Linux Kernel vulnerabilities

CVE-2022-49622 [HIGH] CWE-416 CVE-2022-49622: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid skb In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid skb access on nf_stolen When verdict is NF_STOLEN, the skb might have been freed. When tracing is enabled, this can result in a use-after-free: 1. access to skb->nf_trace 2. access to skb->mark 3. computation of trace id 4. dump of packet payload To avoi

CVE-2022-49651 [HIGH] CWE-416 CVE-2022-49651: In the Linux kernel, the following vulnerability has been resolved: srcu: Tighten cleanup_srcu_stru In the Linux kernel, the following vulnerability has been resolved: srcu: Tighten cleanup_srcu_struct() GP checks Currently, cleanup_srcu_struct() checks for a grace period in progress, but it does not check for a grace period that has not yet started but which might start at any time. Such a situation could result in a use-after-free bug, so this co

CVE-2024-27018 [HIGH] CVE-2024-27018: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip c In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaround to reset conntrack for these packets. Jianbo Liu reports wa

CVE-2024-26884 [HIGH] CWE-119 CVE-2024-26884: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 3

CVE-2024-46828 [HIGH] CVE-2024-46828: In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated

CVE-2024-46849 [HIGH] CWE-416 CVE-2024-46849: In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is reallocated in 'meson_card_reallocate_links()', so move 'pad' pointer initialization after this function when memory is already reallocated. Kasan bug report: BUG: KASAN: slab-use-after-free in axg_card_add_link

CVE-2021-46999 [HIGH] CWE-416 CVE-2021-46999: In the Linux kernel, the following vulnerability has been resolved: sctp: do asoc update earlier in In the Linux kernel, the following vulnerability has been resolved: sctp: do asoc update earlier in sctp_sf_do_dupcook_a There's a panic that occurs in a few of envs, the call trace is as below: [] general protection fault, ... 0x29acd70f1000a: 0000 [#1] SMP PTI [] RIP: 0010:sctp_ulpevent_notify_peer_addr_change+0x4b/0x1fa [sctp] [] sctp_assoc_contr

CVE-2024-49924 [HIGH] CWE-416 CVE-2024-49924: In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct

CVE-2022-48892 [HIGH] CWE-415 CVE-2022-48892: In the Linux kernel, the following vulnerability has been resolved: sched/core: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: sched/core: Fix use-after-free bug in dup_user_cpus_ptr() Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems"), the setting and clearing of user_cpus_ptr are done under pi_lock for arm64 architecture. However, dup_user_cpus_ptr() accesses

CVE-2023-52669 [HIGH] CWE-787 CVE-2023-52669: In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer o In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.

CVE-2021-47194 [HIGH] CWE-665 CVE-2021-47194: In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanup cfg80211_stop_ap(), this leads to the initialization of in-use data. For

CVE-2023-52604 [HIGH] CWE-129 CVE-2023-52604: In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-s

CVE-2023-52599 [HIGH] CWE-129 CVE-2023-52599: In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bou In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt [Syz report] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 PID: 5065 Comm: syz-executor282 Not tainted 6.7.0-rc4-syzkaller-00009-gbee0e7762ad2 #0 Hardwa

CVE-2024-26625 [HIGH] CWE-416 CVE-2024-26625: In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at rele In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are mi

CVE-2023-1078 [HIGH] CWE-787 CVE-2023-1078: A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocop A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled b

CVE-2022-49087 [HIGH] CWE-416 CVE-2022-49087: In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix a race in rxrpc_exit In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix a race in rxrpc_exit_net() Current code can lead to the following race: CPU0 CPU1 rxrpc_exit_net() rxrpc_peer_keepalive_worker() if (rxnet->live) rxnet->live = false; del_timer_sync(&rxnet->peer_keepalive_timer); timer_reduce(&rxnet->peer_keepalive_timer, jiffies + del

CVE-2024-46746 [HIGH] CWE-416 CVE-2024-46746: In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I

CVE-2023-52775 [HIGH] CWE-787 CVE-2023-52775: In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid data corruption In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid data corruption caused by decline We found a data corruption issue during testing of SMC-R on Redis applications. The benchmark has a low probability of reporting a strange error as shown below. "Error: Protocol error, got "\xe2" as reply type byte" Finally, we found

CVE-2021-46938 [HIGH] CWE-415 CVE-2021-46938: In the Linux kernel, the following vulnerability has been resolved: dm rq: fix double free of blk_m In the Linux kernel, the following vulnerability has been resolved: dm rq: fix double free of blk_mq_tag_set in dev remove after table load fails When loading a device-mapper table for a request-based mapped device, and the allocation/initialization of the blk_mq_tag_set for the device fails, a following device remove will cause a double free. E.g.

CVE-2021-47639 [HIGH] CWE-416 CVE-2021-47639: In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots w In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed page after returning from the unmap operation. Most notably, the TDP MMU doesn't zap invalid r