Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
9b27c8 x12: 0000000000000312 x11: 0000000000000106 x10: ffffaba8c4a0a7c8 x9 : ffffaba8c49b27c8 x8 : 00000000ffffefff x7 : ffffaba8c4a0a7c8 x6 : 80000000fffff000 x5 : 0000000000000107 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff3947c0eab3c0 Call trace: buginit+0x18/0x1000 [hello] do_one_initcall+0x80/0x1c8 do_init_module+0x60/0x218 load_module+0x1ba4/0x1d70 __do_sys_init_module+0x198/0x1d0 __arm64_sys_init_module+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f221bd58db0f6ca087ac0392284f6bce21f4f8ea - https:
- CVE Program Container: References: - https://git.kernel.org/stable/c/f221bd58db0f6ca087ac0392284f6bce21f4f8ea - https://git.kernel.org/stable/c/22469a0335a1a1a690349b58bcb55822457df81e - https://git.kernel.org/stable/c/461a760d578b2b2c2faac3040b6b7c77baf128f8 - https://git.kernel.org/stable/c/c1929c041a262a4a27265db8dce3619c92aa678c - https://git.kernel.org/stable/c/3fd487ffaa697ddb05af78a75aaaddabe71c52b0 - https://git.kernel.org/stable/c/9f2ad88f9b349554f64e4037ec185c84d7dd9c7d - https://git.kernel.org/stable/c/c27a2f7668e215c1ebbccd96fab27a220a93f1f7 - https://git.kernel.org/stable/c/ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f
CVE ID: CVE-2024-39489 State: PUBLISHED Published: 2024-07-10T07:14:08.988Z Last Updated: 2025-05-04T09:16:53.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix memleak in seg6_hmac_init_algo seg6_hmac_init_algo returns without cleaning up the previous allocations if one fails, so it's going to leak all that memory and the crypto tfms. Update seg6_hmac_exit to only free the memory when allocated, so we can reuse the code directly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/afd5730969aec960a2fee4e5ee839a6014643976 - https://git.kernel.o
Container: References: - https://git.kernel.org/stable/c/afd5730969aec960a2fee4e5ee839a6014643976 - https://git.kernel.org/stable/c/4a3fcf53725b70010d1cf869a2ba549fed6b8fb3 - https://git.kernel.org/stable/c/daf341e0a2318b813427d5a78788c86f4a7f02be - https://git.kernel.org/stable/c/61d31ac85b4572d11f8071855c0ccb4f32d76c0c - https://git.kernel.org/stable/c/599a5654215092ac22bfc453f4fd3959c55ea821 - https://git.kernel.org/stable/c/0e44d6cbe8de983470c3d2f978649783384fdcb6 - https://git.kernel.org/stable/c/f6a99ef4e056c20a138a95cc51332b2b96c8f383 - https://git.kernel.org/stable/c/efb9f4f19f8e37fde43dfecebc80292d179f56c6
CVE ID: CVE-2024-39490 State: PUBLISHED Published: 2024-07-10T07:14:09.667Z Last Updated: 2025-05-04T09:16:54.371Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix missing sk_buff release in seg6_input_core The seg6_input() function is responsible for adding the SRH into a packet, delegating the operation to the seg6_input_core(). This function uses the skb_cow_head() to ensure that there is sufficient headroom in the sk_buff for accommodating the link-layer header. In the event that the skb_cow_header() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in
ader() function fails, the seg6_input_core() catches the error but it does not release the sk_buff, which will result in a memory leak. This issue was introduced in commit af3b5158b89d ("ipv6: sr: fix BUG due to headroom too small after SRH push") and persists even after commit 7a3f5b0de364 ("netfilter: add netfilter hooks to SRv6 data plane"), where the entire seg6_input() code was refactored to deal with netfilter hooks. The proposed patch addresses the identified memory leak by requiring the seg6_input_core() function to release the sk_buff in the event that skb_cow_head() fails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.o
() fails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e8688218e38111ace457509d8f0cad75f79c1a7a - https://git.kernel.org/stable/c/8f1fc3b86eaea70be6abcae2e9aa7e7b99453864 - https://git.kernel.org/stable/c/f4df8c7670a73752201cbde215254598efdf6ce8 - https://git.kernel.org/stable/c/f5fec1588642e415a3d72e02140160661b303940 - https://git.kernel.org/stable/c/5447f9708d9e4c17a647b16a9cb29e9e02820bd9
CVE ID: CVE-2024-39491 State: PUBLISHED Published: 2024-07-10T07:14:10.314Z Last Updated: 2025-05-04T09:16:55.762Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). The call to cs_dsp_remove() was being done in the component unbind callback cs35l56_hda_unbind(). This meant that if the driver was unbound and then re-bound it would be using an uninitialized cs_dsp instance. It is best to in
nt that if the driver was unbound and then re-bound it would be using an uninitialized cs_dsp instance. It is best to initialize the cs_dsp instance in probe() so that it can return an error if it fails. The component binding API doesn't have any error handling so there's no way to handle a failure if cs_dsp was initialized in the bind. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 - https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 - https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e
CVE ID: CVE-2024-39492 State: PUBLISHED Published: 2024-07-10T07:14:10.967Z Last Updated: 2025-05-04T09:16:56.861Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown The return value of pm_runtime_get_sync() in cmdq_mbox_shutdown() will return 1 when pm runtime state is active, and we don't want to get the warning message in this case. So we change the return value < 0 for WARN_ON(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2d42a37a4518478f075ccf848242b4a50e313a46 - https://git.kerne
am Container: References: - https://git.kernel.org/stable/c/2d42a37a4518478f075ccf848242b4a50e313a46 - https://git.kernel.org/stable/c/747a69a119c469121385543f21c2d08562968ccc
CVE ID: CVE-2024-39493 State: PUBLISHED Published: 2024-07-10T07:18:39.443Z Last Updated: 2025-05-04T12:57:04.627Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak Using completion_done to determine whether the caller has gone away only works after a complete call. Furthermore it's still possible that the caller has not yet called wait_for_completion, resulting in another potential UAF. Fix this by making the caller use cancel_work_sync and then freeing the memory safely. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.or
safely. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0ce5964b82f212f4df6a9813f09a0b5de15bd9c8 - https://git.kernel.org/stable/c/6396b33e98c096bff9c253ed49c008247963492a - https://git.kernel.org/stable/c/a718b6d2a329e069b27d9049a71be5931e71d960 - https://git.kernel.org/stable/c/3fb4601e0db10d4fe25e46f3fa308d40d37366bd - https://git.kernel.org/stable/c/e7428e7e3fe94a5089dc12ffe5bc31574d2315ad - https://git.kernel.org/stable/c/c2d443aa1ae3175c13a665f3a24b8acd759ce9c3 - https://git.kernel.org/stable/c/d0fd124972724cce0d48b9865ce3e273ef69e246 - https://git.kernel.org/stable/c/d3b17c6d9dddc2db3670bc9be628b122416a3d26
CVE ID: CVE-2024-39494 State: PUBLISHED Published: 2024-07-12T12:20:30.348Z Last Updated: 2025-11-03T21:56:11.179Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on rename and the earlier value can be freed; there are conditions sufficient to stabilize it (->d_lock on dentry, ->d_lock on its parent, ->i_rwsem exclusive on the parent's inode, rename_lock), but none of those are met at any of the sites. Take a stable snapshot of the name instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org
nstead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/480afcbeb7aaaa22677d3dd48ec590b441eaac1a - https://git.kernel.org/stable/c/edf287bc610b18d7a9c0c0c1cb2e97b9348c71bb - https://git.kernel.org/stable/c/0b31e28fbd773aefb6164687e0767319b8199829 - https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4 - https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c - https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c - https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de
CVE ID: CVE-2024-39495 State: PUBLISHED Published: 2024-07-12T12:20:31.022Z Last Updated: 2025-11-03T21:56:12.660Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: greybus: Fix use-after-free bug in gb_interface_release due to race condition. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". Ho
ce_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/74cd0a421896b2e07eafe7da4275302bfecef201 - https://git.kernel.org/stable/c/2b6bb0b4abfd79b8698ee161bb73c0936a2aaf83 - https://git.kernel.org/stable/c/fb071f5c75d4b1c177824de74ee75f9dd34123b9 - https://git.kernel.org/stable/c/9a733d69a4a59c2d08620e6589d823c24be773dc - https://git.kernel.org/stable/c/0b8fba38bdfb848fac52e71270b2aa3538c996ea - https://git.kernel.org/stable/c/03ea2b129344152157418929f06726989efc0445 - https://git.kernel.org/stable/c/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce
CVE ID: CVE-2024-39496 State: PUBLISHED Published: 2024-07-12T12:20:31.669Z Last Updated: 2025-11-03T21:56:14.179Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation and then trigger a use-after-free on the device that was just replaced (source device of the replace operation). This happens because at btrfs_load_zone_info() we extract a device from the chunk map into a local variable and then use the device while not under the protection of the device replace rwsem.
the chunk map into a local variable and then use the device while not under the protection of the device replace rwsem. So if there's a device replace operation happening when we extract the device and that device is the source of the replace operation, we will trigger a use-after-free if before we finish using the device the replace operation finishes and frees the device. Fix this by enlarging the critical section under the protection of the device replace rwsem so that all uses of the device are done inside the critical section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/17765964703b88d8befd899f8501150bb7e07e43
ntainer: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/17765964703b88d8befd899f8501150bb7e07e43 - https://git.kernel.org/stable/c/092571ef9a812566c8f2c9038d9c2a64c49788d6 - https://git.kernel.org/stable/c/a0cc006f4214b87e70983c692e05bb36c59b5752 - https://git.kernel.org/stable/c/0090d6e1b210551e63cf43958dc7a1ec942cdde9
CVE ID: CVE-2024-39497 State: PUBLISHED Published: 2024-07-12T12:20:32.330Z Last Updated: 2025-11-03T21:56:15.676Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) Lack of check for copy-on-write (COW) mapping in drm_gem_shmem_mmap allows users to call mmap with PROT_WRITE and MAP_PRIVATE flag causing a kernel panic due to BUG_ON in vmf_insert_pfn_prot: BUG_ON((vma->vm_flags & VM_PFNMAP) && is_cow_mapping(vma->vm_flags)); Return -EINVAL early if COW mapping is detected. This bug affects all drm drivers using default shmem helpers. It can be reproduced by this simple
mapping is detected. This bug affects all drm drivers using default shmem helpers. It can be reproduced by this simple example: void *ptr = mmap(0, size, PROT_WRITE, MAP_PRIVATE, fd, mmap_offset); ptr[0] = 0; Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a508a102edf8735adc9bb73d37dd13c38d1a1b10 - https://git.kernel.org/stable/c/3ae63a8c1685e16958560ec08d30defdc5b9cca0 - https://git.kernel.org/stable/c/2219e5f97244b79c276751a1167615b9714db1b0 - https://git.kernel.org/stable/c/1b4a8b89bf6787090b56424d269bf84ba00c3263 - https://git.kernel.org/stable/c/03c71c42809ef4b17f5d874cdb2d3bf40e847b86 - https://git.kernel.org/st
d269bf84ba00c3263 - https://git.kernel.org/stable/c/03c71c42809ef4b17f5d874cdb2d3bf40e847b86 - https://git.kernel.org/stable/c/39bc27bd688066a63e56f7f64ad34fae03fbe3b8
CVE ID: CVE-2024-39498 State: PUBLISHED Published: 2024-07-12T12:20:32.980Z Last Updated: 2025-05-04T09:17:05.782Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 [Why] Commit: - commit 5aa1dfcdf0a4 ("drm/mst: Refactor the flow for payload allocation/removement") accidently overwrite the commit - commit 54d217406afe ("drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2") which cause regression. [How] Recover the original NULL fix and remove the unnecessary input parameter 'state' for drm_dp_add_payload_part2(). (cherry picked from commit 4545614c1d8da603e
ove the unnecessary input parameter 'state' for drm_dp_add_payload_part2(). (cherry picked from commit 4545614c1d8da603e57b60dd66224d81b6ffc305) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8e21de5f99b2368a5155037ce0aae8aaba3f5241 - https://git.kernel.org/stable/c/5a507b7d2be15fddb95bf8dee01110b723e2bcd9
CVE ID: CVE-2024-39499 State: PUBLISHED Published: 2024-07-12T12:20:33.658Z Last Updated: 2025-11-03T21:56:17.161Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in event_deliver() Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization. This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Only compile te
bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Only compile tested, no access to HW. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/58730dfbd4ae01c1b022b0d234a8bf8c02cdfb81 - https://git.kernel.org/stable/c/681967c4ff210e06380acf9b9a1b33ae06e77cbd - https://git.kernel.org/stable/c/f70ff737346744633e7b655c1fb23e1578491ff3 - https://git.kernel.org/stable/c/95ac3e773a1f8da83c4710a720fbfe80055aafae - https://git.kernel.org/stable/c/95bac1c8bedb362374ea1937b1d3e833e01174ee - https://git.kernel.org/stable/c/e293c6b38ac9029d76ff0d2a6b2d74131709a9a8 - https://git.kerne
374ea1937b1d3e833e01174ee - https://git.kernel.org/stable/c/e293c6b38ac9029d76ff0d2a6b2d74131709a9a8 - https://git.kernel.org/stable/c/757804e1c599af5d2a7f864c8e8b2842406ff4bb - https://git.kernel.org/stable/c/8003f00d895310d409b2bf9ef907c56b42a4e0f4
CVE ID: CVE-2024-39500 State: PUBLISHED Published: 2024-07-12T12:20:34.317Z Last Updated: 2025-11-03T21:56:18.691Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put sk_psock_get will return NULL if the refcount of psock has gone to 0, which will happen when the last call of sk_psock_put is done. However, sk_psock_drop may not have finished yet, so the close callback will still point to sock_map_close despite psock being NULL. This can be reproduced with a thread deleting an element from the sock map, while the second one creates a socket, adds it to the map and closes it
a thread deleting an element from the sock map, while the second one creates a socket, adds it to the map and closes it. That will trigger the WARN_ON_ONCE: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Modules linked in: CPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Code: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0
88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02 RSP: 0018:ffffc9000441fda8 EFLAGS: 00010293 RAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000 RDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0 RBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3 R10: dffffc0000000000 R11: fffffbfff25f36c4 R12: ffffffff89731840 R13: ffff88804b587000 R14: ffff88804b587000 R15: ffffffff89731870 FS: 000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000
0) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0 Call Trace: <TASK> unix_release+0x87/0xc0 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0xbe/0x240 net/socket.c:1421 __fput+0x42b/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb37d618070 Code: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff f
y_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb37d618070 Code: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31 f0 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c RSP: 002b:00007ffcd4a525d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070 RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Use sk_psock, which will only
0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Use sk_psock, which will only check that the pointer is not been set to NULL yet, which should only happen after the callbacks are restored. If, then, a reference can still be gotten, we may call sk_psock_stop and cancel psock->work. As suggested by Paolo Abeni, reorder the condition so the control flow is less convoluted. After that change, the reproducer does not trigger the WARN_ON_ONCE anymore. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d - https://git.kernel.org/stable/c/5eabdf17fe
- https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d - https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50 - https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017 - https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073 - https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0
CVE ID: CVE-2024-39501 State: REJECTED Published: 2024-07-12T12:20:34.980Z Last Updated: 2025-05-10T14:14:44.417Z Description: No description available.
CVE ID: CVE-2024-39502 State: PUBLISHED Published: 2024-07-12T12:20:35.635Z Last Updated: 2025-11-03T21:56:21.973Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether the .poll pointer is not NULL for enabling only the using queue' napi. Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't dis
Unused queues' napi will not be registered by netif_napi_add(), so the .poll pointer indicates NULL. But it couldn't distinguish whether the napi was unregistered or not because netif_napi_del() doesn't reset the .poll pointer to NULL. So, ionic_qcq_enable() calls napi_enable() for the queue, which was unregistered by netif_napi_del(). Reproducer: ethtool -L <interface name> rx 1 tx 1 combined 0 ethtool -L <interface name> rx 0 tx 0 combined 1 ethtool -L <interface name> rx 0 tx 0 combined 4 Splat looks like: kernel BUG at net/core/dev.c:6666! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_
] PREEMPT SMP NOPTI CPU: 3 PID: 1057 Comm: kworker/3:3 Not tainted 6.10.0-rc2+ #16 Workqueue: events ionic_lif_deferred_work [ionic] RIP: 0010:napi_enable+0x3b/0x40 Code: 48 89 c2 48 83 e2 f6 80 b9 61 09 00 00 00 74 0d 48 83 bf 60 01 00 00 00 74 03 80 ce 01 f0 4f RSP: 0018:ffffb6ed83227d48 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff97560cda0828 RCX: 0000000000000029 RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff97560cda0a28 RBP: ffffb6ed83227d50 R08: 0000000000000400 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: ffff97560ce3c1a0 R14: 0000000000000000 R15: ffff975613ba0a20 FS: 0000000000000000(0000) GS:ffff975d5f780000(0000) knlGS:000