CVE-2025-6966
published 2025-12-05CVE-2025-6966: NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.4th percentile
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | python-apt | < 0.9.3.5ubuntu3+esm5 | 0.9.3.5ubuntu3+esm5 |
| canonical | python-apt | >= 0 < 2.2.1.1 | 2.2.1.1 |
| canonical | python-apt | >= 0 < 3.1.0 | 3.1.0 |
| canonical | python-apt | >= 1.1 < 1.1.0~beta1ubuntu0.16.04.12+esm1 | 1.1.0~beta1ubuntu0.16.04.12+esm1 |
| canonical | python-apt | >= 1.6 < 1.6.6ubuntu0.1~esm1 | 1.6.6ubuntu0.1~esm1 |
| canonical | python-apt | >= 2.0 < 2.0.1ubuntu0.20.04.1+esm1 | 2.0.1ubuntu0.20.04.1+esm1 |
| canonical | python-apt | >= 2.4 < 2.4.0ubuntu4.1 | 2.4.0ubuntu4.1 |
| canonical | python-apt | >= 2.7 < 2.7.7ubuntu5.1 | 2.7.7ubuntu5.1 |
| canonical | python-apt | >= 3.0 < 3.0.0ubuntu1.1 | 3.0.0ubuntu1.1 |
| canonical | python-apt | >= 3.0 < 3.0.0ubuntu0.25.04.1 | 3.0.0ubuntu0.25.04.1 |
| debian | debian_linux | — | — |
| debian | python-apt | < python-apt 2.2.1.1 (bullseye) | python-apt 2.2.1.1 (bullseye) |
| ubuntu | python-apt | < 0.9.3.11 | 0.9.3.11 |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
| ubuntu | python-apt | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
python-apt regression
vendor_ubuntu·2026-01-15
CVE-2025-6966 python-apt regression
Title: python-apt regression
Summary: USN-7916-1 introduced a regression in python-apt
USN-7916-1 fixed a vulnerability in python-apt. The update had a
PEP 440 incompatible version. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Julian Andres Klode discovered that python-apt incorrectly handled
deb822 configuration files. An attacker could use this issue to cause
python-apt to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
python-apt vulnerability
vendor_ubuntu·2025-12-09
CVE-2025-6966 python-apt vulnerability
Title: python-apt vulnerability
Summary: python-apt could be made to crash if it opened a specially crafted
file.
Julian Andres Klode discovered that python-apt incorrectly handled
deb822 configuration files. An attacker could use this issue to cause
python-apt to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-apt: python-apt: NULL pointer dereference leads to local denial of service
vendor_redhat·2025-12-05·CVSS 6.9
CVE-2025-6966 [MEDIUM] CWE-476 python-apt: python-apt: NULL pointer dereference leads to local denial of service
python-apt: python-apt: NULL pointer dereference leads to local denial of service
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
A flaw was found in python-apt. This vulnerability allows a local attacker to cause a denial of service (Denial of Service) (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Statement: This vulnerability is rated Low for Red Hat as it requires a local attacker to provide a crafted deb822 file to trigger a NULL pointer dereference in `python-apt`, leading to a denial of service (process crash). Red Hat products that utilize `python-apt` and process untrusted deb822 files ma
Red Hat
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
vendor_redhat·2025-05-02·CVSS 5.5
CVE-2023-53066 [MEDIUM] CWE-476 kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
In the Linux kernel, the following vulnerability has been resolved:
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
We have to make sure that the info returned by the helper is valid
before using it.
Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
A flaw was found in the QED SR-IOV support in the Linux kernel. Improper validation of the value returned from the qed_iov_get_vf_info function can cause a NULL pointer dereference and result in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.6 via RHSA-2025:6966 [1].
[1]. https://access.redhat.com/errata/RHSA-2025:6966
Package: kernel (Red Hat Enterprise Linux 10) - Not
Debian
CVE-2025-6966: python-apt - NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux s...
vendor_debian·2025·CVSS 6.9
CVE-2025-6966 [MEDIUM] CVE-2025-6966: python-apt - NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux s...
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
Scope: local
bookworm: open
bullseye: resolved (fixed in 2.2.1.1)
forky: resolved (fixed in 3.1.0)
sid: resolved (fixed in 3.1.0)
trixie: open
OSV
CVE-2025-6966: NULL pointer dereference in TagSection
osv·2025-12-05·CVSS 6.9
CVE-2025-6966 [MEDIUM] CVE-2025-6966: NULL pointer dereference in TagSection
NULL pointer dereference in TagSection.keys() in python-apt on APT-based Linux systems allows a local attacker to cause a denial of service (process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
GHSA
GHSA-285f-828q-q7g5: NULL pointer dereference in TagSection
ghsa_unreviewed·2025-12-05
CVE-2025-6966 [MEDIUM] CWE-476 GHSA-285f-828q-q7g5: NULL pointer dereference in TagSection
NULL pointer dereference in TagSection.keys() in python-apt on APT-based
Linux systems allows a local attacker to cause a denial of service
(process crash) via a crafted deb822 file with a malformed non-UTF-8 key.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
bugzilla·2025-02-13·CVSS 7.7
CVE-2025-1272 [HIGH] CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
CVE-2025-1272 kernel: Secure Boot does not automatically enable kernel lockdown
The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned modules can be loaded, leading to execution of untrusted code breaking breaking any Secure Boot protection. This vulnerability affects only Fedora Linux.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-48873 kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
bugzilla·2025-01-11·CVSS 5.5
CVE-2024-48873 [MEDIUM] CVE-2024-48873 kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
CVE-2024-48873 kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
The return value of ieee80211_probereq_get() might be NULL, so check it
before using to avoid NULL pointer access.
Addresses-Coverity-ID: 1529805 ("Dereference null return value")
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025011120-CVE-2024-48873-75a9@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-56562 kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
bugzilla·2024-12-27·CVSS 5.5
CVE-2024-56562 [MEDIUM] CVE-2024-56562 kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
CVE-2024-56562 kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
In the Linux kernel, the following vulnerability has been resolved:
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
^^^ here check "init_dyn_addr"
i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...)
^^^^
free "dyn_addr"
Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr".
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122713-CVE-2024-56562-9fd5@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53203 kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
bugzilla·2024-12-27·CVSS 7.8
CVE-2024-53203 [HIGH] CVE-2024-53203 kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
CVE-2024-53203 kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
In the Linux kernel, the following vulnerability has been resolved:
usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
The "command" variable can be controlled by the user via debugfs. The
worry is that if con_index is zero then "&uc->ucsi->connector[con_index
- 1]" would be an array underflow.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122727-CVE-2024-53203-80fc@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-56602 kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
bugzilla·2024-12-27·CVSS 7.8
CVE-2024-56602 [HIGH] CVE-2024-56602 kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
CVE-2024-56602 kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
In the Linux kernel, the following vulnerability has been resolved:
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
sock_init_data() attaches the allocated sk object to the provided sock
object. If ieee802154_create() fails later, the allocated sk object is
freed, but the dangling pointer remains in the provided sock object, which
may allow use-after-free.
Clear the sk pointer in the sock object on error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122703-CVE-2024-56602-d030@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RH
Bugzilla
CVE-2024-56590 kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
bugzilla·2024-12-27·CVSS 5.5
CVE-2024-56590 [MEDIUM] CVE-2024-56590 kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
CVE-2024-56590 kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
This fixes not checking if skb really contains an ACL header otherwise
the code may attempt to access some uninitilized/invalid memory past the
valid skb->data.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122759-CVE-2024-56590-d4ba@gregkh/T
---
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122759-CVE-2024-56590-d4ba@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53146 kernel: NFSD: Prevent a potential integer overflow
bugzilla·2024-12-24·CVSS 5.5
CVE-2024-53146 [MEDIUM] CVE-2024-53146 kernel: NFSD: Prevent a potential integer overflow
CVE-2024-53146 kernel: NFSD: Prevent a potential integer overflow
In the Linux kernel, the following vulnerability has been resolved:
NFSD: Prevent a potential integer overflow
If the tag length is >= U32_MAX - 3 then the "length + 4" addition
can result in an integer overflow. Address this by splitting the
decoding into several steps so that decode_cb_compound4res() does
not have to perform arithmetic on the unsafe length value.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024122426-CVE-2024-53146-c503@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53134 kernel: pmdomain: imx93-blk-ctrl: correct remove path
bugzilla·2024-12-04·CVSS 5.5
CVE-2024-53134 [MEDIUM] CVE-2024-53134 kernel: pmdomain: imx93-blk-ctrl: correct remove path
CVE-2024-53134 kernel: pmdomain: imx93-blk-ctrl: correct remove path
In the Linux kernel, the following vulnerability has been resolved:
pmdomain: imx93-blk-ctrl: correct remove path
The check condition should be 'i onecell_data.num_domains', not
'bc->onecell_data.num_domains' which will make the look never finish
and cause kernel panic.
Also disable runtime to address
"imx93-blk-ctrl 4ac10000.system-controller: Unbalanced pm_runtime_enable!"
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024120451-CVE-2024-53134-cb0a@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53117 kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling
bugzilla·2024-12-02·CVSS 5.5
CVE-2024-53117 [MEDIUM] CVE-2024-53117 kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling
CVE-2024-53117 kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling
In the Linux kernel, the following vulnerability has been resolved:
virtio/vsock: Improve MSG_ZEROCOPY error handling
Add a missing kfree_skb() to prevent memory leaks.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024120250-CVE-2024-53117-145b@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53103 kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
bugzilla·2024-12-02·CVSS 7.8
CVE-2024-53103 [HIGH] CVE-2024-53103 kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
CVE-2024-53103 kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
In the Linux kernel, the following vulnerability has been resolved:
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
When hvs is released, there is a possibility that vsk->trans may not
be initialized to NULL, which could lead to a dangling pointer.
This issue is resolved by initializing vsk->trans to NULL.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024120230-CVE-2024-53103-b5ea@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53110 kernel: vp_vdpa: fix id_table array not null terminated error
bugzilla·2024-12-02·CVSS 5.5
CVE-2024-53110 [MEDIUM] CVE-2024-53110 kernel: vp_vdpa: fix id_table array not null terminated error
CVE-2024-53110 kernel: vp_vdpa: fix id_table array not null terminated error
In the Linux kernel, the following vulnerability has been resolved:
vp_vdpa: fix id_table array not null terminated error
Allocate one extra virtio_device_id as null terminator, otherwise
vdpa_mgmtdev_get_classes() may iterate multiple times and visit
undefined memory.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024120248-CVE-2024-53110-3bff@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53070 kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended
bugzilla·2024-11-19·CVSS 5.5
CVE-2024-53070 [MEDIUM] CVE-2024-53070 kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended
CVE-2024-53070 kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3: fix fault at system suspend if device was already runtime suspended
If the device was already runtime suspended then during system suspend
we cannot access the device registers else it will crash.
Also we cannot access any registers after dwc3_core_exit() on some
platforms so move the dwc3_enable_susphy() call to the top.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111933-CVE-2024-53070-6eea@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53082 kernel: virtio_net: Add hash_key_length check
bugzilla·2024-11-19·CVSS 7.1
CVE-2024-53082 [HIGH] CVE-2024-53082 kernel: virtio_net: Add hash_key_length check
CVE-2024-53082 kernel: virtio_net: Add hash_key_length check
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Add hash_key_length check
Add hash_key_length check in virtnet_probe() to avoid possible out of
bound errors when setting/reading the hash key.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111904-CVE-2024-53082-30c0@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53050 kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability
bugzilla·2024-11-19·CVSS 5.5
CVE-2024-53050 [MEDIUM] CVE-2024-53050 kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability
CVE-2024-53050 kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/hdcp: Add encoder check in hdcp2_get_capability
Add encoder check in intel_hdcp2_get_capability to avoid
null pointer error.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111927-CVE-2024-53050-b59c@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50282 kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
bugzilla·2024-11-19·CVSS 7.8
CVE-2024-50282 [HIGH] CVE-2024-50282 kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
CVE-2024-50282 kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()
Avoid a possible buffer overflow if size is larger than 4K.
(cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111943-CVE-2024-50282-1579@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-53074 kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal
bugzilla·2024-11-19·CVSS 5.5
CVE-2024-53074 [MEDIUM] CVE-2024-53074 kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal
CVE-2024-53074 kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't leak a link on AP removal
Release the link mapping resource in AP removal. This impacted devices
that do not support the MLD API (9260 and down).
On those devices, we couldn't start the AP again after the AP has been
already started and stopped.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111924-CVE-2024-53074-e49b@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50237 kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
bugzilla·2024-11-09·CVSS 5.5
CVE-2024-50237 [MEDIUM] CVE-2024-50237 kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
CVE-2024-50237 kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
Avoid potentially crashing in the driver because of uninitialized private data
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024110932-CVE-2024-50237-7073@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50235 kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free
bugzilla·2024-11-09·CVSS 7.8
CVE-2024-50235 [HIGH] CVE-2024-50235 kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free
CVE-2024-50235 kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: clear wdev->cqm_config pointer on free
When we free wdev->cqm_config when unregistering, we also
need to clear out the pointer since the same wdev/netdev
may get re-registered in another network namespace, then
destroyed later, running this code again, which results in
a double-free.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024110931-CVE-2024-50235-14eb@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50189 kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
bugzilla·2024-11-08·CVSS 5.5
CVE-2024-50189 [MEDIUM] CVE-2024-50189 kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
CVE-2024-50189 kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
In the Linux kernel, the following vulnerability has been resolved:
HID: amd_sfh: Switch to device-managed dmam_alloc_coherent()
Using the device-managed version allows to simplify clean-up in probe()
error path.
Additionally, this device-managed ensures proper cleanup, which helps to
resolve memory errors, page faults, btrfs going read-only, and btrfs
disk corruption.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024110851-CVE-2024-50189-48c8@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50109 kernel: md/raid10: fix null ptr dereference in raid10_size()
bugzilla·2024-11-05·CVSS 5.5
CVE-2024-50109 [MEDIUM] CVE-2024-50109 kernel: md/raid10: fix null ptr dereference in raid10_size()
CVE-2024-50109 kernel: md/raid10: fix null ptr dereference in raid10_size()
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix null ptr dereference in raid10_size()
In raid10_run() if raid10_set_queue_limits() succeed, the return value
is set to zero, and if following procedures failed raid10_run() will
return zero while mddev->private is still NULL, causing null ptr
dereference in raid10_size().
Fix the problem by only overwrite the return value if
raid10_set_queue_limits() failed.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024110554-CVE-2024-50109-b93c@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50101 kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
bugzilla·2024-11-05·CVSS 5.5
CVE-2024-50101 [MEDIUM] CVE-2024-50101 kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
CVE-2024-50101 kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
Previously, the domain_context_clear() function incorrectly called
pci_for_each_dma_alias() to set up context entries for non-PCI devices.
This could lead to kernel hangs or other unexpected behavior.
Add a check to only call pci_for_each_dma_alias() for PCI devices. For
non-PCI devices, domain_context_clear_one() is called directly.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024110526-CVE-2024-50101-d1bb@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966
Bugzilla
CVE-2024-49928 kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
bugzilla·2024-10-21·CVSS 7.1
CVE-2024-49928 [HIGH] CVE-2024-49928 kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
CVE-2024-49928 kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: avoid reading out of bounds when loading TX power FW elements
Because the loop-expression will do one more time before getting false from
cond-expression, the original code copied one more entry size beyond valid
region.
Fix it by moving the entry copy to loop-body.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102125-CVE-2024-49928-05d6@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49860 kernel: ACPI: sysfs: validate return type of _STR method
bugzilla·2024-10-21·CVSS 7.1
CVE-2024-49860 [HIGH] CVE-2024-49860 kernel: ACPI: sysfs: validate return type of _STR method
CVE-2024-49860 kernel: ACPI: sysfs: validate return type of _STR method
In the Linux kernel, the following vulnerability has been resolved:
ACPI: sysfs: validate return type of _STR method
Only buffer objects are valid return values of _STR.
If something else is returned description_show() will access invalid
memory.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102124-CVE-2024-49860-2a48@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50055 kernel: driver core: bus: Fix double free in driver API bus_register()
bugzilla·2024-10-21·CVSS 7.8
CVE-2024-50055 [HIGH] CVE-2024-50055 kernel: driver core: bus: Fix double free in driver API bus_register()
CVE-2024-50055 kernel: driver core: bus: Fix double free in driver API bus_register()
In the Linux kernel, the following vulnerability has been resolved:
driver core: bus: Fix double free in driver API bus_register()
For bus_register(), any error which happens after kset_register() will
cause that @priv are freed twice, fixed by setting @priv with NULL after
the first free.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102134-CVE-2024-50055-7d1f@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-47710 kernel: sock_map: Add a cond_resched() in sock_hash_free()
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-47710 [MEDIUM] CVE-2024-47710 kernel: sock_map: Add a cond_resched() in sock_hash_free()
CVE-2024-47710 kernel: sock_map: Add a cond_resched() in sock_hash_free()
In the Linux kernel, the following vulnerability has been resolved:
sock_map: Add a cond_resched() in sock_hash_free()
Several syzbot soft lockup reports all have in common sock_hash_free()
If a map with a large number of buckets is destroyed, we need to yield
the cpu when needed.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102118-CVE-2024-47710-3882@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49862 kernel: powercap: intel_rapl: Fix off by one in get_rpi()
bugzilla·2024-10-21·CVSS 7.1
CVE-2024-49862 [HIGH] CVE-2024-49862 kernel: powercap: intel_rapl: Fix off by one in get_rpi()
CVE-2024-49862 kernel: powercap: intel_rapl: Fix off by one in get_rpi()
In the Linux kernel, the following vulnerability has been resolved:
powercap: intel_rapl: Fix off by one in get_rpi()
The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have
NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >=
to prevent an off by one access.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102125-CVE-2024-49862-b995@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49968 kernel: ext4: filesystems without casefold feature cannot be mounted with siphash
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-49968 [MEDIUM] CVE-2024-49968 kernel: ext4: filesystems without casefold feature cannot be mounted with siphash
CVE-2024-49968 kernel: ext4: filesystems without casefold feature cannot be mounted with siphash
In the Linux kernel, the following vulnerability has been resolved:
ext4: filesystems without casefold feature cannot be mounted with siphash
When mounting the ext4 filesystem, if the default hash version is set to
DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-49968-ce10@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-47737 kernel: nfsd: call cache_put if xdr_reserve_space returns NULL
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-47737 [MEDIUM] CVE-2024-47737 kernel: nfsd: call cache_put if xdr_reserve_space returns NULL
CVE-2024-47737 kernel: nfsd: call cache_put if xdr_reserve_space returns NULL
In the Linux kernel, the following vulnerability has been resolved:
nfsd: call cache_put if xdr_reserve_space returns NULL
If not enough buffer space available, but idmap_lookup has triggered
lookup_fn which calls cache_get and returns successfully. Then we
missed to call cache_put here which pairs with cache_get.
Reviwed-by: Jeff Layton
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102108-CVE-2024-47737-b77e@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49851 kernel: tpm: Clean up TPM space after command failure
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-49851 [MEDIUM] CVE-2024-49851 kernel: tpm: Clean up TPM space after command failure
CVE-2024-49851 kernel: tpm: Clean up TPM space after command failure
In the Linux kernel, the following vulnerability has been resolved:
tpm: Clean up TPM space after command failure
tpm_dev_transmit prepares the TPM space before attempting command
transmission. However if the command fails no rollback of this
preparation is done. This can result in transient handles being leaked
if the device is subsequently closed with no further commands performed.
Fix this by flushing the space in the event of command transmission
failure.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102152-CVE-2024-49851-edd9@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHS
Bugzilla
CVE-2024-50027 kernel: thermal: core: Free tzp copy along with the thermal zone
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-50027 [MEDIUM] CVE-2024-50027 kernel: thermal: core: Free tzp copy along with the thermal zone
CVE-2024-50027 kernel: thermal: core: Free tzp copy along with the thermal zone
In the Linux kernel, the following vulnerability has been resolved:
thermal: core: Free tzp copy along with the thermal zone
The object pointed to by tz->tzp may still be accessed after being
freed in thermal_zone_device_unregister(), so move the freeing of it
to the point after the removal completion has been completed at which
it cannot be accessed any more.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102130-CVE-2024-50027-91e1@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49971 kernel: drm/amd/display: Increase array size of dummy_boolean
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-49971 [MEDIUM] CVE-2024-49971 kernel: drm/amd/display: Increase array size of dummy_boolean
CVE-2024-49971 kernel: drm/amd/display: Increase array size of dummy_boolean
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Increase array size of dummy_boolean
[WHY]
dml2_core_shared_mode_support and dml_core_mode_support access the third
element of dummy_boolean, i.e. hw_debug5 = &s->dummy_boolean[2], when
dummy_boolean has size of 2. Any assignment to hw_debug5 causes an
OVERRUN.
[HOW]
Increase dummy_boolean's array size to 3.
This fixes 2 OVERRUN issues reported by Coverity.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102133-CVE-2024-49971-ad07@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:696
Bugzilla
CVE-2024-49962 kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-49962 [MEDIUM] CVE-2024-49962 kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
CVE-2024-49962 kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
ACPICA commit 4d4547cf13cca820ff7e0f859ba83e1a610b9fd0
ACPI_ALLOCATE_ZEROED() may fail, elements might be NULL and will cause
NULL pointer dereference later.
[ rjw: Subject and changelog edits ]
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102132-CVE-2024-49962-8d16@gregkh/T
---
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102132-CVE-2024-49962-8d16@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https:
Bugzilla
CVE-2024-49975 kernel: uprobes: fix kernel info leak via "[uprobes]" vma
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-49975 [MEDIUM] CVE-2024-49975 kernel: uprobes: fix kernel info leak via "[uprobes]" vma
CVE-2024-49975 kernel: uprobes: fix kernel info leak via "[uprobes]" vma
In the Linux kernel, the following vulnerability has been resolved:
uprobes: fix kernel info leak via "[uprobes]" vma
xol_add_vma() maps the uninitialized page allocated by __create_xol_area()
into userspace. On some architectures (x86) this memory is readable even
without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ,
although this doesn't really matter, debugger can read this memory anyway.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102134-CVE-2024-49975-4533@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50009 kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-50009 [MEDIUM] CVE-2024-50009 kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
CVE-2024-50009 kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value
cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it
and return in case of error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102109-CVE-2024-50009-1b62@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-49991 kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
bugzilla·2024-10-21·CVSS 7.8
CVE-2024-49991 [HIGH] CVE-2024-49991 kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
CVE-2024-49991 kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
Pass pointer reference to amdgpu_bo_unref to clear the correct pointer,
otherwise amdgpu_bo_unref clear the local variable, the original pointer
not set to NULL, this could cause use-after-free bug.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102137-CVE-2024-49991-59d4@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-50064 kernel: zram: free secondary algorithms names
bugzilla·2024-10-21·CVSS 5.5
CVE-2024-50064 [MEDIUM] CVE-2024-50064 kernel: zram: free secondary algorithms names
CVE-2024-50064 kernel: zram: free secondary algorithms names
In the Linux kernel, the following vulnerability has been resolved:
zram: free secondary algorithms names
We need to kfree() secondary algorithms names when reset zram device that
had multi-streams, otherwise we leak memory.
[[email protected]: kfree(NULL) is legal]
Link: https://lkml.kernel.org/r/[email protected]
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102136-CVE-2024-50064-33d1@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46806 kernel: drm/amdgpu: Fix the warning division or modulo by zero
bugzilla·2024-09-27·CVSS 5.5
CVE-2024-46806 [MEDIUM] CVE-2024-46806 kernel: drm/amdgpu: Fix the warning division or modulo by zero
CVE-2024-46806 kernel: drm/amdgpu: Fix the warning division or modulo by zero
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix the warning division or modulo by zero
Checks the partition mode and returns an error for an invalid mode.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024092709-CVE-2024-46806-2cc7@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46835 kernel: drm/amdgpu: Fix smatch static checker warning
bugzilla·2024-09-27·CVSS 5.5
CVE-2024-46835 [MEDIUM] CVE-2024-46835 kernel: drm/amdgpu: Fix smatch static checker warning
CVE-2024-46835 kernel: drm/amdgpu: Fix smatch static checker warning
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix smatch static checker warning
adev->gfx.imu.funcs could be NULL
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024092753-CVE-2024-46835-4f99@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46805 kernel: drm/amdgpu: fix the waring dereferencing hive
bugzilla·2024-09-27·CVSS 5.5
CVE-2024-46805 [MEDIUM] CVE-2024-46805 kernel: drm/amdgpu: fix the waring dereferencing hive
CVE-2024-46805 kernel: drm/amdgpu: fix the waring dereferencing hive
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix the waring dereferencing hive
Check the amdgpu_hive_info *hive that maybe is NULL.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024092709-CVE-2024-46805-b06a@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46819 kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4
bugzilla·2024-09-27·CVSS 5.5
CVE-2024-46819 [MEDIUM] CVE-2024-46819 kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4
CVE-2024-46819 kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
if ras_manager obj null, don't print NBIO err data
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024092712-CVE-2024-46819-d958@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46724 kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
bugzilla·2024-09-18·CVSS 7.1
CVE-2024-46724 [HIGH] CVE-2024-46724 kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
CVE-2024-46724 kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
Check the fb_channel_number range to avoid the array out-of-bounds
read error
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091835-CVE-2024-46724-02f5@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46723 kernel: drm/amdgpu: fix ucode out-of-bounds read warning
bugzilla·2024-09-18·CVSS 7.1
CVE-2024-46723 [HIGH] CVE-2024-46723 kernel: drm/amdgpu: fix ucode out-of-bounds read warning
CVE-2024-46723 kernel: drm/amdgpu: fix ucode out-of-bounds read warning
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix ucode out-of-bounds read warning
Clear warning that read ucode[] may out-of-bounds.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091834-CVE-2024-46723-6726@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46722 kernel: drm/amdgpu: fix mc_data out-of-bounds read warning
bugzilla·2024-09-18·CVSS 7.1
CVE-2024-46722 [HIGH] CVE-2024-46722 kernel: drm/amdgpu: fix mc_data out-of-bounds read warning
CVE-2024-46722 kernel: drm/amdgpu: fix mc_data out-of-bounds read warning
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix mc_data out-of-bounds read warning
Clear warning that read mc_data[i-1] may out-of-bounds.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091834-CVE-2024-46722-34b3@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46725 kernel: drm/amdgpu: Fix out-of-bounds write warning
bugzilla·2024-09-18·CVSS 7.8
CVE-2024-46725 [HIGH] CVE-2024-46725 kernel: drm/amdgpu: Fix out-of-bounds write warning
CVE-2024-46725 kernel: drm/amdgpu: Fix out-of-bounds write warning
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix out-of-bounds write warning
Check the ring type value to fix the out-of-bounds
write warning
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091835-CVE-2024-46725-af49@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-46747 kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
bugzilla·2024-09-18·CVSS 7.1
CVE-2024-46747 [HIGH] CVE-2024-46747 kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
CVE-2024-46747 kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
In the Linux kernel, the following vulnerability has been resolved:
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024091837-CVE-2024-46747-f489@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-43884 kernel: Bluetooth: MGMT: Add error handling to pair_device()
bugzilla·2024-08-26·CVSS 5.5
CVE-2024-43884 [MEDIUM] CVE-2024-43884 kernel: Bluetooth: MGMT: Add error handling to pair_device()
CVE-2024-43884 kernel: Bluetooth: MGMT: Add error handling to pair_device()
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Add error handling to pair_device()
hci_conn_params_add() never checks for a NULL value and could lead to a NULL
pointer dereference causing a crash.
Fixed by adding error handling in the function.
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024082621-CVE-2024-43884-43fa@gregkh/T
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata/RHSA-2025:6966
Bugzilla
CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
bugzilla·2024-06-02·CVSS 7.8
CVE-2024-36880 [HIGH] CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
CVE-2024-36880 kernel: Bluetooth: qca: add missing firmware sanity checks
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: qca: add missing firmware sanity checks
The Linux kernel CVE team has assigned CVE-2024-36880 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024053031-CVE-2024-36880-c961@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2284281]
---
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-36880 is: SKIP No affected files built, so skip this CVE NO - - unknown (where first YES/NO value means if related sources built).
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 ht
Bugzilla
CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
bugzilla·2024-05-01·CVSS 7.8
CVE-2024-27008 [HIGH] CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
CVE-2024-27008 kernel: drm: nv04: Fix out of bounds access
In the Linux kernel, the following vulnerability has been resolved:
drm: nv04: Fix out of bounds access
The Linux kernel CVE team has assigned CVE-2024-27008 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050148-CVE-2024-27008-5964@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2278284]
---
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-27008 is: SKIP No affected files built, so skip this CVE NO - - unknown (where first YES/NO value means if related sources built).
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:6966 https://access.redhat.com/errata
2025-12-05
Published