0, < 5.15.168fixed 5.15.168

  In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in ppp_channel_bridge_input() Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in th

• CVE-2024-49945MedOct 21, 2024
  affected >= 4.8.0, < 6.10.14fixed 6.10.14

  In the Linux kernel, the following vulnerability has been resolved: net/ncsi: Disable the ncsi work before freeing the associated structure The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic.

• CVE-2024-49944MedOct 21, 2024
  affected >= 2.6.30, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever

• CVE-2024-49943HigOct 21, 2024
  affected >= 6.11.0, < 6.11.3fixed 6.11.3

  In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc_submit: add missing locking in wedged_fini Any non-wedged queue can have a zero refcount here and can be running concurrently with an async queue destroy, therefore dereferencing the queue ptr to che

• CVE-2024-49942MedOct 21, 2024
  affected >= 6.8.0, < 6.10.14fixed 6.10.14

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Prevent null pointer access in xe_migrate_copy xe_migrate_copy designed to copy content of TTM resources. When source resource is null, it will trigger a NULL pointer dereference in xe_migrate_copy. To

• CVE-2024-49941MedOct 21, 2024
  affected >= 6.9.0, < 6.11.3fixed 6.11.3

  In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix potential NULL pointer dereference in gpiod_get_label() In `gpiod_get_label()`, it is possible that `srcu_dereference_check()` may return a NULL pointer, leading to a scenario where `label->str` is

• CVE-2024-49940HigOct 21, 2024
  affected >= 4.15.0, < 6.11.3fixed 6.11.3

  In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tun

• CVE-2024-49939HigOct 21, 2024
  affected >= 5.16.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid to add interface to list twice when SER If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_wow_resume() return

• CVE-2024-49938MedOct 21, 2024
  affected >= 2.6.35, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths.

• CVE-2024-49937MedOct 21, 2024
  affected >= 6.0.0, < 6.1.113fixed 6.1.113

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Set correct chandef when starting CAC When starting CAC in a mode other than AP mode, it return a "WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]" caused by the chan

• CVE-2024-49936HigOct 21, 2024
  affected >= 4.7.0, < 5.4.290fixed 5.4.290

  In the Linux kernel, the following vulnerability has been resolved: net/xen-netback: prevent UAF in xenvif_flush_hash() During the list_for_each_entry_rcu iteration call of xenvif_flush_hash, kfree_rcu does not exist inside the rcu read critical section, so if kfree_rcu is call

• CVE-2024-49935MedOct 21, 2024
  affected >= 2.6.32, < 5.4.296fixed 5.4.296

  In the Linux kernel, the following vulnerability has been resolved: ACPI: PAD: fix crash in exit_round_robin() The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff

• CVE-2024-49934HigOct 21, 2024
  affected >= 5.0.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name It's observed that a crash occurs during hot-remove a memory device, in which user is accessing the hugetlb. See calltrace as following: --

• CVE-2024-49933MedOct 21, 2024
  affected >= 5.10.0, < 5.10.227fixed 5.10.227

  In the Linux kernel, the following vulnerability has been resolved: blk_iocost: fix more out of bound shifts Recently running UBSAN caught few out of bound shifts in the ioc_forgive_debts() function: UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is