kernel

Vulnerabilities (14,027)

• CVE-2024-26678MedApr 2, 2024
  affected >= 6.7.0, < 6.7.5fixed 6.7.5

  In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit entrypoint of the 64-bit kernel image if it is bootable fro

• CVE-2024-26677MedApr 2, 2024
  affected >= 2.6.22, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of delayed ACKs to not set the reference serial number as they can't be used as an RTT reference.

• CVE-2024-26676MedApr 2, 2024
  affected < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using the peer. socketpa

• CVE-2024-26675MedApr 2, 2024
  affected >= 2.6.12, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adop

• CVE-2024-26674HigApr 2, 2024
  affected >= 6.4.0, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.

• CVE-2024-26673HigApr 2, 2024
  affected >= 5.3.0, < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a

• CVE-2024-26672HigApr 2, 2024
  affected >= 4.2.0, < 6.7.4fixed 6.7.4

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()' Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variabl

• CVE-2024-26671MedApr 2, 2024
  affected >= 4.11.0, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_

• CVE-2024-26670MedApr 2, 2024
  affected >= 6.6.0, < 6.6.15fixed 6.6.15

  In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD Currently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't quite right, as it is supposed to be applied after the last explicit memory acc

• CVE-2024-26669HigApr 2, 2024
  affected >= 5.1.0, < 6.6.15fixed 6.6.15

  In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the '

• CVE-2024-26668MedApr 2, 2024
  affected >= 4.3.0, < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its be

• CVE-2024-26667MedApr 2, 2024
  affected >= 5.19.0, < 6.1.78fixed 6.1.78

  In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup The commit 8b45a26f2ba9 ("drm/msm/dpu: reserve cdm blocks for writeback in case of YUV output") introduced a smatch warning about another co

• CVE-2024-26666HigApr 2, 2024
  affected >= 6.5.0, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that.

• CVE-2024-26665CriApr 2, 2024
  affected >= 5.9.0, < 5.10.210fixed 5.10.210

  In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of

• CVE-2024-26664HigApr 2, 2024
  affected < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access Fix a bug that pdata->cpu_map[] is set before out-of-bounds check. The problem might be triggered on systems with more than 128 cores per package.

• CVE-2024-26663HigApr 2, 2024
  affected >= 4.9.0, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010:

• CVE-2024-26662MedApr 2, 2024
  affected >= 5.9.0, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' 'panel_cntl' structure used to control the display panel could be null, dereferencing it could lead to a null pointer access. Fi

• CVE-2024-26661MedApr 2, 2024
  affected >= 5.9.0, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg

• CVE-2024-26660HigApr 2, 2024
  affected >= 5.11.0, < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four elements, correspon

• CVE-2024-26659HigApr 2, 2024
  affected >= 2.6.36, < 5.10.213fixed 5.10.213

  In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of the early TRBs. Yet