kernel

Vulnerabilities (14,119)

• CVE-2024-39292HigJun 24, 2024
  affected >= 2.6.23, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list. If that happens, register_winch_irq()

• CVE-2024-39291HigJun 24, 2024
  affected >= 6.5.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() The function gfx_v9_4_3_init_microcode in gfx_v9_4_3.c was generating about potential truncation of output when using t

• CVE-2024-38667HigJun 24, 2024
  affected >= 5.7.0, < 6.1.93fixed 6.1.93

  In the Linux kernel, the following vulnerability has been resolved: riscv: prevent pt_regs corruption for secondary idle threads Top of the kernel thread stack should be reserved for pt_regs. However this is not the case for the idle threads of the secondary boot harts. Their s

• CVE-2024-38664HigJun 24, 2024
  affected >= 6.2.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: drm: zynqmp_dpsub: Always register bridge We must always register the DRM bridge, since zynqmp_dp_hpd_work_func calls drm_bridge_hpd_notify, which in turn expects hpd_mutex to be initialized. We do this before

• CVE-2024-38663HigJun 24, 2024
  affected >= 6.2.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"), each iostat instance is added to blkcg percpu list, so blkcg_reset_stats() can't re

• CVE-2024-38384HigJun 24, 2024
  affected >= 6.2.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from reorder of WRITE ->lqueued __blkcg_rstat_flush() can be run anytime, especially when blk_cgroup_bio_start is being executed. If WRITE of `->lqueued` is re-ordered with READ

• CVE-2024-37026MedJun 24, 2024
  affected >= 6.8.0, < 6.9.4fixed 6.9.4

  In the Linux kernel, the following vulnerability has been resolved: drm/xe: Only use reserved BCS instances for usm migrate exec queue The GuC context scheduling queue is 2 entires deep, thus it is possible for a migration job to be stuck behind a fault if migration exec queue

• CVE-2024-37021MedJun 24, 2024
  affected >= 4.4.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: fpga: manager: add owner module and take its refcount The current implementation of the fpga manager assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take

• CVE-2024-36479MedJun 24, 2024
  affected >= 4.10.0, < 6.1.120fixed 6.1.120

  In the Linux kernel, the following vulnerability has been resolved: fpga: bridge: add owner module and take its refcount The current implementation of the fpga bridge assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take t

• CVE-2024-35247MedJun 24, 2024
  affected >= 4.10.0, < 5.10.219fixed 5.10.219

  In the Linux kernel, the following vulnerability has been resolved: fpga: region: add owner module and take its refcount The current implementation of the fpga region assumes that the low-level module registers a driver for the parent device and uses its owner pointer to take t

• CVE-2024-34030MedJun 24, 2024
  affected >= 6.6.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Return error for int_map allocation failure Return -ENOMEM from of_pci_prop_intr_map() if kcalloc() fails to prevent a NULL pointer dereference in this case. [bhelgaas: commit log]

• CVE-2024-34027HigJun 24, 2024
  affected >= 5.8.0, < 5.10.219fixed 5.10.219

  In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock It needs to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock to avoid racing with checkpoint, otherwise, filesystem me

• CVE-2024-33847HigJun 24, 2024
  affected >= 5.14.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: don't allow unaligned truncation on released compress inode f2fs image may be corrupted after below testcase: - mkfs.f2fs -O extra_attr,compression -f /dev/vdb - mount /dev/vdb /mnt/f2fs - touch

• CVE-2024-32936HigJun 24, 2024
  affected >= 6.7.0, < 6.9.4fixed 6.9.4

  In the Linux kernel, the following vulnerability has been resolved: media: ti: j721e-csi2rx: Fix races while restarting DMA After the frame is submitted to DMA, it may happen that the submitted list is not updated soon enough, and the DMA callback is triggered before that. Thi

• CVE-2024-39277HigJun 21, 2024
  affected >= 5.11.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: handle NUMA_NO_NODE correctly cpumask_of_node() can be called for NUMA_NO_NODE inside do_map_benchmark() resulting in the following sanitizer report: UBSAN: array-index-out-of-bounds in

• CVE-2024-38780MedJun 21, 2024
  affected >= 4.14.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() with spin_unlock_ir

• CVE-2024-38662MedJun 21, 2024
  affected < 5.10.219fixed 5.10.219

  In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a map_d

• CVE-2024-36481MedJun 21, 2024
  affected >= 6.6.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might return NULL or an error via the ERR_PTR() macro. However, its caller in parse_btf_field() only checks for the NULL condition.

• CVE-2024-36477HigJun 21, 2024
  affected >= 6.6.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the transfer buffer. As su

• CVE-2024-36288CriJun 21, 2024
  affected >= 6.9.3, < 6.9.4fixed 6.9.4

  In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-access in range [0x