Linux Kernel vulnerabilities

CVE-2021-47517 [HIGH] CWE-416 CVE-2021-47517: In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operati In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame ethtool operations could still be performed, which might end up in unwanted or undefined behavi

CVE-2024-27395 [HIGH] CWE-416 CVE-2024-27395: In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will

CVE-2024-53106 [HIGH] CWE-787 CVE-2024-53106: In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in ima_ In the Linux kernel, the following vulnerability has been resolved: ima: fix buffer overrun in ima_eventdigest_init_common Function ima_eventdigest_init() calls ima_eventdigest_init_common() with HASH_ALGO__LAST which is then used to access the array hash_digest_size[] leading to buffer overrun. Have a conditional statement to handle this.

CVE-2024-26748 [HIGH] CWE-415 CVE-2024-26748: In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double f In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833 spin_lock(&priv_dev->lock); 834 } 835 836 if (request->buf == priv_dev->zlp_buf) 837 cdns3_g

CVE-2026-23193 [HIGH] CWE-416 CVE-2026-23193: In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-af In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Similar to the connection usage count logic, the waiter signaled by complete() (e.g., in the sess

CVE-2022-3170 [HIGH] CWE-125 CVE-2022-3170: An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.

CVE-2024-35949 [HIGH] CWE-787 CVE-2024-35949: In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure that WRITTEN i In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure that WRITTEN is set on all metadata blocks We previously would call btrfs_check_leaf() if we had the check integrity code enabled, which meant that we could only run the extended leaf checks if we had WRITTEN set on the header flags. This leaves a gap in our checkin

CVE-2022-50185 [HIGH] CWE-787 CVE-2022-50185: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffe In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after th

CVE-2024-57850 [HIGH] CWE-787 CVE-2024-57850: In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to pre

CVE-2021-47485 [HIGH] CWE-120 CVE-2021-47485: In the Linux kernel, the following vulnerability has been resolved: IB/qib: Protect from buffer ove In the Linux kernel, the following vulnerability has been resolved: IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields Overflowing either addrlimit or bytes_togo can allow userspace to trigger a buffer overflow of kernel memory. Check for overflows in all the places doing math on user controlled buffers.

CVE-2022-2978 [HIGH] CWE-416 CVE-2022-2978: A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers funct A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

CVE-2009-3621 [MEDIUM] CWE-400 CVE-2009-3621: net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.

CVE-2024-42136 [HIGH] CWE-190 CVE-2024-42136: In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_cha In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33 [ 366.021089] -92233720

CVE-2022-48744 [HIGH] CWE-787 CVE-2022-48744: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflow In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (

CVE-2024-50067 [HIGH] CWE-787 CVE-2024-50067: In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds mem In the Linux kernel, the following vulnerability has been resolved: uprobe: avoid out-of-bounds memory access of fetching args Uprobe needs to fetch args into a percpu buffer, and then copy to ring buffer to avoid non-atomic context problem. Sometimes user-space strings, arrays can be very large, but the size of percpu buffer is only page size. And

CVE-2024-26895 [HIGH] CWE-416 CVE-2024-26895: In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-aft In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilc_netdev_cleanup currently triggers a KASAN warning, which can be observed on interface registration error path, or simply by removing the module/unbinding device from driver: echo spi0.1 > /sys/bus/spi

CVE-2024-38569 [HIGH] CWE-129 CVE-2024-38569: In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi_pcie: Fix ou In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi_pcie: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of eve

CVE-2024-38568 [HIGH] CWE-129 CVE-2024-38568: In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix o In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: hns3: Fix out-of-bound access when valid event group The perf tool allows users to create event groups through following cmd [1], but the driver does not check whether the array index is out of bounds when writing data to the event_group array. If the number of ev

CVE-2024-36906 [HIGH] CWE-787 CVE-2024-36906: In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack poison We found below OOB crash: [ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c

CVE-2024-50047 [HIGH] CWE-416 CVE-2024-50047: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async d In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption (large read) crashes with a slab-use-after-free way down in the crypto API. Reproducer: # mount.cifs -o ...,seal,esize=1 //srv/share /mnt # dd if=/mnt/largefile of=/dev/null ... [ 194.196391] ========================