linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-49872 | Med | 4.7 | >= 6.11.0, < 6.11.3 | 6.11.3 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfd_pin_folios alloc race panic If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfd_alloc_folio(memfd, | |
| CVE-2024-49871 | Med | 5.5 | >= 5.11.0, < 5.15.168 | 5.15.168 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: Input: adp5589-keys - fix NULL pointer dereference We register a devm action to call adp5589_clear_config() and then pass the i2c client as argument so that we can call i2c_get_clientdata() in order to get our | |
| CVE-2024-49870 | Med | 5.5 | >= 5.17.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix dentry leak in cachefiles_open_file() A dentry leak may be caused when a lookup cookie and a cull are concurrent: P1 | P2 ----------------------------------- | |
| CVE-2024-49869 | Hig | 7.8 | >= 6.11.0, < 6.11.3 | 6.11.3 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 ("btrfs: send: annotate struct name_cache_entry with __counted_by()") we annotated the variable leng | |
| CVE-2024-49868 | Med | 5.5 | >= 2.6.35, < 5.4.285 | 5.4.285 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion [BUG] Syzbot reported a NULL pointer dereference with the following crash: FAULT_INJECTION: forcing a failure. start_transactio | |
| CVE-2024-49867 | Hig | 7.8 | < 5.4.285 | 5.4.285 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at close_ctree(), we have the following steps in this order: 1) Park the cleaner kthread - this doesn't destroy the k | |
| CVE-2024-49866 | Hig | 7.8 | >= 5.14.0, < 5.15.168 | 5.15.168 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally: ``` ODEBUG: init active (active s | |
| CVE-2024-49865 | Hig | 7.8 | >= 6.8.0, < 6.11.3 | 6.11.3 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xa_alloc to prevent UAF Evil user can guess the next id of the vm before the ioctl completes and then call vm destroy ioctl to trigger UAF since create ioctl is still referencing the same vm. Mo | |
| CVE-2024-49864 | Hig | 7.5 | >= 6.2.0, < 6.6.55 | 6.6.55 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap b | |
| CVE-2024-49863 | Med | 5.5 | >= 4.20.0, < 5.10.227 | 5.10.227 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when gu | |
| CVE-2024-49862 | Hig | 7.1 | >= 6.5.0, < 6.6.54 | 6.6.54 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix off by one in get_rpi() The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one acce | |
| CVE-2024-49861 | Hig | 7.8 | >= 5.2.0, < 6.1.120 | 6.1.120 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through sp | |
| CVE-2024-49860 | Hig | 7.3 | >= 3.7.0, < 4.19.323 | 4.19.323 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory. | |
| CVE-2024-49859 | Hig | 7.8 | >= 3.8.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to check atomic_file in f2fs ioctl interfaces Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which ma | |
| CVE-2024-49858 | Med | 5.5 | >= 4.16.0, < 5.10.227 | 5.10.227 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and p | |
| CVE-2024-49857 | Hig | 7.1 | >= 6.11.0, < 6.11.2 | 6.11.2 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: set the cipher for secured NDP ranging The cipher pointer is not set, but is derefereced trying to set its content, which leads to a NULL pointer dereference. Fix it by pointing to the ciphe | |
| CVE-2024-49856 | Med | 5.5 | >= 5.13.0, < 5.15.168 | 5.15.168 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks | |
| CVE-2024-49855 | Cri | 9.8 | >= 5.19.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free | |
| CVE-2024-49853 | Hig | 7.8 | >= 5.18.0, < 6.1.113 | 6.1.113 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack. | |
| CVE-2024-49852 | Hig | 7.8 | >= 5.14.0, < 5.15.168 | 5.15.168 | Oct 21, 2024 | In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free() |
- affected >= 6.11.0, < 6.11.3fixed 6.11.3
In the Linux kernel, the following vulnerability has been resolved: mm/gup: fix memfd_pin_folios alloc race panic If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here: folio = memfd_alloc_folio(memfd,
- affected >= 5.11.0, < 5.15.168fixed 5.15.168
In the Linux kernel, the following vulnerability has been resolved: Input: adp5589-keys - fix NULL pointer dereference We register a devm action to call adp5589_clear_config() and then pass the i2c client as argument so that we can call i2c_get_clientdata() in order to get our
- affected >= 5.17.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix dentry leak in cachefiles_open_file() A dentry leak may be caused when a lookup cookie and a cull are concurrent: P1 | P2 -----------------------------------
- affected >= 6.11.0, < 6.11.3fixed 6.11.3
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: fix buffer overflow detection when copying path to cache entry Starting with commit c0247d289e73 ("btrfs: send: annotate struct name_cache_entry with __counted_by()") we annotated the variable leng
- affected >= 2.6.35, < 5.4.285fixed 5.4.285
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion [BUG] Syzbot reported a NULL pointer dereference with the following crash: FAULT_INJECTION: forcing a failure. start_transactio
- affected < 5.4.285fixed 5.4.285
In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount During unmount, at close_ctree(), we have the following steps in this order: 1) Park the cleaner kthread - this doesn't destroy the k
- affected >= 5.14.0, < 5.15.168fixed 5.15.168
In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally: ``` ODEBUG: init active (active s
- affected >= 6.8.0, < 6.11.3fixed 6.11.3
In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xa_alloc to prevent UAF Evil user can guess the next id of the vm before the ioctl completes and then call vm destroy ioctl to trigger UAF since create ioctl is still referencing the same vm. Mo
- affected >= 6.2.0, < 6.6.55fixed 6.6.55
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap b
- affected >= 4.20.0, < 5.10.227fixed 5.10.227
In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when gu
- affected >= 6.5.0, < 6.6.54fixed 6.6.54
In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix off by one in get_rpi() The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one acce
- affected >= 5.2.0, < 6.1.120fixed 6.1.120
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through sp
- affected >= 3.7.0, < 4.19.323fixed 4.19.323
In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory.
- affected >= 3.8.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to check atomic_file in f2fs ioctl interfaces Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which ma
- affected >= 4.16.0, < 5.10.227fixed 5.10.227
In the Linux kernel, the following vulnerability has been resolved: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and p
- affected >= 6.11.0, < 6.11.2fixed 6.11.2
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: set the cipher for secured NDP ranging The cipher pointer is not set, but is derefereced trying to set its content, which leads to a NULL pointer dereference. Fix it by pointing to the ciphe
- affected >= 5.13.0, < 5.15.168fixed 5.15.168
In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks
- affected >= 5.19.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free
- affected >= 5.18.0, < 6.1.113fixed 6.1.113
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack.
- affected >= 5.14.0, < 5.15.168fixed 5.15.168
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free()
Page 581 of 713