Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35827 State: PUBLISHED Published: 2024-05-17T13:41:09.193Z Last Updated: 2025-05-04T09:06:16.892Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() The "controllen" variable is type size_t (unsigned long). Casting it to int could lead to an integer underflow. The check_add_overflow() function considers the type of the destination which is type int. If we add two positive values and the result cannot fit in an integer then that's counted as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an
as an overflow. However, if we cast "controllen" to an int and it turns negative, then negative values *can* fit into an int type so there is no overflow. Good: 100 + (unsigned long)-4 = 96 <-- overflow Bad: 100 + (int)-4 = 96 <-- no overflow I deleted the cast of the sizeof() as well. That's not a bug but the cast is unnecessary. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/868ec868616438df487b9e2baa5a99f8662cc47c - https://git.kernel.org/stable/c/59a534690ecc3af72c6ab121aeac1237a4adae66 - https://git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e - https://git.kernel.org/stable/c/b6563ad0d599110bd5cf
/git.kernel.org/stable/c/0c8c74bb59e7d77554016efc34c2d10376985e5e - https://git.kernel.org/stable/c/b6563ad0d599110bd5cf8f56c47d279c3ed796fe - https://git.kernel.org/stable/c/8ede3db5061bb1fe28e2c9683329aafa89d2b1b4
CVE ID: CVE-2024-35828 State: PUBLISHED Published: 2024-05-17T13:41:12.702Z Last Updated: 2025-05-04T09:06:18.510Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/96481624fb5a6319079fb5059e46dbce43a90186 - https://git.kernel.org/stab
er: References: - https://git.kernel.org/stable/c/96481624fb5a6319079fb5059e46dbce43a90186 - https://git.kernel.org/stable/c/bea9573c795acec5614d4ac2dcc7b3b684cea5bf - https://git.kernel.org/stable/c/f0dd27314c7afe34794c2aa19dd6f2d30eb23bc7 - https://git.kernel.org/stable/c/e888c4461e109f7b93c3522afcbbaa5a8fdf29d2 - https://git.kernel.org/stable/c/4d99d267da3415db2124029cb5a6d2d955ca43f9 - https://git.kernel.org/stable/c/da10f6b7918abd5b4bc5c9cb66f0fc6763ac48f3 - https://git.kernel.org/stable/c/d219724d4b0ddb8ec7dfeaed5989f23edabaf591 - https://git.kernel.org/stable/c/8e243ac649c10922a6b4855170eaefe4c5b3faab - https://git.kernel.org/stable/c/5f0e4aede01cb01fa633171f0533affd25328c3a
CVE ID: CVE-2024-35829 State: PUBLISHED Published: 2024-05-17T13:41:16.290Z Last Updated: 2025-05-04T09:06:19.759Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f2e80ac9344aebbff576453d5c0290b332e187ed - https://git.kernel.org/stable/c/746606d37d662c70ae1379fc658ee9c65f06880f - https://git.kernel.org/stable/c/f6d51a91b41704704e395de6839c667b0f810bbf - https://git.kernel.org/
9fc658ee9c65f06880f - https://git.kernel.org/stable/c/f6d51a91b41704704e395de6839c667b0f810bbf - https://git.kernel.org/stable/c/8e25c0ee5665e8a768b8e21445db1f86e9156eb7 - https://git.kernel.org/stable/c/4ab14eccf5578af1dd5668a5f2d771df27683cab - https://git.kernel.org/stable/c/ec6bb037e4a35fcbb5cd7bc78242d034ed893fcd - https://git.kernel.org/stable/c/04ae3eb470e52a3c41babe85ff8cee195e4dcbea
CVE ID: CVE-2024-35830 State: PUBLISHED Published: 2024-05-17T13:41:19.675Z Last Updated: 2025-05-04T09:06:21.297Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/17c2650de14842c25c569cbb2126c421489a3a24 - https://git.kernel.org/stable/c/daf21394f9898fb9f0698c3e50de08132d2164e6 - https://git.kernel.org/stable/c/610f20e5c
4 - https://git.kernel.org/stable/c/daf21394f9898fb9f0698c3e50de08132d2164e6 - https://git.kernel.org/stable/c/610f20e5cf35ca9c0992693cae0dd8643ce932e7 - https://git.kernel.org/stable/c/b8505a1aee8f1edc9d16d72ae09c93de086e2a1a - https://git.kernel.org/stable/c/8ba8db9786b55047df5ad3db3e01dd886687a77d - https://git.kernel.org/stable/c/edbb3226c985469a2f8eb69885055c9f5550f468 - https://git.kernel.org/stable/c/c915c46a25c3efb084c4f5e69a053d7f7a635496 - https://git.kernel.org/stable/c/4f1490a5d7a0472ee5d9f36547bc4ba46be755c7 - https://git.kernel.org/stable/c/87399f1ff92203d65f1febf5919429f4bb613a02
CVE ID: CVE-2024-35831 State: PUBLISHED Published: 2024-05-17T13:41:23.171Z Last Updated: 2025-05-04T12:55:53.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: Fix release of pinned pages when __io_uaddr_map fails Looking at the error path of __io_uaddr_map, if we fail after pinning the pages for any reasons, ret will be set to -EINVAL and the error handler won't properly release the pinned pages. I didn't manage to trigger it without forcing a failure, but it can happen in real life when memory is heavily fragmented. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://g
heavily fragmented. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0b6f39c175ba5f0ef72bdb3b9d2a06ad78621d62 - https://git.kernel.org/stable/c/712e2c8415f55a4a4ddaa98a430b87f624109f69 - https://git.kernel.org/stable/c/4d376d7ad62b6a8e8dfff56b559d9d275e5b9b3a - https://git.kernel.org/stable/c/67d1189d1095d471ed7fa426c7e384a7140a5dd7
CVE ID: CVE-2024-35832 State: PUBLISHED Published: 2024-05-17T13:48:20.877Z Last Updated: 2025-05-04T09:06:23.919Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bcachefs: kvfree bch_fs::snapshots in bch2_fs_snapshots_exit bch_fs::snapshots is allocated by kvzalloc in __snapshot_t_mut. It should be freed by kvfree not kfree. Or umount will triger: [ 406.829178 ] BUG: unable to handle page fault for address: ffffe7b487148008 [ 406.830676 ] #PF: supervisor read access in kernel mode [ 406.831643 ] #PF: error_code(0x0000) - not-present page [ 406.832487 ] PGD 0 P4D 0 [ 406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI [ 406.833512 ] CP
e(0x0000) - not-present page [ 406.832487 ] PGD 0 P4D 0 [ 406.832898 ] Oops: 0000 [#1] PREEMPT SMP PTI [ 406.833512 ] CPU: 2 PID: 1754 Comm: umount Kdump: loaded Tainted: G OE 6.7.0-rc7-custom+ #90 [ 406.834746 ] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 [ 406.835796 ] RIP: 0010:kfree+0x62/0x140 [ 406.836197 ] Code: 80 48 01 d8 0f 82 e9 00 00 00 48 c7 c2 00 00 00 80 48 2b 15 78 9f 1f 01 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 56 9f 1f 01 <48> 8b 50 08 48 89 c7 f6 c2 01 0f 85 b0 00 00 00 66 90 48 8b 07 f6 [ 406.837810 ] RSP: 0018:ffffb9d641607e48 EFLAGS: 00010286 [ 406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607d
P: 0018:ffffb9d641607e48 EFLAGS: 00010286 [ 406.838213 ] RAX: ffffe7b487148000 RBX: ffffb9d645200000 RCX: ffffb9d641607dc4 [ 406.838738 ] RDX: 000065bb00000000 RSI: ffffffffc0d88b84 RDI: ffffb9d645200000 [ 406.839217 ] RBP: ffff9a4625d00068 R08: 0000000000000001 R09: 0000000000000001 [ 406.839650 ] R10: 0000000000000001 R11: 000000000000001f R12: ffff9a4625d4da80 [ 406.840055 ] R13: ffff9a4625d00000 R14: ffffffffc0e2eb20 R15: 0000000000000000 [ 406.840451 ] FS: 00007f0a264ffb80(0000) GS:ffff9a4e2d500000(0000) knlGS:0000000000000000 [ 406.840851 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4: 00000000000006f0 [ 406.841464 ] Ca
CR0: 0000000080050033 [ 406.841125 ] CR2: ffffe7b487148008 CR3: 000000018c4d2000 CR4: 00000000000006f0 [ 406.841464 ] Call Trace: [ 406.841583 ] <TASK> [ 406.841682 ] ? __die+0x1f/0x70 [ 406.841828 ] ? page_fault_oops+0x159/0x470 [ 406.842014 ] ? fixup_exception+0x22/0x310 [ 406.842198 ] ? exc_page_fault+0x1ed/0x200 [ 406.842382 ] ? asm_exc_page_fault+0x22/0x30 [ 406.842574 ] ? bch2_fs_release+0x54/0x280 [bcachefs] [ 406.842842 ] ? kfree+0x62/0x140 [ 406.842988 ] ? kfree+0x104/0x140 [ 406.843138 ] bch2_fs_release+0x54/0x280 [bcachefs] [ 406.843390 ] kobject_put+0xb7/0x170 [ 406.843552 ] deactivate_locked_super+0x2f/0xa0 [ 406.843756 ] cleanup_mnt+0xba/0x150 [ 406.843917 ] task_work_run+0x59/
406.843552 ] deactivate_locked_super+0x2f/0xa0 [ 406.843756 ] cleanup_mnt+0xba/0x150 [ 406.843917 ] task_work_run+0x59/0xa0 [ 406.844083 ] exit_to_user_mode_prepare+0x197/0x1a0 [ 406.844302 ] syscall_exit_to_user_mode+0x16/0x40 [ 406.844510 ] do_syscall_64+0x4e/0xf0 [ 406.844675 ] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 406.844907 ] RIP: 0033:0x7f0a2664e4fb Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/56590678791119b9a655202e49898edfb9307271 - https://git.kernel.org/stable/c/369acf97d6fd5da620d053d0f1878ffe32eff555
CVE ID: CVE-2024-35833 State: PUBLISHED Published: 2024-05-17T13:48:24.319Z Last Updated: 2025-05-04T09:06:25.326Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA This dma_alloc_coherent() is undone neither in the remove function, nor in the error handling path of fsl_qdma_probe(). Switch to the managed version to fix both issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1c75fe450b5200c78f4a102a0eb8e15d8f1ccda8 - https://git.kernel.org/stable/c/ae6769ba51417c1c86fb645812d5bff455
g/stable/c/1c75fe450b5200c78f4a102a0eb8e15d8f1ccda8 - https://git.kernel.org/stable/c/ae6769ba51417c1c86fb645812d5bff455eee802 - https://git.kernel.org/stable/c/15eb996d7d13cb72a16389231945ada8f0fef2c3 - https://git.kernel.org/stable/c/25ab4d72eb7cbfa0f3d97a139a9b2bfcaa72dd59 - https://git.kernel.org/stable/c/5cd8a51517ce15edbdcea4fc74c4c127ddaa1bd6 - https://git.kernel.org/stable/c/198270de9d8eb3b5d5f030825ea303ef95285d24 - https://git.kernel.org/stable/c/3aa58cb51318e329d203857f7a191678e60bb714
CVE ID: CVE-2024-35834 State: PUBLISHED Published: 2024-05-17T14:02:19.184Z Last Updated: 2025-05-04T09:06:26.691Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce descriptor to XSK Rx queue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cce713664548284daf977739e7ff1cd59e84189c - https://git.kernel.org/stable/c/7b4d93d31aade99210d41cd9d4cbd2957c98bc8c - https://git.kernel.org/stable/c/269009893146c495f41e9572dd9319e787c2eba9
CVE ID: CVE-2024-35835 State: PUBLISHED Published: 2024-05-17T14:02:23.469Z Last Updated: 2025-05-04T09:06:28.425Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb62
richment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3d3ed8c152971dbe64c92c9ecb98fdb52abb629 - https://git.kernel.org/stable/c/2501afe6c4c9829d03abe9a368b83d9ea1b611b7 - https://git.kernel.org/stable/c/cf116d9c3c2aebd653c2dfab5b10c278e9ec3ee5 - https://git.kernel.org/stable/c/c57ca114eb00e03274dd38108d07a3750fa3c056 - https://git.kernel.org/stable/c/42876db001bbea7558e8676d1019f08f9390addb - https://git.kernel.org/stable/c/b21db3f1ab7967a81d6bbd328d28fe5a4c07a8a7 - https://git.kernel.org/stable/c/66cc521a739ccd5da057a1cb3d6346c6d0e7619b - https://git.kernel.org/stable/c/3c6d5189246f590e4e1f167991558bdb72a4738b
CVE ID: CVE-2024-35836 State: PUBLISHED Published: 2024-05-17T14:02:27.847Z Last Updated: 2025-05-04T09:06:30.191Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance of the same PCI device have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbin
llocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5050a5b9d8b4d3c6f7e376e07670e437db7ccf9c - https://git.kernel.org/stable/c/830ead5fb0c5855ce4d70ba2ed4a673b5f1e7d9b
CVE ID: CVE-2024-35837 State: PUBLISHED Published: 2024-05-17T14:02:32.070Z Last Updated: 2025-05-04T09:06:31.831Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/83f99138bf3b396f761600ab488054396fb5768f - https://git.kernel.org/stable/c/af47faa6d3328406038b731794e7cf508c71affa - https://git.kernel.or
600ab488054396fb5768f - https://git.kernel.org/stable/c/af47faa6d3328406038b731794e7cf508c71affa - https://git.kernel.org/stable/c/cec65f09c47d8c2d67f2bcad6cf05c490628d1ec - https://git.kernel.org/stable/c/938729484cfa535e9987ed0f86f29a2ae3a8188b - https://git.kernel.org/stable/c/dc77f6ab5c3759df60ff87ed24f4d45df0f3b4c4 - https://git.kernel.org/stable/c/9f538b415db862e74b8c5d3abbccfc1b2b6caa38
CVE ID: CVE-2024-35838 State: PUBLISHED Published: 2024-05-17T14:02:36.410Z Last Updated: 2025-05-04T09:06:33.165Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential sta-link leak When a station is allocated, links are added but not set to valid yet (e.g. during connection to an AP MLD), we might remove the station without ever marking links valid, and leak them. Fix that. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/49aaeb8c539b1633b3bd7c2df131ec578aa1eae1 - https://git.kernel.org/stable/c/587c5892976108674bbe61a8ff659de27931
stable/c/49aaeb8c539b1633b3bd7c2df131ec578aa1eae1 - https://git.kernel.org/stable/c/587c5892976108674bbe61a8ff659de279318034 - https://git.kernel.org/stable/c/e04bf59bdba0fa45d52160be676114e16be855a9 - https://git.kernel.org/stable/c/b01a74b3ca6fd51b62c67733ba7c3280fa6c5d26
CVE ID: CVE-2024-35839 State: PUBLISHED Published: 2024-05-17T14:27:30.524Z Last Updated: 2025-05-04T09:06:34.423Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: replace physindev with physinif in nf_bridge_info An skb can be added to a neigh->arp_queue while waiting for an arp reply. Where original skb's skb->dev can be different to neigh's neigh->dev. For instance in case of bridging dnated skb from one veth to another, the skb would be added to a neigh->arp_queue of the bridge. As skb->dev can be reset back to nf_bridge->physindev and used, and as there is no explicit mechanism that prevents this physindev
v can be reset back to nf_bridge->physindev and used, and as there is no explicit mechanism that prevents this physindev from been freed under us (for instance neigh_flush_dev doesn't cleanup skbs from different device's neigh queue) we can crash on e.g. this stack: arp_process neigh_update skb = __skb_dequeue(&neigh->arp_queue) neigh_resolve_output(..., skb) ... br_nf_dev_xmit br_nf_pre_routing_finish_bridge_slow skb->dev = nf_bridge->physindev br_handle_frame_finish Let's use plain ifindex instead of net_device link. To peek into the original net_device we will use dev_get_by_index_rcu(). Thus either we get device and are safe to use it or we don't get it and drop skb. Additional Analyst N
t_by_index_rcu(). Thus either we get device and are safe to use it or we don't get it and drop skb. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7ae19ee81ca56b13c50a78de6c47d5b8fdc9d97b - https://git.kernel.org/stable/c/9325e3188a9cf3f69fc6f32af59844bbc5b90547 - https://git.kernel.org/stable/c/544add1f1cfb78c3dfa3e6edcf4668f6be5e730c - https://git.kernel.org/stable/c/9874808878d9eed407e3977fd11fee49de1e1d86
CVE ID: CVE-2024-35840 State: PUBLISHED Published: 2024-05-17T14:27:31.166Z Last Updated: 2025-05-04T09:06:35.802Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() subflow_finish_connect() uses four fields (backup, join_id, thmac, none) that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set in mptcp_parse_option() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/413b913507326972135d2977975dbff8b7f2c453 - https://git.kernel.org/stable/c/51e4cb032d49ce094605f27e45eabebc0408893c - http
3b913507326972135d2977975dbff8b7f2c453 - https://git.kernel.org/stable/c/51e4cb032d49ce094605f27e45eabebc0408893c - https://git.kernel.org/stable/c/ad3e8f5c3d5c53841046ef7a947c04ad45a20721 - https://git.kernel.org/stable/c/76e8de7273a22a00d27e9b8b7d4d043d6433416a - https://git.kernel.org/stable/c/be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb
CVE ID: CVE-2024-35841 State: PUBLISHED Published: 2024-05-17T14:27:31.822Z Last Updated: 2025-05-04T09:06:37.059Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in
ay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways. What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we ha
sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86 - https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8 - https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9
CVE ID: CVE-2024-35842 State: PUBLISHED Published: 2024-05-17T14:27:32.476Z Last Updated: 2025-05-04T09:06:38.687Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: sof-common: Add NULL check for normal_link string It's not granted that all entries of struct sof_conn_stream declare a `normal_link` (a non-SOF, direct link) string, and this is the case for SoCs that support only SOF paths (hence do not support both direct and SOF usecases). For example, in the case of MT8188 there is no normal_link string in any of the sof_conn_stream entries and there will be more drivers doing that in the future. To avoid possible
string in any of the sof_conn_stream entries and there will be more drivers doing that in the future. To avoid possible NULL pointer KPs, add a NULL check for `normal_link`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cad471227a37c0c7c080bfc9ed01b53750e82afe - https://git.kernel.org/stable/c/b1d3db6740d0997ffc6e5a0d96ef7cbd62b35fdd - https://git.kernel.org/stable/c/cde6ca5872bf67744dffa875a7cb521ab007b7ef - https://git.kernel.org/stable/c/e3b3ec967a7d93b9010a5af9a2394c8b5c8f31ed
CVE ID: CVE-2024-35843 State: PUBLISHED Published: 2024-05-17T14:40:10.747Z Last Updated: 2025-05-04T09:06:39.871Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Use device rbtree in iopf reporting path The existing I/O page fault handler currently locates the PCI device by calling pci_get_domain_bus_and_slot(). This function searches the list of all PCI devices until the desired device is found. To improve lookup efficiency, replace it with device_rbtree_find() to search the device within the probed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with
ed device rbtree. The I/O page fault is initiated by the device, which does not have any synchronization mechanism with the software to ensure that the device stays in the probed device tree. Theoretically, a device could be released by the IOMMU subsystem after device_rbtree_find() and before iopf_get_dev_fault_param(), which would cause a use-after-free problem. Add a mutex to synchronize the I/O page fault reporting path and the IOMMU release device path. This lock doesn't introduce any performance overhead, as the conflict between I/O page fault reporting and device releasing is very rare. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://git.kerne
easing is very rare. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15 - https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a