kernel

Vulnerabilities (14,119)

• CVE-2024-41064HigJul 29, 2024
  affected >= 3.7.0, < 5.4.281fixed 5.4.281

  In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a cop

• CVE-2024-41063MedJul 29, 2024
  affected < 4.19.319fixed 4.19.319

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destro

• CVE-2024-41062HigJul 29, 2024
  affected >= 3.4.0, < 6.1.101fixed 6.1.101

  In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection

• CVE-2024-41061HigJul 29, 2024
  affected >= 6.7.0, < 6.9.11fixed 6.9.11

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport [Why] Potential out of bounds access in dml2_calculate_rq_and_dlg_params() because the value of out_lowest_state_idx used as an index for

• CVE-2024-41060HigJul 29, 2024
  affected >= 3.19.0, < 5.10.234fixed 5.10.234

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.

• CVE-2024-41059HigJul 29, 2024
  affected >= 3.16.0, < 4.19.319fixed 4.19.319

  In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_listxattr+0x11e9/0x

• CVE-2024-41058HigJul 29, 2024
  affected >= 5.17.0, < 6.1.101fixed 6.1.101

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN: sl

• CVE-2024-41057HigJul 29, 2024
  affected >= 5.17.0, < 6.1.101fixed 6.1.101

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() We got the following issue in our fault injection stress test: ================================================================== BUG: KASAN:

• CVE-2024-41056HigJul 29, 2024
  affected >= 5.16.0, < 6.1.100fixed 6.1.100

  In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-termin

• CVE-2024-41055MedJul 29, 2024
  affected < 5.10.222fixed 5.10.222

  In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage"

• CVE-2024-41054MedJul 29, 2024
  affected >= 6.5.0, < 6.6.41fixed 6.6.41

  In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue When ufshcd_clear_cmd is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by the ISR. And ufshcd_clear_c

• CVE-2024-41053MedJul 29, 2024
  affected < 6.6.41fixed 6.6.41

  In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_abort_one racing issue When ufshcd_abort_one is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by ISR. Return success when re

• CVE-2024-41052MedJul 29, 2024
  affected >= 6.6.36, < 6.6.41fixed 6.6.41

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Init the count variable in collecting hot-reset devices The count variable is used without initialization, it results in mistakes in the device counting and crashes the userspace if the get hot reset

• CVE-2024-41051HigJul 29, 2024
  affected < 6.1.100fixed 6.1.100

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing ondemand_object_worker() to re-open the object, cachefiles_object is not pinned. The cachefiles_object may be freed when t

• CVE-2024-41050HigJul 29, 2024
  affected >= 5.19.0, < 6.1.100fixed 6.1.100

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation of msg_id to avoid reuse Reusing the msg_id after a maliciously completed reopen request may cause a read request to remain unprocessed and result in a hung, as shown below:

• CVE-2024-41049HigJul 29, 2024
  affected < 5.4.280fixed 5.4.280

  In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a lock entry that was ad

• CVE-2024-41048HigJul 29, 2024
  affected >= 4.20.0, < 5.15.163fixed 5.15.163

  In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg When running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch platform, the following kernel panic occurs: [...] Oops[#1]: CPU: 22 PID: 2824 Comm

• CVE-2024-41047MedJul 29, 2024
  affected < 5.15.163fixed 5.15.163

  In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 ("i40e: Fix reset path while removing the driver") introduced a new PF state "__I40E_IN_REMOVE" to block modifying the XDP progr

• CVE-2024-41046HigJul 29, 2024
  affected >= 3.0.0, < 4.19.318fixed 4.19.318

  In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times.

• CVE-2024-41045HigJul 29, 2024
  affected >= 5.15.0, < 6.9.10fixed 6.9.10

  In the Linux kernel, the following vulnerability has been resolved: bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked through bpf_map_update_elem as well, or more precisely, f