kernel

Vulnerabilities (14,119)

• CVE-2024-39468HigJun 25, 2024
  affected >= 5.14.0, < 5.15.162fixed 5.15.162

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock.

• CVE-2024-39467HigJun 25, 2024
  affected >= 3.8.0, < 5.4.278fixed 5.4.278

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kernel bug as below: F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 ===========================================

• CVE-2024-39466MedJun 25, 2024
  affected >= 5.15.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/qcom/lmh: Check for SCM availability at probe Up until now, the necessary scm availability check has not been performed, leading to possible null pointer dereferences (which did happen for me on

• CVE-2024-39465MedJun 25, 2024
  affected >= 6.7.0, < 6.9.5fixed 6.9.5

  In the Linux kernel, the following vulnerability has been resolved: media: mgb4: Fix double debugfs remove Fixes an error where debugfs_remove_recursive() is called first on a parent directory and then again on a child which causes a kernel panic. [hverkuil: added Fixes/Cc tag

• CVE-2024-39464MedJun 25, 2024
  affected >= 6.6.0, < 6.6.34fixed 6.6.34

  In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix notifier list entry init struct v4l2_async_notifier has several list_head members, but only waiting_list and done_list are initialized. notifier_entry was kept 'zeroed' leading to an unin

• CVE-2024-39463HigJun 25, 2024
  affected >= 5.11.0, < 5.15.168fixed 5.15.168

  In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: add

• CVE-2024-39462CriJun 25, 2024
  affected >= 6.6.0, < 6.6.34fixed 6.6.34

  In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by,

• CVE-2024-39461MedJun 25, 2024
  affected >= 6.6.0, < 6.6.34fixed 6.6.34

  In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by,

• CVE-2024-39371MedJun 25, 2024
  affected >= 5.19.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: io_uring: check for non-NULL file pointer in io_file_can_poll() In earlier kernels, it was possible to trigger a NULL pointer dereference off the forced async preparation path, if no file had been assigned. The

• CVE-2024-39301MedJun 25, 2024
  affected >= 3.2.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: net/9p: fix uninit-value in p9_client_rpc() Syzbot with the help of KMSAN reported the following error: BUG: KMSAN: uninit-value in trace_9p_client_res include/trace/events/9p.h:146 [inline] BUG: KMSAN: uninit

• CVE-2024-39298MedJun 25, 2024
  affected >= 6.0.0, < 6.1.95fixed 6.1.95

  In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages When I did memory failure tests recently, below panic occurs: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:

• CVE-2024-39296MedJun 25, 2024
  affected >= 6.6.0, < 6.6.34fixed 6.6.34

  In the Linux kernel, the following vulnerability has been resolved: bonding: fix oops during rmmod "rmmod bonding" causes an oops ever since commit cc317ea3d927 ("bonding: remove redundant NULL check in debugfs function"). Here are the relevant functions being called: bonding

• CVE-2024-39293CriJun 25, 2024
  affected >= 6.9.0, < 6.9.5fixed 6.9.5

  In the Linux kernel, the following vulnerability has been resolved: Revert "xsk: Support redirect to any socket bound to the same umem" This reverts commit 2863d665ea41282379f108e4da6c8a2366ba66db. This patch introduced a potential kernel crash when multiple napi instances red

• CVE-2024-39276MedJun 25, 2024
  affected < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() Syzbot reports a warning as follows: ============================================ WARNING: CPU: 0 PID: 5075 at fs/mbcache.c:419 mb_cach

• CVE-2024-38661MedJun 25, 2024
  affected >= 4.19.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: s390/ap: Fix crash in AP internal function modify_bitmap() A system crash like this Failing address: 200000cb7df6f000 TEID: 200000cb7df6f403 Fault in home space mode while using kernel ASCE. AS:00000002d

• CVE-2024-38385HigJun 25, 2024
  affected >= 6.5.0, < 6.6.34fixed 6.6.34

  In the Linux kernel, the following vulnerability has been resolved: genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() irq_find_at_or_after() dereferences the interrupt descriptor which is returned by mt_find() while neither holding sparse_irq_lock nor RCU read lo

• CVE-2024-38306HigJun 25, 2024
  affected >= 6.8.0, < 6.9.5fixed 6.9.5

  In the Linux kernel, the following vulnerability has been resolved: btrfs: protect folio::private when attaching extent buffer folios [BUG] Since v6.8 there are rare kernel crashes reported by various people, the common factor is bad page status error messages like this: BUG

• CVE-2024-37354HigJun 25, 2024
  affected >= 4.17.0, < 5.15.197fixed 5.15.197

  In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfs_set_item_key_safe(): BTRFS critical (device vdb): slot 4 key (450 108 8192) new

• CVE-2024-37078HigJun 25, 2024
  affected >= 2.6.30, < 4.19.317fixed 4.19.317

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeba

• CVE-2022-48772MedJun 25, 2024
  affected >= 4.11.0, < 5.4.278fixed 5.4.278

  In the Linux kernel, the following vulnerability has been resolved: media: lgdt3306a: Add a check against null-pointer-def The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup