kernel

Vulnerabilities (14,119)

• CVE-2024-34777HigJun 21, 2024
  affected >= 5.11.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: fix node id validation While validating node ids in map_benchmark_ioctl(), node_possible() may be provided with invalid argument outside of [0,MAX_NUMNODES-1] range leading to: BUG: KAS

• CVE-2024-38659HigJun 21, 2024
  affected >= 2.6.35, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA

• CVE-2024-38637MedJun 21, 2024
  affected >= 4.9.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of get_channel_from_mode If channel for the given node is not found we return null from get_channel_from_mode. Make sure we validate the return pointer before using it in two of th

• CVE-2024-38636MedJun 21, 2024
  affected >= 5.17.0, < 6.1.93fixed 6.1.93

  In the Linux kernel, the following vulnerability has been resolved: f2fs: multidev: fix to recognize valid zero block address As reported by Yi Zhang in mailing list [1], kernel warning was catched during zbd/010 test as below: ./check zbd/010 zbd/010 (test gap zone support wi

• CVE-2024-38635HigJun 21, 2024
  affected < 5.4.278fixed 5.4.278

  In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT. This code is however completely wrong and leads to an o

• CVE-2024-38634MedJun 21, 2024
  affected >= 2.6.30, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port->lock when calling uart_handle_cts_change() uart_handle_cts_change() has to be called with port lock taken, Since we run it in a separate work, the lock may not be taken at the time o

• CVE-2024-38633MedJun 21, 2024
  affected >= 2.6.30, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uart_driver_registered on driver removal The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after

• CVE-2024-38632MedJun 21, 2024
  affected < 5.15.168fixed 5.15.168

  In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak.

• CVE-2024-38631HigJun 21, 2024
  affected >= 6.9.0, < 6.9.4fixed 6.9.4

  In the Linux kernel, the following vulnerability has been resolved: iio: adc: PAC1934: fix accessing out of bounds array index Fix accessing out of bounds array index for average current and voltage measurements. The device itself has only 4 channels, but in sysfs there are "fa

• CVE-2024-38630HigJun 21, 2024
  affected >= 2.6.12, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is running, del_timer()

• CVE-2024-38629HigJun 21, 2024
  affected >= 6.4.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file operations. Therefore,

• CVE-2024-38628HigJun 21, 2024
  affected >= 5.15.0, < 6.1.93fixed 6.1.93

  In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks.

• CVE-2024-38627HigJun 21, 2024
  affected >= 4.7.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.

• CVE-2024-38626HigJun 21, 2024
  affected >= 6.9.0, < 6.9.4fixed 6.9.4

  In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was reported by lee bruce: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300 fuse_req

• CVE-2024-38625MedJun 21, 2024
  affected >= 5.15.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called.

• CVE-2024-38624MedJun 21, 2024
  affected >= 5.15.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: vbo = 2 * vbo + skip

• CVE-2024-38623HigJun 21, 2024
  affected >= 5.15.0, < 5.15.161fixed 5.15.161

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)

• CVE-2024-38622MedJun 21, 2024
  affected >= 5.19.0, < 6.6.33fixed 6.6.33

  In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, but then callback function is unconditionally called by this po

• CVE-2024-38621HigJun 21, 2024
  affected >= 3.7.0, < 4.19.316fixed 4.19.316

  In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have copied thus far. Wh

• CVE-2024-38390MedJun 21, 2024
  affected >= 6.1.0, < 6.1.93fixed 6.1.93

  In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails Calling a6xx_destroy() before adreno_gpu_init() leads to a null pointer dereference on: msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev,