linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,119)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-42272 | Hig | 7.8 | < 5.10.224 | 5.10.224 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not | |
| CVE-2024-42271 | Hig | 7.8 | >= 3.4.0, < 4.19.320 | 4.19.320 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path | |
| CVE-2024-42270 | Med | 5.5 | >= 5.15.0, < 5.15.165 | 5.15.165 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. [0] The problem is that iptable_nat_table_init() is e | |
| CVE-2024-42269 | Med | 5.5 | >= 5.15.0, < 5.15.165 | 5.15.165 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user space before the en | |
| CVE-2024-42268 | Med | 5.5 | >= 6.0.0, < 6.1.104 | 6.1.104 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlink_remote_ | |
| CVE-2024-42267 | Med | 5.5 | >= 4.15.0, < 5.10.224 | 5.10.224 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel. | |
| CVE-2024-42266 | Hig | 7.8 | >= 6.10.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically, | |
| CVE-2024-42265 | Med | 5.5 | >= 3.7.0, < 4.19.320 | 4.19.320 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being spec | |
| CVE-2024-42264 | Hig | 7.8 | >= 6.8.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage wher | |
| CVE-2024-42263 | Med | 5.5 | >= 6.8.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_s | |
| CVE-2024-42262 | Med | 5.5 | >= 6.8.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the performance extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm | |
| CVE-2024-42261 | Med | 5.5 | >= 6.8.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the timestamp extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix | |
| CVE-2024-42260 | Med | 5.5 | >= 6.8.0, < 6.10.4 | 6.10.4 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the performance extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fi | |
| CVE-2023-52889 | Med | 5.5 | >= 4.20.0, < 5.4.282 | 5.4.282 | Aug 17, 2024 | In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is | |
| CVE-2024-42259 | Hig | 7.8 | >= 4.9.0, < 4.19.320 | 4.19.320 | Aug 14, 2024 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping o | |
| CVE-2024-42258 | Hig | 7.1 | < 6.1.105 | 6.1.105 | Aug 12, 2024 | In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x | |
| CVE-2024-42257 | Hig | 7.8 | >= 6.10.0, < 6.10.1 | 6.10.1 | Aug 8, 2024 | In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring a | |
| CVE-2024-42256 | Hig | 7.5 | >= 6.10.0, < 6.10.1 | 6.10.1 | Aug 8, 2024 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifs_prepare_write() which will make cifs repick the server for the op before renegotiating credits; | |
| CVE-2024-42255 | Med | 5.5 | >= 6.10.0, < 6.10.1 | 6.10.1 | Aug 8, 2024 | In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth after NULL check in tpm_buf_check_hmac_response(). Otherwise, unless tpm2_sessions_init() was called, a call can cause NULL | |
| CVE-2024-42254 | Med | 5.5 | >= 6.10.0, < 6.10.1 | 6.10.1 | Aug 8, 2024 | In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x00000000000 |
- affected < 5.10.224fixed 5.10.224
In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not
- affected >= 3.4.0, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path
- affected >= 5.15.0, < 5.15.165fixed 5.15.165
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. [0] The problem is that iptable_nat_table_init() is e
- affected >= 5.15.0, < 5.15.165fixed 5.15.165
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user space before the en
- affected >= 6.0.0, < 6.1.104fixed 6.1.104
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix missing lock on sync reset reload On sync reset reload work, when remote host updates devlink on reload actions performed on that host, it misses taking devlink lock before calling devlink_remote_
- affected >= 4.15.0, < 5.10.224fixed 5.10.224
In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel.
- affected >= 6.10.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: btrfs: make cow_file_range_inline() honor locked_page on error The btrfs buffered write path runs through __extent_writepage() which has some tricky return value handling for writepage_delalloc(). Specifically,
- affected >= 3.7.0, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being spec
- affected >= 6.8.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage wher
- affected >= 6.8.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the timestamp extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm_s
- affected >= 6.8.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix potential memory leak in the performance extension If fetching of userspace memory fails during the main loop, all drm sync objs looked up until that point will be leaked because of the missing drm
- affected >= 6.8.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the timestamp extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fix
- affected >= 6.8.0, < 6.10.4fixed 6.10.4
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Validate passed in drm syncobj handles in the performance extension If userspace provides an unknown or invalid handle anywhere in the handle array the rest of the driver will not handle that well. Fi
- affected >= 4.20.0, < 5.4.282fixed 5.4.282
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK_CTX(sk)->label is
- affected >= 4.9.0, < 4.19.320fixed 4.19.320
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping o
- affected < 6.1.105fixed 6.1.105
In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 32 bit") didn't work for x
- affected >= 6.10.0, < 6.10.1fixed 6.10.1
In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostr_pad() for s_volume_name As with the other strings in struct ext4_super_block, s_volume_name is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 ("ext4: add nonstring a
- affected >= 6.10.0, < 6.10.1fixed 6.10.1
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server re-repick on subrequest retry When a subrequest is marked for needing retry, netfs will call cifs_prepare_write() which will make cifs repick the server for the op before renegotiating credits;
- affected >= 6.10.0, < 6.10.1fixed 6.10.1
In the Linux kernel, the following vulnerability has been resolved: tpm: Use auth only after NULL check in tpm_buf_check_hmac_response() Dereference auth after NULL check in tpm_buf_check_hmac_response(). Otherwise, unless tpm2_sessions_init() was called, a call can cause NULL
- affected >= 6.10.0, < 6.10.1fixed 6.10.1
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix error pbuf checking Syz reports a problem, which boils down to NULL vs IS_ERR inconsistent error handling in io_alloc_pbuf_ring(). KASAN: null-ptr-deref in range [0x0000000000000000-0x00000000000
Page 607 of 706