kernel

Vulnerabilities (14,027)

• CVE-2024-26759HigApr 3, 2024
  affected >= 4.15.0, < 6.1.80fixed 6.1.80

  In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache When skipping swapcache for SWP_SYNCHRONOUS_IO, if two or more threads swapin the same entry at the same time, they get different pages (A, B). Before one thread (T0)

• CVE-2024-26758MedApr 3, 2024
  affected >= 3.0.0, < 6.7.7fixed 6.7.7

  In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore suspended array in md_check_recovery() mddev_suspend() never stop sync_thread, hence it doesn't make sense to ignore suspended array in md_check_recovery(), which might cause sync_thread can't

• CVE-2024-26757MedApr 3, 2024
  affected >= 4.8.0, < 6.7.7fixed 6.7.7

  In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in md_check_recovery() Usually if the array is not read-write, md_check_recovery() won't register new sync_thread in the first place. And if the array is read-write and sync_thr

• CVE-2024-26756MedApr 3, 2024
  affected >= 2.6.17, < 6.7.7fixed 6.7.7

  In the Linux kernel, the following vulnerability has been resolved: md: Don't register sync_thread for reshape directly Currently, if reshape is interrupted, then reassemble the array will register sync_thread directly from pers->run(), in this case 'MD_RECOVERY_RUNNING' is set

• CVE-2024-26755MedApr 3, 2024
  affected >= 6.7.0, < 6.7.7fixed 6.7.7

  In the Linux kernel, the following vulnerability has been resolved: md: Don't suspend the array for interrupted reshape md_start_sync() will suspend the array if there are spares that can be added or removed from conf, however, if reshape is still in progress, this won't happen

• CVE-2024-26754HigApr 3, 2024
  affected >= 4.7.0, < 4.19.308fixed 4.19.308

  In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink family. Syzkaller hit '

• CVE-2024-26753HigApr 3, 2024
  affected < 5.10.212fixed 5.10.212

  In the Linux kernel, the following vulnerability has been resolved: crypto: virtio/akcipher - Fix stack overflow on memcpy sizeof(struct virtio_crypto_akcipher_session_para) is less than sizeof(struct virtio_crypto_op_ctrl_req::u), copying more bytes from stack variable leads s

• CVE-2024-26752MedApr 3, 2024
  affected < 4.19.308fixed 4.19.308

  In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this,

• CVE-2024-26751MedApr 3, 2024
  affected >= 4.15.0, < 4.19.308fixed 4.19.308

  In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping correctly, and eventuall

• CVE-2024-26749HigApr 3, 2024
  affected >= 5.4.0, < 5.4.270fixed 5.4.270

  In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() ... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ... 'priv_req' actually fr

• CVE-2024-26748HigApr 3, 2024
  affected >= 5.4.0, < 5.4.270fixed 5.4.270

  In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832

• CVE-2024-26747MedApr 3, 2024
  affected >= 4.19.0, < 5.10.211fixed 5.10.211

  In the Linux kernel, the following vulnerability has been resolved: usb: roles: fix NULL pointer issue when put module's reference In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch device and put the r

• CVE-2024-26744MedApr 3, 2024
  affected >= 3.3.0, < 4.19.308fixed 4.19.308

  In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying the srpt_service_guid parameter Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module trigg

• CVE-2024-26743MedApr 3, 2024
  affected >= 4.11.0, < 5.10.211fixed 5.10.211

  In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]----------- WARNING: CP

• CVE-2024-26742HigApr 3, 2024
  affected >= 6.0.0, < 6.1.80fixed 6.1.80

  In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, the driver needs t

• CVE-2024-26741MedApr 3, 2024
  affected >= 6.1.0, < 6.1.80fixed 6.1.80

  In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkaller reported a warning [0] in inet_csk_destroy_sock() with no repro. WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->ics

• CVE-2024-26740MedApr 3, 2024
  affected >= 4.10.0, < 6.6.19fixed 6.6.19

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog for mirred ingress The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so run

• CVE-2024-26739HigApr 3, 2024
  affected >= 4.19.0, < 5.10.238fixed 5.10.238

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcod

• CVE-2024-26738MedApr 3, 2024
  affected >= 6.4.0, < 6.6.19fixed 6.6.19

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci_controller When a PCI device is dynamically added, the kernel oopses with a NULL pointer dereference: BUG: Kernel NULL pointer dereference o

• CVE-2024-26737HigApr 3, 2024
  affected >= 5.15.0, < 5.15.150fixed 5.15.150

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->timer. bpf_timer_c