Linux Kernel vulnerabilities

CVE-2024-36934 [HIGH] CWE-787 CVE-2024-36934: In the Linux kernel, the following vulnerability has been resolved: bna: ensure the copied buf is N In the Linux kernel, the following vulnerability has been resolved: bna: ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when usin

CVE-2021-47541 [HIGH] CWE-416 CVE-2021-47541: In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-f In the Linux kernel, the following vulnerability has been resolved: net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and tmp->tx_cq will be freed on the error path of mlx4_en_copy_priv(). After that mlx4_en_alloc_resources() is called and there is a dereference of

CVE-2023-52438 [HIGH] CWE-416 CVE-2023-52438: In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in s In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in shinker's callback The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock

CVE-2024-53057 [HIGH] CWE-416 CVE-2024-53057: In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_redu In the Linux kernel, the following vulnerability has been resolved: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdis

CVE-2024-26616 [HIGH] CWE-416 CVE-2024-26616: In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: avoid use-after-f In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned [BUG] There is a bug report that, on a ext4-converted btrfs, scrub leads to various problems, including: - "unable to find chunk map" errors BTRFS info (device vdb): scrub: started on devid 1 BTRFS critical (dev

CVE-2023-52469 [HIGH] CWE-416 CVE-2023-52469: In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains: kv_parse_power_table |-> kv_dpm_init |-

CVE-2022-49695 [HIGH] CWE-416 CVE-2022-49695: In the Linux kernel, the following vulnerability has been resolved: igb: fix a use-after-free issue In the Linux kernel, the following vulnerability has been resolved: igb: fix a use-after-free issue in igb_clean_tx_ring Fix the following use-after-free bug in igb_clean_tx_ring routine when the NIC is running in XDP mode. The issue can be triggered redirecting traffic into the igb NIC and then closing the device while the traffic is flowing. [ 73.

CVE-2022-49647 [HIGH] CWE-416 CVE-2022-49647: In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst no In the Linux kernel, the following vulnerability has been resolved: cgroup: Use separate src/dst nodes when preloading css_sets for migration Each cset (css_set) is pinned by its tasks. When we're moving tasks around across csets for a migration, we need to hold the source and destination csets to ensure that they don't go away while we're moving tas

CVE-2022-49667 [HIGH] CWE-416 CVE-2022-49667: In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free after 802.3ad slave unbind commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports r

CVE-2022-49287 [HIGH] CWE-416 CVE-2022-49287: In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING:

CVE-2022-49413 [HIGH] CWE-416 CVE-2022-49413: In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different cgroup (or in case of writeback just starts submitting bios associated with a different cgroup) bfq_merge_bio() can operate with stale cgroup information in bic. Thus the bio can be merged to

CVE-2023-52603 [HIGH] CWE-129 CVE-2023-52603: In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bound In the Linux kernel, the following vulnerability has been resolved: UBSAN: array-index-out-of-bounds in dtSplitRoot Syzkaller reported the following issue: oop0: detected capacity change from 0 to 32768 UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dtree.c:1971:9 index -2 is out of range for type 'struct dtslot [128]' CPU: 0 PID: 3613 Comm: syz-ex

CVE-2022-49261 [HIGH] CWE-125 CVE-2022-49261: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: add missing bound In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: add missing boundary check in vm_access A missing bounds check in vm_access() can lead to an out-of-bounds read or write in the adjacent memory area, since the len attribute is not validated before the memcpy later in the function, potentially hitting: [ 183.637831] BU

CVE-2022-49377 [HIGH] CWE-416 CVE-2022-49377: In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in In the Linux kernel, the following vulnerability has been resolved: blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns. So don

CVE-2024-39496 [HIGH] CWE-416 CVE-2024-39496: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation and then trigger a use-after-free on the device that was just replaced (source device of the replace operation). Th

CVE-2022-3176 [HIGH] CWE-416 CVE-2022-3176: There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is p

CVE-2023-52922 [HIGH] CWE-416 CVE-2023-52922: In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_s In the Linux kernel, the following vulnerability has been resolved: can: bcm: Fix UAF in bcm_proc_show() BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),

CVE-2024-40900 [HIGH] CWE-416 CVE-2024-40900: In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests fro In the Linux kernel, the following vulnerability has been resolved: cachefiles: remove requests from xarray during flushing requests Even with CACHEFILES_DEAD set, we can still read the requests, so in the following concurrency the request may be used after it has been freed: mount | daemon_thread1 | daemon_thread2 cachefiles_ondemand_init_object ca

CVE-2024-39510 [HIGH] CWE-416 CVE-2024-39510: In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after- In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() We got the following issue in a fuzz test of randomly issuing the restore command: BUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60 Read of size 8 at addr ffff888122e84088 by task

CVE-2021-4037 [HIGH] CVE-2021-4037: A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel th A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a scenario where a directory is SGID and belongs to a certain group and is writable by a user who is not a m