Linux Kernel vulnerabilities

CVE-2021-47576 [HIGH] CWE-416 CVE-2021-47576: In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() In resp_mode_select() sanity check the block descriptor len to avoid UAF. BUG: KASAN: use-after-free in resp_mode_select+0xa4c/0xb40 drivers/scsi/scsi_debug.c:2509 Read of size 1 at addr ffff888026670f50 by

CVE-2023-52772 [HIGH] CWE-416 CVE-2023-52772: In the Linux kernel, the following vulnerability has been resolved: af_unix: fix use-after-free in In the Linux kernel, the following vulnerability has been resolved: af_unix: fix use-after-free in unix_stream_read_actor() syzbot reported the following crash [1] After releasing unix socket lock, u->oob_skb can be changed by another thread. We must temporarily increase skb refcount to make sure this other thread will not free the skb under us. [1]

CVE-2023-52751 [HIGH] CWE-416 CVE-2023-52751: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2_query_info_compound() The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options 'multichannel,max_channels=2,vers=3.1.1,mfsymlinks,noperm' BUG: KASAN: slab-use-after-free

CVE-2021-47061 [HIGH] CWE-416 CVE-2021-47061: In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU If allocating a new instance of an I/O bus fails when unregistering a device, wait to destroy the device until after all readers are guaranteed to see the new null bus. Destroying devices before the bus is nulli

CVE-2024-26782 [HIGH] CWE-415 CVE-2024-26782: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socke In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same value as the original one: as a consequence, on program exit it's possible to observe the fol

CVE-2023-52591 [HIGH] CVE-2023-52591: In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching rename In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change reiserfs rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem.

CVE-2023-52452 [HIGH] CWE-665 CVE-2023-52452: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit sta In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocated_stack, but

CVE-2024-56658 [HIGH] CWE-416 CVE-2024-56658: In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' f In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dst_destroy [1] Issue is in xfrm6_net_init() and xfrm4_net_init() : They copy xfrm[46]_dst_ops_template into net->xfrm.xfrm[46]_dst_ops. But net structure might be freed before all the dst

CVE-2024-26622 [HIGH] CWE-416 CVE-2024-26622: In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in to In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->io_sem is held. Otherwise, concurrent write() requests can cause use-after-free-write and dou

CVE-2021-39698 [HIGH] CVE-2021-39698: In aio_poll_complete_work of aio In aio_poll_complete_work of aio.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-185125206References: Upstream kernel

CVE-2024-56551 [HIGH] CWE-416 CVE-2024-56551: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab afte In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147 [ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0

CVE-2024-53156 [HIGH] CWE-129 CVE-2024-53156: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check fo In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworke

CVE-2024-50226 [HIGH] CWE-416 CVE-2024-50226: In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, p In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use-after-free, permit out-of-order decoder shutdown In support of investigating an initialization failure report [1], cxl_test was updated to register mock memory-devices after the mock root-port/bus device had been registered. That led to cxl_test crashing with a use-

CVE-2024-47691 [HIGH] CWE-416 CVE-2024-47691: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-fr In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread() syzbot reports a f2fs bug as below: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_report+0xe8/0x550 mm/kasan/report.c:491 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan

CVE-2024-26961 [HIGH] CWE-416 CVE-2024-26961: In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resour In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing

CVE-2024-26995 [HIGH] CWE-193 CVE-2024-26995: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the P In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one. When doing the pow

CVE-2024-56570 [HIGH] CVE-2024-56570: In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.

CVE-2024-42271 [HIGH] CWE-416 CVE-2024-42271: In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of severing the path (or it is already removed / never existed). This needs to be done with ato

CVE-2021-4439 [HIGH] CWE-129 CVE-2021-4439: In the Linux kernel, the following vulnerability has been resolved: isdn: cpai: check ctr->cnr to a In the Linux kernel, the following vulnerability has been resolved: isdn: cpai: check ctr->cnr to avoid array index out of bound The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp. __module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num); Durin

CVE-2021-47549 [HIGH] CWE-416 CVE-2021-47549: In the Linux kernel, the following vulnerability has been resolved: sata_fsl: fix UAF in sata_fsl_p In the Linux kernel, the following vulnerability has been resolved: sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl When the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux, a bug is reported: BUG: Unable to handle kernel data access on read at 0x80000800805b502c Oops: Kernel access of bad area, sig: 11 [#1] NIP [c000000000