kernel

Vulnerabilities (16,579)

• CVE-2024-26687MedApr 3, 2024
  affected >= 2.6.37, < 5.4.274fixed 5.4.274

  In the Linux kernel, the following vulnerability has been resolved: xen/events: close evtchn after mapping cleanup shutdown_pirq and startup_pirq are not taking the irq_mapping_update_lock because they can't due to lock inversion. Both are called with the irq_desc->lock being t

• CVE-2024-26686MedApr 3, 2024
  affected >= 2.6.12, < 5.10.237fixed 5.10.237

  In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the process has NR_THR

• CVE-2024-26685MedApr 3, 2024
  affected >= 3.12.0, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async

• CVE-2023-52639MedApr 3, 2024
  affected >= 4.8.0, < 6.1.82fixed 6.1.82

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to see gmap->private being zero in kvm_s390_vsie_gmap_notifier resulting in a crash. This is due to the fact that we add gmap->private

• CVE-2023-52638MedApr 3, 2024
  affected >= 5.15.0, < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks_lock - active_ses

• CVE-2023-52637HigApr 3, 2024
  affected >= 5.4.0, < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving packets. Following t

• CVE-2024-26684MedApr 2, 2024
  affected >= 5.4.0, < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves the Data Path Pari

• CVE-2024-26683MedApr 2, 2024
  affected >= 6.7.0, < 6.7.5fixed 6.7.5

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel t

• CVE-2024-26682MedApr 2, 2024
  affected >= 6.7.0, < 6.7.5fixed 6.7.5

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that to not attempt to c

• CVE-2024-26681MedApr 2, 2024
  affected >= 6.0.0, < 6.1.78fixed 6.1.78

  In the Linux kernel, the following vulnerability has been resolved: netdevsim: avoid potential loop in nsim_dev_trap_report_work() Many syzbot reports include the following trace [1] If nsim_dev_trap_report_work() can not grab the mutex, it should rearm itself at least one jif

• CVE-2024-26680MedApr 2, 2024
  affected >= 5.5.0, < 6.1.78fixed 6.1.78

  In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes for PTP HWTS ring but then generic aq_ring_free() does not take this into account. Create and u

• CVE-2024-26679MedApr 2, 2024
  affected >= 3.18.0, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.

• CVE-2024-26678MedApr 2, 2024
  affected >= 6.7.0, < 6.7.5fixed 6.7.5

  In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit entrypoint of the 64-bit kernel image if it is bootable fro

• CVE-2024-26677MedApr 2, 2024
  affected >= 2.6.22, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of delayed ACKs to not set the reference serial number as they can't be used as an RTT reference.

• CVE-2024-26676MedApr 2, 2024
  affected < 5.15.149fixed 5.15.149

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using the peer. socketpa

• CVE-2024-26675MedApr 2, 2024
  affected >= 2.6.12, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adop

• CVE-2024-26674HigApr 2, 2024
  affected >= 6.4.0, < 6.6.17fixed 6.6.17

  In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.

• CVE-2024-26673HigApr 2, 2024
  affected >= 5.3.0, < 5.4.269fixed 5.4.269

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a

• CVE-2024-26672HigApr 2, 2024
  affected >= 4.2.0, < 6.7.4fixed 6.7.4

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()' Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variabl

• CVE-2024-26671MedApr 2, 2024
  affected >= 4.11.0, < 4.19.307fixed 4.19.307

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_