kernel

Vulnerabilities (14,027)

• CVE-2024-26586HigFeb 22, 2024
  affected >= 4.19.0, < 5.10.209fixed 5.10.209

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn,

• CVE-2023-52452HigFeb 22, 2024
  affected >= 5.12.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently

• CVE-2023-52451HigFeb 22, 2024
  affected >= 4.1.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC inde

• CVE-2023-52450MedFeb 22, 2024
  affected >= 6.2.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi = &type->topology[ni

• CVE-2023-52449MedFeb 22, 2024
  affected >= 2.6.31, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read

• CVE-2023-52448MedFeb 22, 2024
  affected >= 4.20.0, < 5.4.268fixed 5.4.268

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in r

• CVE-2023-52447HigFeb 22, 2024
  affected >= 5.9.0, < 5.10.214fixed 5.10.214

  In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_p

• CVE-2023-52446HigFeb 22, 2024
  affected >= 6.2.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map_free() When running `./test_progs -j` in my local vm with latest kernel, I once hit a kasan error like below: [ 1887.184724] BUG: KASAN: slab-use-after-fre

• CVE-2023-52445HigFeb 22, 2024
  affected >= 2.6.26, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on t

• CVE-2023-52444HigFeb 22, 2024
  affected >= 4.2.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_p

• CVE-2023-52443MedFeb 22, 2024
  affected >= 4.11.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string

• CVE-2024-26585CriFeb 21, 2024
  affected >= 4.20.0, < 5.15.165fixed 5.15.165

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling

• CVE-2024-26584CriFeb 21, 2024
  affected >= 4.16.0, < 5.15.160fixed 5.15.160

  In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRES

• CVE-2024-26583CriFeb 21, 2024
  affected >= 5.7.0, < 5.15.160fixed 5.15.160

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touch

• CVE-2024-26582CriFeb 21, 2024
  affected >= 6.0.0, < 6.1.79fixed 6.1.79

  In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and we trigger a use-a

• CVE-2023-52442CriFeb 21, 2024
  affected >= 5.15.0, < 5.15.145fixed 5.15.145

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in compound request `smb2_get_msg()` in smb2_get_ksmbd_tcon() and smb2_check_user_session() will always return the first request smb2 header in a compound request. if `SMB

• CVE-2023-52441CriFeb 21, 2024
  affected < 5.15.145fixed 5.15.145

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false.

• CVE-2023-52440CriFeb 21, 2024
  affected >= 5.17.0, < 6.1.52fixed 6.1.52

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy t

• CVE-2023-52439HigFeb 20, 2024
  affected >= 4.18.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev-

• CVE-2023-52438HigFeb 20, 2024
  affected >= 4.20.0, < 5.4.268fixed 5.4.268

  In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283