CVE-2024-26606 — Improper Input Validation in Linux

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.82-1 (bookworm)	linux 6.1.82-1 (bookworm)
linux	linux	—	—
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < dd64bb8329ce0ea27bc557e4160c2688835402ac	dd64bb8329ce0ea27bc557e4160c2688835402ac
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < 42beab162dcee1e691ee4934292d51581c29df61	42beab162dcee1e691ee4934292d51581c29df61
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < a423042052ec2bdbf1e552e621e6a768922363cc	a423042052ec2bdbf1e552e621e6a768922363cc
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < 82722b453dc2f967b172603e389ee7dc1b3137cc	82722b453dc2f967b172603e389ee7dc1b3137cc
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < 90e09c016d72b91e76de25f71c7b93d94cc3c769	90e09c016d72b91e76de25f71c7b93d94cc3c769
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < a7ae586f6f6024f490b8546c8c84670f96bb9b68	a7ae586f6f6024f490b8546c8c84670f96bb9b68
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < 93b372c39c40cbf179e56621e6bc48240943af69	93b372c39c40cbf179e56621e6bc48240943af69
linux	linux	>= 457b9a6f09f011ebcb9b52cc203a6331a6fc2de7 < 97830f3c3088638ff90b20dfba2eb4d487bf14d7	97830f3c3088638ff90b20dfba2eb4d487bf14d7
linux	linux_kernel	>= 0 < 5.10.216-1	5.10.216-1
linux	linux_kernel	>= 0 < 6.1.82-1	6.1.82-1
linux	linux_kernel	>= 0 < 6.7.7-1	6.7.7-1
linux	linux_kernel	>= 0 < 6.7.7-1	6.7.7-1
linux	linux_kernel	>= 0 < 5.4.0-181.201	5.4.0-181.201
linux	linux_kernel	>= 0 < 5.15.0-106.116	5.15.0-106.116
linux	linux_kernel	>= 2.6.29 < 4.19.307	4.19.307
linux	linux_kernel	>= 4.20.0 < 5.4.269	5.4.269
linux	linux_kernel	>= 5.11.0 < 5.15.149	5.15.149
linux	linux_kernel	>= 5.16.0 < 6.1.79	6.1.79
linux	linux_kernel	>= 5.5.0 < 5.10.210	5.10.210
linux	linux_kernel	>= 6.2.0 < 6.6.18	6.6.18
linux	linux_kernel	>= 6.7.0 < 6.7.6	6.7.6

CISA ICS

Siemens SINEC OS

cisa_ics·2025-08-14

Siemens SINEC OS ICS Advisory ## Siemens SINEC OS Release DateAugust 14, 2025 Alert CodeICSA-25-226-15 Related topics: Industrial Control System Vulnerabilities, Industrial Control Systems As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global). View CSAF ## 1. EXECUTIVE SUMMARY - CVSS v3.1 9.1 - ATTENTION: Exploitable remotely/low attack complexity - Vendor: Siemens - Equipment: RUGGEDCOM, SCALANCE - Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-08-02·CVSS 7.0

CVE-2024-26711 [HIGH] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-07-19·CVSS 7.0

CVE-2024-26910 [HIGH] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-07-17·CVSS 7.0

CVE-2024-26714 [HIGH] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-07-16·CVSS 7.0

CVE-2024-26663 [HIGH] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-07-12·CVSS 7.0

CVE-2024-24861 [HIGH] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of

Ubuntu

Linux kernel (Intel IoTG) vulnerabilities

vendor_ubuntu·2024-06-11·CVSS 6.5

CVE-2024-26859 [MEDIUM] Linux kernel (Intel IoTG) vulnerabilities Title: Linux kernel (Intel IoTG) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL poin

Ubuntu

Linux kernel (Intel IoTG) vulnerabilities

vendor_ubuntu·2024-05-28·CVSS 6.5

CVE-2023-52491 [MEDIUM] Linux kernel (Intel IoTG) vulnerabilities Title: Linux kernel (Intel IoTG) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial

Ubuntu

Linux kernel (AWS) vulnerabilities

vendor_ubuntu·2024-05-20·CVSS 6.5

CVE-2024-26592 [MEDIUM] Linux kernel (AWS) vulnerabilities Title: Linux kernel (AWS) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds r

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-05-15·CVSS 6.5

CVE-2023-52631 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vu

Ubuntu

Linux kernel (BlueField) vulnerabilities

vendor_ubuntu·2024-05-14·CVSS 5.5

CVE-2024-26636 [MEDIUM] Linux kernel (BlueField) vulnerabilities Title: Linux kernel (BlueField) vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Android drivers; - Hardware random number generator core; - GPU drivers; - Hardware monitoring drivers; - I2C subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Ne

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-05-07·CVSS 5.5

CVE-2023-52604 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Android drivers; - Hardware random number generator core; - GPU drivers; - Hardware monitoring drivers; - I2C subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Network driver

Ubuntu

Linux kernel vulnerabilities

vendor_ubuntu·2024-05-07·CVSS 6.5

CVE-2024-26645 [MEDIUM] Linux kernel vulnerabilities Title: Linux kernel vulnerabilities Summary: Several security issues were fixed in the Linux kernel. It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vu

Red Hat

kernel: signal epoll threads of self-work

vendor_redhat·2024-02-26·CVSS 5.5

CVE-2024-26606 [MEDIUM] CWE-20 kernel: signal epoll threads of self-work kernel: signal epoll threads of self-work In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. A flaw was found in the Linux kernel. This issue is in the binder subsystem. Statement: Red Hat

Debian

CVE-2024-26606: linux - In the Linux kernel, the following vulnerability has been resolved: binder: sig...

vendor_debian·2024·CVSS 5.5

CVE-2024-26606 [MEDIUM] CVE-2024-26606: linux - In the Linux kernel, the following vulnerability has been resolved: binder: sig... In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Scope: local bookworm: resolved (fixed in 6.1.82-1) bullseye: resolved (fixed in 5.10.216-1) forky: resolved (fixed in 6.7.7-1) sid: resolve

OSV

linux-oem-6.5 vulnerabilities

osv·2024-08-02·CVSS 7.0

CVE-2023-6270 [HIGH] linux-oem-6.5 vulnerabilities linux-oem-6.5 vulnerabilities It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Gui-Dong Han discovered that th

OSV

linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities

osv·2024-07-19·CVSS 7.0

CVE-2023-6270 [HIGH] linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities linux-aws-6.5, linux-lowlatency-hwe-6.5, linux-oracle-6.5, linux-starfive-6.5 vulnerabilities It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service

OSV

linux-hwe-6.5 vulnerabilities

osv·2024-07-17·CVSS 7.0

CVE-2023-6270 [HIGH] linux-hwe-6.5 vulnerabilities linux-hwe-6.5 vulnerabilities It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Gui-Dong Han discovered that th

OSV

linux-azure-6.5, linux-gcp-6.5 vulnerabilities

osv·2024-07-16·CVSS 7.0

CVE-2023-6270 [HIGH] linux-azure-6.5, linux-gcp-6.5 vulnerabilities linux-azure-6.5, linux-gcp-6.5 vulnerabilities It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Gui-Dong Han d

OSV

linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities

osv·2024-07-12·CVSS 7.0

CVE-2023-6270 [HIGH] linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities linux, linux-gcp, linux-nvidia-6.5, linux-raspi vulnerabilities It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151

OSV

linux-intel-iotg-5.15 vulnerabilities

osv·2024-06-11·CVSS 6.5

CVE-2023-47233 [MEDIUM] linux-intel-iotg-5.15 vulnerabilities linux-intel-iotg-5.15 vulnerabilities Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270) It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of ser

OSV

linux-intel-iotg vulnerabilities

osv·2024-05-28·CVSS 6.5

CVE-2023-47233 [MEDIUM] linux-intel-iotg vulnerabilities linux-intel-iotg vulnerabilities Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233) It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Inte

OSV

linux-aws, linux-aws-5.15 vulnerabilities

osv·2024-05-20·CVSS 6.5

CVE-2024-1151 [MEDIUM] linux-aws, linux-aws-5.15 vulnerabilities linux-aws, linux-aws-5.15 vulnerabilities It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a

OSV

linux-hwe-5.15, linux-raspi vulnerabilities

osv·2024-05-15·CVSS 6.5

CVE-2024-1151 [MEDIUM] linux-hwe-5.15, linux-raspi vulnerabilities linux-hwe-5.15, linux-raspi vulnerabilities It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201) Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause

OSV

linux-bluefield vulnerabilities

osv·2024-05-14·CVSS 5.5

CVE-2024-23849 [MEDIUM] linux-bluefield vulnerabilities linux-bluefield vulnerabilities Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Android drivers; - Hardware random number generator core; - GPU drivers; - Hardware monitoring drivers; - I2C subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - Network drivers; - PCI driver for MicroSemi Switchtec; - PHY drivers; - Ceph distrib

OSV

linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency

osv·2024-05-07·CVSS 6.5

[MEDIUM] linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15 vulnerabilities It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151) Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker coul

OSV

linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, lin

osv·2024-05-07·CVSS 5.5

CVE-2024-23849 [MEDIUM] linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, lin linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - Block layer subsystem; - Android drivers; - Hardware random

GHSA

GHSA-6pc7-4x73-wwc6: In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend

ghsa_unreviewed·2024-02-26

CVE-2024-26606 [MEDIUM] GHSA-6pc7-4x73-wwc6: In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work.

OSV

CVE-2024-26606: In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on

osv·2024-02-26·CVSS 5.5

CVE-2024-26606 [MEDIUM] CVE-2024-26606: In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work.

CVE-2024-26606: In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O…

Affected

CVSS provenance