Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-56724 State: PUBLISHED Published: 2024-12-29T11:30:01.641Z Last Updated: 2025-11-03T20:53:19.358Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ). Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Additiona
to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b7c7c400de85d915e0da7c2c363553a801c47349 - https://git.kernel.org/stable/c/c472b55cc0bc3df805db6a14f50a084884cf18ee - https://git.kernel.org/stable/c/da498e02c92e6d82df8001438dd583b90c570815 - https://git.kernel.org/stable/c/56acf415772ee7e10e448b371f52b249aa2d0f7b - https://git.kernel.org/stable/c/1b734ad0e33648c3988c6a37c2ac16c2d63eda06 - https://git.kernel.org/stable/c/2310f5336f32eac9ada2d59b965d578efe25c4bf - https://git.kernel.org/stable/c/5bc6d0da4a32fe34a
s://git.kernel.org/stable/c/2310f5336f32eac9ada2d59b965d578efe25c4bf - https://git.kernel.org/stable/c/5bc6d0da4a32fe34a9960de577e0b7de3454de0c - https://git.kernel.org/stable/c/9b79d59e6b2b515eb9a22bc469ef7b8f0904fc73
CVE ID: CVE-2024-56725 State: PUBLISHED Published: 2024-12-29T11:30:03.732Z Last Updated: 2025-11-03T20:53:20.739Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c Add error pointer check after calling otx2_mbox_get_rsp(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b94052830e3cd3be7141789a5ce6e62cf9f620a4 - https://git.kernel.org/stable/c/b99db02209ca4c2e2f53b82049ea3cbc82b54895 - https://git.kernel.org/stable/c/54e8b501b3ea9371e4a9aa639c75b681fa5680f0 - https://git.kernel.org/stable/c/6ee6c
54895 - https://git.kernel.org/stable/c/54e8b501b3ea9371e4a9aa639c75b681fa5680f0 - https://git.kernel.org/stable/c/6ee6cf42dc5230425cfce1ffefa5a8d8a99e6fce - https://git.kernel.org/stable/c/69297b0d3369488af259e3a7cf53d69157938ea1
CVE ID: CVE-2024-56726 State: PUBLISHED Published: 2024-12-29T11:30:04.820Z Last Updated: 2025-11-03T20:53:22.110Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c Add error pointer check after calling otx2_mbox_get_rsp(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a374e7e79fbdd7574bd89344447b0d4b91ba9801 - https://git.kernel.org/stable/c/856ad633e11869729be698df2287ecfe6ec31f27 - https://git.kernel.org/stable/c/c5a6c5af434671aea739a5a41c849819144f02c9 - https://git.kernel.org/stable/c/41f39f4c67
- https://git.kernel.org/stable/c/c5a6c5af434671aea739a5a41c849819144f02c9 - https://git.kernel.org/stable/c/41f39f4c67253f802809310be6846ff408c3c758 - https://git.kernel.org/stable/c/54abcec092616a4d01195355eb5d6036fb8fe363 - https://git.kernel.org/stable/c/ac9183023b6a9c09467516abd8aab04f9a2f9564
CVE ID: CVE-2024-56727 State: PUBLISHED Published: 2024-12-29T11:30:05.610Z Last Updated: 2025-11-03T20:53:23.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c Adding error pointer check after calling otx2_mbox_get_rsp(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8c9f8b35dc3d4ad8053a72bc0c5a7843591f6b75 - https://git.kernel.org/stable/c/c4eae7bac880edd88aaed6a8ec2997fa85e259c7 - https://git.kernel.org/stable/c/a479b3d7586e6f77f8337bbcac980eaf2d0a4029 - https://git.kernel.org/stable/c/e5
85e259c7 - https://git.kernel.org/stable/c/a479b3d7586e6f77f8337bbcac980eaf2d0a4029 - https://git.kernel.org/stable/c/e5e60f17d2462ef5c13db4d1a54eef5778fd2295 - https://git.kernel.org/stable/c/bd3110bc102ab6292656b8118be819faa0de8dd0
CVE ID: CVE-2024-56728 State: PUBLISHED Published: 2024-12-29T11:30:06.419Z Last Updated: 2025-11-03T20:53:26.521Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Add error pointer check after calling otx2_mbox_get_rsp(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ff9de1f2712cbca53da2e37d831eea7ffcb43b6 - https://git.kernel.org/stable/c/55c41b97001a09bb490ffa2e667e251d75d15ab1 - https://git.kernel.org/stable/c/05a6ce174c0c724e5914e1e5efd826bab8f382b4 - https://git.kernel.org/stable/c/c0f
5d15ab1 - https://git.kernel.org/stable/c/05a6ce174c0c724e5914e1e5efd826bab8f382b4 - https://git.kernel.org/stable/c/c0f64fd73b60aee85f88c270c9d714ead27a7b7a - https://git.kernel.org/stable/c/6cda142cee032b8fe65ee11f78721721c3988feb - https://git.kernel.org/stable/c/2db2194727b1f49a5096c1c3981adef1b7638733 - https://git.kernel.org/stable/c/e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c
CVE ID: CVE-2024-56729 State: PUBLISHED Published: 2024-12-29T11:30:07.181Z Last Updated: 2025-10-01T20:07:04.657Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid->tcon before performing network ops Avoid leaking a tcon ref when a lease break races with opening the cached directory. Processing the leak break might take a reference to the tcon in cached_dir_lease_break() and then fail to release the ref in cached_dir_offload_close, since cfid->tcon is still NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15 - https://
CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/625e2357c8fcfae6e66dcc667dc656fe390bab15 - https://git.kernel.org/stable/c/4b216c8f9c7d84ef7de33ca60b97e08e03ef3292 - https://git.kernel.org/stable/c/1b9ab6b648f89441c8a13cb3fd8ca83ffebc5262 - https://git.kernel.org/stable/c/c353ee4fb119a2582d0e011f66a76a38f5cf984d
CVE ID: CVE-2024-56730 State: PUBLISHED Published: 2024-12-29T11:30:07.876Z Last Updated: 2025-10-01T20:07:04.483Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/9p/usbg: fix handling of the failed kzalloc() memory allocation On the linux-next, next-20241108 vanilla kernel, the coccinelle tool gave the following error report: ./net/9p/trans_usbg.c:912:5-11: ERROR: allocation function on line 911 returns NULL not ERR_PTR on failure kzalloc() failure is fixed to handle the NULL return case on the memory exhaustion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2cdb416de8b5795
ustion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2cdb416de8b5795fd25fadcb69e1198b6df6d8cc - https://git.kernel.org/stable/c/ff1060813d9347e8c45c8b8cff93a4dfdb6726ad
CVE ID: CVE-2024-56731 State: PUBLISHED Published: 2025-06-24T03:37:42.327Z Last Updated: 2025-06-25T12:43:04.424Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: gogs Products: gogs Problem Types: CWE-552 Description: Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the
account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7 - https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9 - https://github.com/gogs/gogs/releases/tag/v0.13.3
CVE ID: CVE-2024-56732 State: PUBLISHED Published: 2024-12-27T20:01:50.275Z Last Updated: 2024-12-28T16:48:04.545Z Vendors: harfbuzz Products: harfbuzz Problem Types: CWE-122 Description: HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hb_cairo_glyphs_from_buffer function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-qmp9-xqm5-jh6m - https://github.com/harfbuzz/harfbuzz/commit/1767f99e2e2196c3fcae27db6d8b60098d3f6d26
CVE ID: CVE-2024-56733 State: PUBLISHED Published: 2024-12-30T16:46:37.661Z Last Updated: 2024-12-30T17:33:25.498Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: pglombardo Products: PasswordPusher Problem Types: CWE-384 Description: Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before this process, they can use the to
d invalidated upon logout, if an attacker manages to capture the session cookie before this process, they can use the token to gain unauthorized access to the user's session until the token expires or is manually cleared. This vulnerability hinges on the attacker's ability to access the session cookie during an active session, either through a man-in-the-middle attack, by exploiting another vulnerability like XSS, or via direct access to the victim's device. Although there is no direct resolution to this vulnerability, it is recommended to always use the latest version of Password Pusher to best mitigate risk. If self-hosting, ensure Password Pusher is hosted exclusively over SSL connections
assword Pusher to best mitigate risk. If self-hosting, ensure Password Pusher is hosted exclusively over SSL connections to encrypt traffic and prevent session cookies from being intercepted in transit. Additionally, implement best practices in local security to safeguard user systems, browsers, and data against unauthorized access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-4fwj-m62q-pp47
CVE ID: CVE-2024-56734 State: PUBLISHED Published: 2024-12-30T16:48:58.184Z Last Updated: 2024-12-30T17:36:51.332Z Vendors: better-auth Products: better-auth Problem Types: CWE-601 Description: Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links generated by the library. The verify email callback endpoint accepts a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect w
a `callbackURL` parameter. Unlike other verification methods, email verification only uses JWT to verify and redirect without proper validation of the target domain. The origin checker is bypassed in this scenario because it only checks for `POST` requests. An attacker can manipulate this parameter to redirect users to arbitrary URLs controlled by the attacker. Version 1.1.6 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/better-auth/better-auth/security/advisories/GHSA-8jhw-6pjj-8723 - https://github.com/better-auth/better-auth/commit/deb3d73aea90d0468d92723f4511542b593e522f
CVE ID: CVE-2024-56736 State: PUBLISHED Published: 2025-04-16T15:38:11.307Z Last Updated: 2025-04-16T18:03:38.561Z Vendors: Apache Software Foundation Products: Apache HertzBeat Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/kdzg36h9yxp0q0n4lhcfppxntjy8rj1x - https://lists.apache.org/thread/lwfhsllos1rx9v8k0yhl252cbpqpn0sv
CVE ID: CVE-2024-56737 State: PUBLISHED Published: 2024-12-29T00:00:00 Last Updated: 2024-12-31T18:17:21.967Z Vendors: GNU Products: GRUB2 Problem Types: CWE-122 Description: GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?66599
CVE ID: CVE-2024-56738 State: PUBLISHED Published: 2024-12-29T00:00:00 Last Updated: 2024-12-31T18:15:24.931Z Vendors: GNU Products: GRUB2 Problem Types: CWE-208 Description: GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for grub_crypto_memcmp and thus allows side-channel attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://savannah.gnu.org/bugs/?66603
CVE ID: CVE-2024-56739 State: PUBLISHED Published: 2024-12-29T11:30:08.512Z Last Updated: 2025-11-03T20:53:29.335Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware. When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, they will continually expire, may causing kernel softlockup. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
e, they will continually expire, may causing kernel softlockup. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/39ad0a1ae17b54509cd9e93dcd8cec16e7c12d3f - https://git.kernel.org/stable/c/44b3257ff705d63d5f00ef8ed314a0eeb7ec37f2 - https://git.kernel.org/stable/c/0d68e8514d9040108ff7d1b37ca71096674b6efe - https://git.kernel.org/stable/c/246f621d363988e7040f4546d20203dc713fa3e1 - https://git.kernel.org/stable/c/fde56535505dde3336df438e949ef4742b6d6d6e - https://git.kernel.org/stable/c/dd4b1cbcc916fad5d10c2662b62def9f05e453d4 - https://git.kernel.org/stable/c/a1f0b4af90cc18b10261ecde56c6a56b22c75bd1 - https://git.kernel.or
c2662b62def9f05e453d4 - https://git.kernel.org/stable/c/a1f0b4af90cc18b10261ecde56c6a56b22c75bd1 - https://git.kernel.org/stable/c/e77bce0a8c3989b4173c36f4195122bca8f4a3e1 - https://git.kernel.org/stable/c/e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d
CVE ID: CVE-2024-56740 State: PUBLISHED Published: 2024-12-29T11:30:09.180Z Last Updated: 2025-10-01T20:07:04.078Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs/localio: must clear res.replen in nfs_local_read_done Otherwise memory corruption can occur due to NFSv3 LOCALIO reads leaving garbage in res.replen: - nfs3_read_done() copies that into server->read_hdrsize; from there nfs3_proc_read_setup() copies it to args.replen in new requests. - nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages() which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf contains a ridiculous len. - This is copied to rq
() which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf contains a ridiculous len. - This is copied to rq_private_buf and xs_read_stream_request() eventually passes the kvec to sock_recvmsg() which receives incoming data into entirely the wrong place. This is easily reproduced with NFSv3 LOCALIO that is servicing reads when it is made to pivot back to using normal RPC. This switch back to using normal NFSv3 with RPC can occur for a few reasons but this issue was exposed with a test that stops and then restarts the NFSv3 server while LOCALIO is performing heavy read IO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/de5dac261eea
y read IO. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/de5dac261eeab99762bbdf7c20cee5d26ef4462e - https://git.kernel.org/stable/c/650703bc4ed3edf841e851c99ab8e7ba9e5262a3
CVE ID: CVE-2024-56741 State: REJECTED Published: 2024-12-29T11:30:09.843Z Last Updated: 2025-03-03T08:12:43.495Z Description: No description available.
CVE ID: CVE-2024-56742 State: PUBLISHED Published: 2024-12-29T11:30:10.538Z Last Updated: 2025-05-04T10:03:39.195Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages() Fix an unwind issue in mlx5vf_add_migration_pages(). If a set of pages is allocated but fails to be added to the SG table, they need to be freed to prevent a memory leak. Any pages successfully added to the SG table will be freed as part of mlx5vf_free_data_buffer(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/769fe4ce444b646b0bf6ac308de80686c730c7df - ht
es: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/769fe4ce444b646b0bf6ac308de80686c730c7df - https://git.kernel.org/stable/c/c44f1b2ddfa81c8d7f8e9b6bc76c427bc00e69d5 - https://git.kernel.org/stable/c/22e87bf3f77c18f5982c19ffe2732ef0c7a25f16
CVE ID: CVE-2024-56743 State: PUBLISHED Published: 2024-12-29T11:30:11.174Z Last Updated: 2025-10-01T20:07:03.949Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs_common: must not hold RCU while calling nfsd_file_put_local Move holding the RCU from nfs_to_nfsd_file_put_local to nfs_to_nfsd_net_put. It is the call to nfs_to->nfsd_serv_put that requires the RCU anyway (the puts for nfsd_file and netns were combined to avoid an extra indirect reference but that micro-optimization isn't possible now). This fixes xfstests generic/013 and it triggering: "Voluntary context switch within RCU read-side critical section!" [ 143.545738
s xfstests generic/013 and it triggering: "Voluntary context switch within RCU read-side critical section!" [ 143.545738] Call Trace: [ 143.546206] <TASK> [ 143.546625] ? show_regs+0x6d/0x80 [ 143.547267] ? __warn+0x91/0x140 [ 143.547951] ? rcu_note_context_switch+0x496/0x5d0 [ 143.548856] ? report_bug+0x193/0x1a0 [ 143.549557] ? handle_bug+0x63/0xa0 [ 143.550214] ? exc_invalid_op+0x1d/0x80 [ 143.550938] ? asm_exc_invalid_op+0x1f/0x30 [ 143.551736] ? rcu_note_context_switch+0x496/0x5d0 [ 143.552634] ? wakeup_preempt+0x62/0x70 [ 143.553358] __schedule+0xaa/0x1380 [ 143.554025] ? _raw_spin_unlock_irqrestore+0x12/0x40 [ 143.554958] ? try_to_wake_up+0x1fe/0x6b0 [ 143.555715] ? wake_up_process+0x
5] ? _raw_spin_unlock_irqrestore+0x12/0x40 [ 143.554958] ? try_to_wake_up+0x1fe/0x6b0 [ 143.555715] ? wake_up_process+0x19/0x20 [ 143.556452] schedule+0x2e/0x120 [ 143.557066] schedule_preempt_disabled+0x19/0x30 [ 143.557933] rwsem_down_read_slowpath+0x24d/0x4a0 [ 143.558818] ? xfs_efi_item_format+0x50/0xc0 [xfs] [ 143.559894] down_read+0x4e/0xb0 [ 143.560519] xlog_cil_commit+0x1b2/0xbc0 [xfs] [ 143.561460] ? _raw_spin_unlock+0x12/0x30 [ 143.562212] ? xfs_inode_item_precommit+0xc7/0x220 [xfs] [ 143.563309] ? xfs_trans_run_precommits+0x69/0xd0 [xfs] [ 143.564394] __xfs_trans_commit+0xb5/0x330 [xfs] [ 143.565367] xfs_trans_roll+0x48/0xc0 [xfs] [ 143.566262] xfs_defer_trans_roll+0x57/0x100 [xfs
_commit+0xb5/0x330 [xfs] [ 143.565367] xfs_trans_roll+0x48/0xc0 [xfs] [ 143.566262] xfs_defer_trans_roll+0x57/0x100 [xfs] [ 143.567278] xfs_defer_finish_noroll+0x27a/0x490 [xfs] [ 143.568342] xfs_defer_finish+0x1a/0x80 [xfs] [ 143.569267] xfs_bunmapi_range+0x4d/0xb0 [xfs] [ 143.570208] xfs_itruncate_extents_flags+0x13d/0x230 [xfs] [ 143.571353] xfs_free_eofblocks+0x12e/0x190 [xfs] [ 143.572359] xfs_file_release+0x12d/0x140 [xfs] [ 143.573324] __fput+0xe8/0x2d0 [ 143.573922] __fput_sync+0x1d/0x30 [ 143.574574] nfsd_filp_close+0x33/0x60 [nfsd] [ 143.575430] nfsd_file_free+0x96/0x150 [nfsd] [ 143.576274] nfsd_file_put+0xf7/0x1a0 [nfsd] [ 143.577104] nfsd_file_put_local+0x18/0x30 [nfsd] [ 143.57
6/0x150 [nfsd] [ 143.576274] nfsd_file_put+0xf7/0x1a0 [nfsd] [ 143.577104] nfsd_file_put_local+0x18/0x30 [nfsd] [ 143.578070] nfs_close_local_fh+0x101/0x110 [nfs_localio] [ 143.579079] __put_nfs_open_context+0xc9/0x180 [nfs] [ 143.580031] nfs_file_clear_open_context+0x4a/0x60 [nfs] [ 143.581038] nfs_file_release+0x3e/0x60 [nfs] [ 143.581879] __fput+0xe8/0x2d0 [ 143.582464] __fput_sync+0x1d/0x30 [ 143.583108] __x64_sys_close+0x41/0x80 [ 143.583823] x64_sys_call+0x189a/0x20d0 [ 143.584552] do_syscall_64+0x64/0x170 [ 143.585240] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 143.586185] RIP: 0033:0x7f3c5153efd7 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/
86185] RIP: 0033:0x7f3c5153efd7 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e6e3e97d64f50d9b6b1d62274f08925b1adbfc2 - https://git.kernel.org/stable/c/c840b8e1f039e90f97ca55525667eb961422f86c
CVE ID: CVE-2024-56744 State: PUBLISHED Published: 2024-12-29T11:30:11.816Z Last Updated: 2025-05-04T13:01:19.207Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential deadlock in f2fs_record_stop_reason() syzbot reports deadlock issue of f2fs as below: ====================================================== WARNING: possible circular locking dependency detected 6.12.0-rc3-syzkaller-00087-gc964ced77262 #0 Not tainted ------------------------------------------------------ kswapd0/79 is trying to acquire lock: ffff888011824088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_down_write fs/f2fs/f2fs.h:2199 [inline] ffff
ing to acquire lock: ffff888011824088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_down_write fs/f2fs/f2fs.h:2199 [inline] ffff888011824088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_record_stop_reason+0x52/0x1d0 fs/f2fs/super.c:4068 but task is already holding lock: ffff88804bd92610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x662/0x15c0 fs/f2fs/inode.c:842 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 (sb_internal#2){.+.+}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 percpu_down_read include/linux/percpu-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1716 [inline] sb_start_intwrite+0x4d/0x1c0 include/linux/fs.h:1
-rwsem.h:51 [inline] __sb_start_write include/linux/fs.h:1716 [inline] sb_start_intwrite+0x4d/0x1c0 include/linux/fs.h:1899 f2fs_evict_inode+0x662/0x15c0 fs/f2fs/inode.c:842 evict+0x4e8/0x9b0 fs/inode.c:725 f2fs_evict_inode+0x1a4/0x15c0 fs/f2fs/inode.c:807 evict+0x4e8/0x9b0 fs/inode.c:725 dispose_list fs/inode.c:774 [inline] prune_icache_sb+0x239/0x2f0 fs/inode.c:963 super_cache_scan+0x38c/0x4b0 fs/super.c:223 do_shrink_slab+0x701/0x1160 mm/shrinker.c:435 shrink_slab+0x1093/0x14d0 mm/shrinker.c:662 shrink_one+0x43b/0x850 mm/vmscan.c:4818 shrink_many mm/vmscan.c:4879 [inline] lru_gen_shrink_node mm/vmscan.c:4957 [inline] shrink_node+0x3799/0x3de0 mm/vmscan.c:5937 kswapd_shrink_node mm/vmscan.