kernel

Vulnerabilities (14,027)

• CVE-2024-26857HigApr 17, 2024
  affected >= 4.2.0, < 4.19.310fixed 4.19.310

  In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_

• CVE-2024-26856HigApr 17, 2024
  affected >= 5.14.0, < 5.15.152fixed 5.15.152

  In the Linux kernel, the following vulnerability has been resolved: net: sparx5: Fix use after free inside sparx5_del_mact_entry Based on the static analyzis of the code it looks like when an entry from the MAC table was removed, the entry was still used after being freed. More

• CVE-2024-26855MedApr 17, 2024
  affected >= 4.20.0, < 5.4.272fixed 5.4.272

  In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_spec is dereferenced

• CVE-2024-26854HigApr 17, 2024
  affected >= 6.7.0, < 6.7.10fixed 6.7.10

  In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is initialized too late, after its first use. Move it to the top of ice_dpll_init. Note that the "err_exit" error path destroys the mutex. And t

• CVE-2024-26853CriApr 17, 2024
  affected >= 5.13.0, < 6.1.82fixed 6.1.82

  In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi. However, this is

• CVE-2024-26852HigApr 17, 2024
  affected >= 4.11.0, < 4.19.310fixed 4.19.310

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") w

• CVE-2024-26851HigApr 17, 2024
  affected >= 2.6.17, < 4.19.310fixed 4.19.310

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vmlinux get_bitmap(

• CVE-2024-26850MedApr 17, 2024
  affected >= 6.6.0, < 6.6.21fixed 6.6.21

  In the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: fix BUG_ON with pud advanced test Architectures like powerpc add debug checks to ensure we find only devmap PUD pte entries. These debug checks are only done with CONFIG_DEBUG_VM. This pa

• CVE-2024-26849MedApr 17, 2024
  affected >= 6.1.0, < 6.1.81fixed 6.1.81

  In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG:

• CVE-2024-26847MedApr 17, 2024
  affected >= 6.3.0, < 6.6.21fixed 6.6.21

  In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: use correct function name for resetting TCE tables The PAPR spec spells the function name as "ibm,reset-pe-dma-windows" but in practice firmware uses the singular form: "ibm,reset-pe-dma-wi

• CVE-2023-52644MedApr 17, 2024
  affected >= 2.6.26, < 4.19.311fixed 4.19.311

  In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue. Stop/wake queue 0

• CVE-2024-26846MedApr 17, 2024
  affected >= 5.3.0, < 5.10.211fixed 5.10.211

  In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl a

• CVE-2024-26845HigApr 17, 2024
  affected >= 5.1.0, < 5.4.270fixed 5.4.270

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list takes a refcounter on t

• CVE-2024-26844MedApr 17, 2024
  affected >= 4.0.0, < 6.1.80fixed 6.1.80

  In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request wit

• CVE-2024-26843MedApr 17, 2024
  affected >= 5.5.0, < 5.10.211fixed 5.10.211

  In the Linux kernel, the following vulnerability has been resolved: efi: runtime: Fix potential overflow of soft-reserved region size md_size will have been narrowed if we have >= 4GB worth of pages in a soft-reserved region.

• CVE-2024-26842HigApr 17, 2024
  affected >= 6.5.0, < 6.6.19fixed 6.6.19

  In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix shift issue in ufshcd_clear_cmd() When task_tag >= 32 (in MCQ mode) and sizeof(unsigned int) == 4, 1U << task_tag will out of bounds for a u32 mask. Fix this up to prevent SHIFT_ISSUE (bitw

• CVE-2024-26841MedApr 17, 2024
  affected >= 5.19.0, < 6.6.19fixed 6.6.19

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: Update cpu_sibling_map when disabling nonboot CPUs Update cpu_sibling_map when disabling nonboot CPUs by defining & calling clear_cpu_sibling_map(), otherwise we get such errors on SMT systems: jump

• CVE-2024-26840MedApr 17, 2024
  affected >= 2.6.30, < 4.19.309fixed 4.19.309

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: ================================================================== unreferenced obj

• CVE-2024-26839MedApr 17, 2024
  affected >= 4.3.0, < 4.19.308fixed 4.19.308

  In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated before. Or those reso

• CVE-2024-26838HigApr 17, 2024
  affected >= 5.14.0, < 5.15.150fixed 5.15.150

  In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assocated with freeing an IRQ. [50006.466686] Call Trace: [50006.466691] [50006.489538] dump_stack+0x5c/0x80 [50006.4