linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-44970 | Cri | 9.8 | >= 5.16.0, < 6.1.105 | 6.1.105 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs | |
| CVE-2024-44969 | Med | 5.5 | >= 4.17.0, < 4.19.320 | 4.19.320 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due to a hardware or fir | |
| CVE-2024-44968 | Med | 5.5 | >= 6.1.103, < 6.1.105 | 6.1.105 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went un | |
| CVE-2024-44967 | Hig | 7.8 | >= 6.0.0, < 6.1.105 | 6.1.105 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so thi | |
| CVE-2024-44966 | Hig | 7.8 | >= 5.13.0, < 5.15.165 | 5.15.165 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which does not allocate an | |
| CVE-2024-44965 | Med | 5.5 | >= 4.19.0, < 4.19.320 | 4.19.320 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack g | |
| CVE-2024-44964 | Hig | 7.8 | >= 6.7.0, < 6.10.5 | 6.10.5 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring q_vector->vport pointers after reinitializating the structures. This is due to | |
| CVE-2024-44963 | Med | 5.5 | >= 4.11.0, < 6.6.64 | 6.6.64 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at btrfs_free_tree_block(), if we fail to create a delayed reference we don't deal with the error and just do a BUG_ON(). Th | |
| CVE-2024-44962 | Med | 5.5 | >= 6.4.0, < 6.6.46 | 6.6.46 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it lea | |
| CVE-2024-44961 | Med | 5.5 | >= 6.5.0, < 6.6.46 | 6.6.46 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft recovery should be forwarded to userspace, or we can get into a really bad state where apps will keep submitting hanging com | |
| CVE-2024-44960 | Med | 5.5 | < 4.19.320 | 4.19.320 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set | |
| CVE-2024-44959 | Hig | 7.8 | < 6.6.46 | 6.6.46 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: tracefs: Use generic inode RCU for synchronizing freeing With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_l | |
| CVE-2024-44958 | Med | 5.5 | >= 4.20.0, < 5.15.165 | 5.15.165 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_de | |
| CVE-2024-44957 | Med | 5.5 | >= 6.6.0, < 6.6.46 | 6.6.46 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Switch from mutex to spinlock for irqfds irqfd_wakeup() gets EPOLLHUP, when it is called by eventfd_release() by way of wake_up_poll(&ctx->wqh, EPOLLHUP), which gets called under spin_lock_irqsave | |
| CVE-2024-44956 | Med | 5.5 | >= 6.8.0, < 6.10.5 | 6.10.5 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/preempt_fence: enlarge the fence critical section It is really easy to introduce subtle deadlocks in preempt_fence_work_func() since we operate on single global ordered-wq for signalling our preempt fenc | |
| CVE-2024-44954 | Hig | 7.8 | >= 2.6.30, < 4.19.320 | 4.19.320 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by s | |
| CVE-2024-44953 | Med | 5.5 | >= 6.8.0, < 6.10.5 | 6.10.5 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix deadlock during RTC update There is a deadlock when runtime suspend waits for the flush of RTC work, and the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resume. Here is deadlo | |
| CVE-2024-44951 | Hig | 7.8 | >= 6.8.0, < 6.10.5 | 6.10.5 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the | |
| CVE-2024-44950 | Hig | 7.1 | >= 3.16.0, < 6.1.120 | 6.1.120 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to | |
| CVE-2024-44949 | Hig | 7.8 | >= 4.4.0, < 6.1.119 | 6.1.119 | Sep 4, 2024 | In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is writt |
- affected >= 5.16.0, < 6.1.105fixed 6.1.105
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs
- affected >= 4.17.0, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due to a hardware or fir
- affected >= 6.1.103, < 6.1.105fixed 6.1.105
In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Move per CPU pointer access into the atomic section The recent fix for making the take over of the broadcast timer more reliable retrieves a per CPU pointer in preemptible context. This went un
- affected >= 6.0.0, < 6.1.105fixed 6.1.105
In the Linux kernel, the following vulnerability has been resolved: drm/mgag200: Bind I2C lifetime to DRM device Managed cleanup with devm_add_action_or_reset() will release the I2C adapter when the underlying Linux device goes away. But the connector still refers to it, so thi
- affected >= 5.13.0, < 5.15.165fixed 5.15.165
In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which does not allocate an
- affected >= 4.19.0, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #DF from the stack g
- affected >= 6.7.0, < 6.10.5fixed 6.10.5
In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring q_vector->vport pointers after reinitializating the structures. This is due to
- affected >= 4.11.0, < 6.6.64fixed 6.6.64
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not BUG_ON() when freeing tree block after error When freeing a tree block, at btrfs_free_tree_block(), if we fail to create a delayed reference we don't deal with the error and just do a BUG_ON(). Th
- affected >= 6.4.0, < 6.6.46fixed 6.6.46
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading When unload the btnxpuart driver, its associated timer will be deleted. If the timer happens to be modified at this moment, it lea
- affected >= 6.5.0, < 6.6.46fixed 6.6.46
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Forward soft recovery errors to userspace As we discussed before[1], soft recovery should be forwarded to userspace, or we can get into a really bad state where apps will keep submitting hanging com
- affected < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget doesn't properly set
- affected < 6.6.46fixed 6.6.46
In the Linux kernel, the following vulnerability has been resolved: tracefs: Use generic inode RCU for synchronizing freeing With structure layout randomization enabled for 'struct inode' we need to avoid overlapping any of the RCU-used / initialized-only-once members, e.g. i_l
- affected >= 4.20.0, < 5.15.165fixed 5.15.165
In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 static_key_slow_try_de
- affected >= 6.6.0, < 6.6.46fixed 6.6.46
In the Linux kernel, the following vulnerability has been resolved: xen: privcmd: Switch from mutex to spinlock for irqfds irqfd_wakeup() gets EPOLLHUP, when it is called by eventfd_release() by way of wake_up_poll(&ctx->wqh, EPOLLHUP), which gets called under spin_lock_irqsave
- affected >= 6.8.0, < 6.10.5fixed 6.10.5
In the Linux kernel, the following vulnerability has been resolved: drm/xe/preempt_fence: enlarge the fence critical section It is really easy to introduce subtle deadlocks in preempt_fence_work_func() since we operate on single global ordered-wq for signalling our preempt fenc
- affected >= 2.6.30, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by s
- affected >= 6.8.0, < 6.10.5fixed 6.10.5
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix deadlock during RTC update There is a deadlock when runtime suspend waits for the flush of RTC work, and the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resume. Here is deadlo
- affected >= 6.8.0, < 6.10.5fixed 6.10.5
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix TX fifo corruption Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the
- affected >= 3.16.0, < 6.1.120fixed 6.1.120
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to
- affected >= 4.4.0, < 6.1.119fixed 6.1.119
In the Linux kernel, the following vulnerability has been resolved: parisc: fix a possible DMA corruption ARCH_DMA_MINALIGN was defined as 16 - this is too small - it may be possible that two unrelated 16-byte allocations share a cache line. If one of these allocations is writt
Page 593 of 706