Linux Kernel vulnerabilities

CVE-2022-49170 [HIGH] CWE-129 CVE-2022-49170: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image - Reproduce tested on kernel

CVE-2024-50230 [HIGH] CWE-787 CVE-2024-50230: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to m In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported that in directory operations after nilfs2 detects filesystem corruption and degrades to read-only, __block_write_begin_int(), which is called to prepare block writes, may fail the BUG_ON check for accesses

CVE-2024-41092 [HIGH] CWE-416 CVE-2024-41092: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines: [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence ... [414.068

CVE-2024-42284 [HIGH] CWE-754 CVE-2024-42284: In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value fro In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address.

CVE-2024-49884 [HIGH] CWE-416 CVE-2024-49884: In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free i In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() We hit the following use-after-free: BUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40 CPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirt

CVE-2024-46800 [HIGH] CWE-416 CVE-2024-46800: In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free i In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen, leading to the similar use-after-free as Commi

CVE-2024-40956 [HIGH] CWE-416 CVE-2024-40956: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible U In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list Use list_for_each_entry_safe() to allow iterating through the list and deleting the entry in the iteration process. The descriptor is freed via idxd_desc_complete() and there's a slight chance may cause issue for t

CVE-2021-47012 [HIGH] CWE-416 CVE-2021-47012: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix a use after free in siw_alloc_mr Our code analyzer reported a UAF. In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem st

CVE-2020-0466 [HIGH] CVE-2020-0466: In do_epoll_ctl and ep_loop_check_proc of eventpoll In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel

CVE-2022-48423 [HIGH] CWE-787 CVE-2022-48423: In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An o In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.

CVE-2024-26907 [HIGH] CWE-416 CVE-2024-26907: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source w In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source warning while accessing Eth segment ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start" at /var/lib/dkms/mlnx-ofed-kernel/5.8/build/drivers/infiniband/hw/mlx5/wr.c:131 (size 2) WAR

CVE-2022-49223 [HIGH] CWE-416 CVE-2022-49223: In the Linux kernel, the following vulnerability has been resolved: cxl/port: Hold port reference u In the Linux kernel, the following vulnerability has been resolved: cxl/port: Hold port reference until decoder release KASAN + DEBUG_KOBJECT_RELEASE reports a potential use-after-free in cxl_decoder_release() where it goes to reference its parent, a cxl_port, to free its id back to port->decoder_ida. BUG: KASAN: use-after-free in to_cxl_port+0x18/0

CVE-2022-49470 [HIGH] CWE-416 CVE-2022-49470: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix use-a In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event We should not access skb buffer data anymore after hci_recv_frame was called. [ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [

CVE-2022-49419 [HIGH] CWE-416 CVE-2022-49419: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup Commit b3c9a924aab6 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove") fixed a use-after-free error due the vesafb driver freeing the fb_info in the .remove handler instead of doing it in .fb_dest

CVE-2023-52707 [HIGH] CWE-416 CVE-2023-52707: In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free i In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, the polling waitqueue gets freed in the following path: do_rmdir cgroup_rmdir kernfs_drain_op

CVE-2024-50217 [HIGH] CWE-416 CVE-2024-50217: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of bl In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids() Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And f

CVE-2024-42105 [HIGH] CWE-416 CVE-2024-42105: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks Patch series "nilfs2: fix potential issues related to reserved inodes". This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's internal inode being exposed in the namespace on a corrupted filesystem, and a couple of fla

CVE-2024-56615 [HIGH] CWE-787 CVE-2024-56615: In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compare

CVE-2024-38556 [HIGH] CWE-129 CVE-2024-38556: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acqu In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be al

CVE-2021-47589 [HIGH] CWE-415 CVE-2021-47589: In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbv In the Linux kernel, the following vulnerability has been resolved: igbvf: fix double free in `igbvf_probe` In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims t