kernel

Vulnerabilities (14,119)

• CVE-2024-40958HigJul 12, 2024
  affected >= 5.2.0, < 5.4.279fixed 5.4.279

  In the Linux kernel, the following vulnerability has been resolved: netns: Make get_net_ns() handle zero refcount net Syzkaller hit a warning: refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0 Modules lin

• CVE-2024-40957HigJul 12, 2024
  affected >= 5.15.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING hook, we should pass

• CVE-2024-40956HigJul 12, 2024
  affected >= 5.11.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed

• CVE-2024-40955MedJul 12, 2024
  affected >= 6.5.0, < 6.6.36fixed 6.6.36

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists() We can trigger a slab-out-of-bounds with the following commands: mkfs.ext4 -F /dev/$disk 10G mount /dev/$disk /tmp/test echo

• CVE-2024-40954HigJul 12, 2024
  affected >= 5.12.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_

• CVE-2024-40953HigJul 12, 2024
  affected >= 2.6.39, < 4.19.323fixed 4.19.323

  In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Use {READ,WRITE}_ONCE() to access kvm->last_boosted_vcpu to ensure the loads and stores are atomic. In the extremely unlikely scenario the compil

• CVE-2024-40952MedJul 12, 2024
  affected >= 6.6.0, < 6.6.36fixed 6.6.36

  In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty() bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. This introduces the followi

• CVE-2024-40951MedJul 12, 2024
  affected >= 6.6.0, < 6.6.36fixed 6.6.36

  In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger() bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. Since ocfs2 hasn't set bh->

• CVE-2024-40950MedJul 12, 2024
  affected >= 6.9.0, < 6.9.7fixed 6.9.7

  In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: fix misused mapping_large_folio_support() for anon folios When I did a large folios split test, a WARNING "[ 5059.122759][ T166] Cannot split file folio to non-0 order" was triggered. But the

• CVE-2024-40949HigJul 12, 2024
  affected >= 6.7.0, < 6.9.7fixed 6.9.7

  In the Linux kernel, the following vulnerability has been resolved: mm: shmem: fix getting incorrect lruvec when replacing a shmem folio When testing shmem swapin, I encountered the warning below on my machine. The reason is that replacing an old shmem folio with a new one cau

• CVE-2024-40948MedJul 12, 2024
  affected >= 5.17.0, < 6.1.96fixed 6.1.96

  In the Linux kernel, the following vulnerability has been resolved: mm/page_table_check: fix crash on ZONE_DEVICE Not all pages may apply to pgtable check. One example is ZONE_DEVICE pages: they map PFNs directly, and they don't allocate page_ext at all even if there's struct

• CVE-2024-40947HigJul 12, 2024
  affected < 5.10.222fixed 5.10.222

  In the Linux kernel, the following vulnerability has been resolved: ima: Avoid blocking in RCU read-side critical section A panic happens in ima_match_policy: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 PGD 42f873067 P4D 0 Oops: 0000 [#1] SMP NOPT

• CVE-2024-40945MedJul 12, 2024
  affected >= 5.2.0, < 5.4.279fixed 5.4.279

  In the Linux kernel, the following vulnerability has been resolved: iommu: Return right value in iommu_sva_bind_device() iommu_sva_bind_device() should return either a sva bond handle or an ERR_PTR value in error cases. Existing drivers (idxd and uacce) only check the return va

• CVE-2024-40944MedJul 12, 2024
  affected >= 6.2.0, < 6.6.35fixed 6.6.35

  In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix bug with call depth tracking The call to cc_platform_has() triggers a fault and system crash if call depth tracking is active because the GS segment has been reset by load_segments() and GS_BASE

• CVE-2024-40943HigJul 12, 2024
  affected >= 2.6.23, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix races between hole punching and AIO+DIO After commit "ocfs2: return real error code in ocfs2_dio_wr_get_block", fstests/generic/300 become from always failed to sometimes failed: ===================

• CVE-2024-40942MedJul 12, 2024
  affected >= 2.6.26, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets de

• CVE-2024-40941HigJul 12, 2024
  affected >= 4.12.0, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove t

• CVE-2024-40940HigJul 12, 2024
  affected >= 5.19.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rule creation fail in mlx5_lag_create_port_sel_table(), instead of previously created rules, the tainted pointer is delet

• CVE-2024-40939HigJul 12, 2024
  affected >= 5.16.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipc_devlink_create_region(), previously created regions delete process starts from tainted pointer

• CVE-2024-40938MedJul 12, 2024
  affected >= 5.19.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: landlock: Fix d_parent walk The WARN_ON_ONCE() in collect_domain_accesses() can be triggered when trying to link a root mount point. This cannot work in practice because this directory is mounted, but the VFS