kernel

Vulnerabilities (14,119)

• CVE-2024-40917MedJul 12, 2024
  affected < 6.6.72fixed 6.6.72

  In the Linux kernel, the following vulnerability has been resolved: memblock: make memblock_set_node() also warn about use of MAX_NUMNODES On an (old) x86 system with SRAT just covering space above 4Gb: ACPI: SRAT: Node 0 PXM 0 [mem 0x100000000-0xfffffffff] hotplug the co

• CVE-2024-40916MedJul 12, 2024
  affected < 5.4.279fixed 5.4.279

  In the Linux kernel, the following vulnerability has been resolved: drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortu

• CVE-2024-40915MedJul 12, 2024
  affected >= 5.7.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context __kernel_map_pages() is a debug function which clears the valid bit in page table entry for deallocated pages to detect illegal memory acce

• CVE-2024-40914MedJul 12, 2024
  affected < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: don't unpoison huge_zero_folio When I did memory failure tests recently, below panic occurs: kernel BUG at include/linux/mm.h:1135! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 9 PID: 13

• CVE-2024-40913HigJul 12, 2024
  affected >= 5.19.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference

• CVE-2024-40912MedJul 12, 2024
  affected >= 3.14.0, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() The ieee80211_sta_ps_deliver_wakeup() function takes sta->ps_lock to synchronizes with ieee80211_tx_h_unicast_ps_buf() which is called from soft

• CVE-2024-40911HigJul 12, 2024
  affected >= 3.16.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked before calling rdev_get_station() (see lockdep assert in ieee80211_get_station()). This fixes the following kernel NULL dereference:

• CVE-2024-40910HigJul 12, 2024
  affected >= 5.18.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execution path for accep

• CVE-2024-40909HigJul 12, 2024
  affected < 6.6.35fixed 6.6.35

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a potential use-after-free in bpf_link_free() After commit 1a80dbcb2dba, bpf_link can be freed by link->ops->dealloc_deferred, but the code still tests and uses link->ops->dealloc afterward, which lead

• CVE-2024-40908MedJul 12, 2024
  affected >= 5.15.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: bpf: Set run context for rawtp test_run callback syzbot reported crash when rawtp program executed through the test_run interface calls bpf_get_attach_cookie helper or any other helper that touches task->bpf_ct

• CVE-2024-40907CriJul 12, 2024
  affected >= 6.9.0, < 6.9.6fixed 6.9.6

  In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic in XDP_TX action In the XDP_TX path, ionic driver sends a packet to the TX path with rx page and corresponding dma address. After tx is done, ionic_tx_clean() frees that page. But RX rin

• CVE-2024-40906HigJul 12, 2024
  affected >= 6.1.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Always stop health timer during driver removal Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. T

• CVE-2024-40905MedJul 12, 2024
  affected >= 4.2.0, < 5.4.279fixed 5.4.279

  In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible race in __fib6_drop_pcpu_from() syzbot found a race in __fib6_drop_pcpu_from() [1] If compiler reads more than once (*ppcpu_rt), second read could read NULL, if another cpu clears the value

• CVE-2024-40904MedJul 12, 2024
  affected >= 2.6.28, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages The syzbot fuzzer found that the interrupt-URB completion callback in the cdc-wdm driver was taking too long, and the driver's immediate resu

• CVE-2024-40903HigJul 12, 2024
  affected < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps There could be a potential use-after-free case in tcpm_register_source_caps(). This could happen when: * new (say invalid) source caps are

• CVE-2024-40902HigJul 12, 2024
  affected >= 2.6.12, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than t

• CVE-2024-40901HigJul 12, 2024
  affected >= 4.10.0, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions operate on long val

• CVE-2024-40900HigJul 12, 2024
  affected >= 5.19.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed:

• CVE-2024-40899HigJul 12, 2024
  affected >= 6.8.0, < 6.9.6fixed 6.9.6

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd() We got the following issue in a fuzz test of randomly issuing the restore command: ==========================================================

• CVE-2024-39510HigJul 12, 2024
  affected >= 6.8.0, < 6.9.6fixed 6.9.6

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: =====================================================