kernel

Vulnerabilities (14,254)

• CVE-2024-26593HigFeb 23, 2024
  affected >= 5.3.0, < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to t

• CVE-2024-26592CriFeb 22, 2024
  affected >= 5.15.0, < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_connection() functio

• CVE-2024-26591MedFeb 22, 2024
  affected >= 5.13.0, < 5.15.148fixed 5.15.148

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_attach The following case can cause a crash due to missing attach_btf: 1) load rawtp program 2) load fentry program with rawtp as target_fd 3) create tracing l

• CVE-2024-26590MedFeb 22, 2024
  affected >= 5.16.0, < 6.1.80fixed 6.1.80

  In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initiali

• CVE-2024-26589HigFeb 22, 2024
  affected >= 4.20.0, < 5.15.148fixed 5.15.148

  In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation. However, variable offset ptr alu is not prohibited for this ptr kind. So th

• CVE-2024-26588HigFeb 22, 2024
  affected >= 6.1.0, < 6.1.75fixed 6.1.75

  In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access The test_tag test triggers an unhandled page fault: # ./test_tag [ 130.640218] CPU 0 Unable to handle kernel paging request at virtual address ffff80001

• CVE-2024-26587MedFeb 22, 2024
  affected >= 6.6.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized in nsim_init_netdevsim(), which is only called if (nsim_dev_port_is_pf()). Create a counterpart of nsim_init_netdevsim() and move the mock_p

• CVE-2024-26586HigFeb 22, 2024
  affected >= 4.19.0, < 5.10.209fixed 5.10.209

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a list of ACLs. In turn,

• CVE-2023-52452HigFeb 22, 2024
  affected >= 5.12.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently

• CVE-2023-52451HigFeb 22, 2024
  affected >= 4.1.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drmem array dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC inde

• CVE-2023-52450MedFeb 22, 2024
  affected >= 6.2.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi = &type->topology[ni

• CVE-2023-52449MedFeb 22, 2024
  affected >= 2.6.31, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by ftl notifier If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read

• CVE-2023-52448MedFeb 22, 2024
  affected >= 4.20.0, < 5.4.268fixed 5.4.268

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in r

• CVE-2023-52447HigFeb 22, 2024
  affected >= 5.9.0, < 5.10.214fixed 5.10.214

  In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_p

• CVE-2023-52446HigFeb 22, 2024
  affected >= 6.2.0, < 6.6.14fixed 6.6.14

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map_free() When running `./test_progs -j` in my local vm with latest kernel, I once hit a kasan error like below: [ 1887.184724] BUG: KASAN: slab-use-after-fre

• CVE-2023-52445HigFeb 22, 2024
  affected >= 2.6.26, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on t

• CVE-2023-52444HigFeb 22, 2024
  affected >= 4.2.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link[1]: f2fs_rename() ... if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_p

• CVE-2023-52443MedFeb 22, 2024
  affected >= 4.11.0, < 4.19.306fixed 4.19.306

  In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is empty When processing a packed profile in unpack_profile() described like "profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}" a string

• CVE-2024-26585CriFeb 21, 2024
  affected >= 4.20.0, < 5.15.165fixed 5.15.165

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling

• CVE-2024-26584CriFeb 21, 2024
  affected >= 4.16.0, < 5.15.160fixed 5.15.160

  In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRES