Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
the race occurs: T1:Smmu device probe T2: Client device probe really_probe() arm_smmu_device_probe() iommu_device_register() really_probe() platform_dma_configure() of_dma_configure() of_dma_configure_id() of_iommu_configure() iommu_probe_device() iommu_init_device() arm_smmu_probe_device() arm_smmu_get_by_fwnode() driver_find_device_by_fwnode() driver_find_device() next_device() klist_next() /* null ptr assigned to smmu */ /* null ptr dereference while smmu->streamid_mask */ driver_bound() klist_add_tail() When this null smmu pointer is dereferenced later in arm_smmu_probe_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to th
e_device, the device crashes. Fix this by deferring the probe of the client device until the smmu device has bound to the arm smmu driver. [will: Add comment] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c2527d07c7e9cda2c6165d5edccf74752baac1b0 - https://git.kernel.org/stable/c/dc02407ea952e20c544a078a6be2e6f008327973 - https://git.kernel.org/stable/c/f8f794f387ad21c4696e5cd0626cb6f8a5f6aea5 - https://git.kernel.org/stable/c/4a9485918a042e3114890dfbe19839a1897f8b2c - https://git.kernel.org/stable/c/5018696b19bc6c021e934a8a59f4b1dd8c0ac9f8 - https://git.kernel.org/stable/c/229e6ee43d2a160a1592b83aad620d6027084aad
CVE ID: CVE-2024-56569 State: PUBLISHED Published: 2024-12-27T14:23:12.462Z Last Updated: 2025-11-03T20:49:40.437Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix regression with module command in stack_trace_filter When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod command causes a null pointer dereference. While commit 0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter") has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash. Additional Analyst Notes: - CISA ADP Vulnric
ue, it left a corner case unhandled, which still results in a kernel crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/43ca32ce12888fb0eeb2d74dfc558dea60d3473e - https://git.kernel.org/stable/c/5dabb7af57bc72308a6e2e81a5dd756eef283803 - https://git.kernel.org/stable/c/885109aa0c70639527dd6a65c82e63c9ac055e3d - https://git.kernel.org/stable/c/7ae27880de3482e063fcc1f72d9a298d0d391407 - https://git.kernel.org/stable/c/8a92dc4df89c50bdb26667419ea70e0abbce456e - https://git.kernel.org/stable/c/19cacabdd5a8487ae566cbecb4d03bcb038a067e - https://git.kernel.org/stable/c/45af52e7d3b8560f21d139b3759735eead8b1653
CVE ID: CVE-2024-56570 State: PUBLISHED Published: 2024-12-27T14:23:13.273Z Last Updated: 2025-11-03T20:49:43.264Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/f9248e2f73fb4afe08324485e98c815ac084d166 - https://git.kernel.org/stable/c/5f86e79c0b2287ffdabe6c
it.kernel.org/stable/c/f9248e2f73fb4afe08324485e98c815ac084d166 - https://git.kernel.org/stable/c/5f86e79c0b2287ffdabe6c1b305a36c4e0f40fe3 - https://git.kernel.org/stable/c/749eac5a6687ec99116e0691d0d71225254654e3 - https://git.kernel.org/stable/c/ff43d008bbf9b27ada434d6455f039a5ef6cee53 - https://git.kernel.org/stable/c/065bf5dd21639f80e68450de16bda829784dbb8c - https://git.kernel.org/stable/c/72014e7745cc8250bb8f27bd78694dfd3f1b5773 - https://git.kernel.org/stable/c/c8b359dddb418c60df1a69beea01d1b3322bfe83
CVE ID: CVE-2024-56571 State: REJECTED Published: 2024-12-27T14:23:14.200Z Last Updated: 2025-02-13T15:21:36.580Z Description: No description available.
CVE ID: CVE-2024-56572 State: PUBLISHED Published: 2024-12-27T14:23:15.298Z Last Updated: 2025-11-03T20:49:45.324Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here. To mitigate this, free the buffer when allegro_alloc_buffer fails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cf642904be39ae0d441dbdfa8f485e0a46260be4 - https://git.kernel.org/stable/c/74a65313578b
https://git.kernel.org/stable/c/cf642904be39ae0d441dbdfa8f485e0a46260be4 - https://git.kernel.org/stable/c/74a65313578b35e1239966adfa7ac2bdd60caf00 - https://git.kernel.org/stable/c/64f72a738864b506ab50b4a6cb3ce3c3e04b71af - https://git.kernel.org/stable/c/17e5613666209be4e5be1f1894f1a6014a8a0658 - https://git.kernel.org/stable/c/6712a28a4f923ffdf51cff267ad05a634ee1babc - https://git.kernel.org/stable/c/891b5790bee8fc6ddba17874dd87a646128d0b99 - https://git.kernel.org/stable/c/0f514068fbc5d4d189c817adc7c4e32cffdc2e47
CVE ID: CVE-2024-56573 State: PUBLISHED Published: 2024-12-27T14:23:16.231Z Last Updated: 2025-05-04T09:58:40.379Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. cmdline refers to the pool allocation that should be freed when cleaning up after a failure, so pass this instead to free_pool(). References: - https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a - https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf - https://git
09bd0994d216d60589ec67f8b11376a - https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf - https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847
CVE ID: CVE-2024-56574 State: PUBLISHED Published: 2024-12-27T14:23:17.177Z Last Updated: 2025-11-03T20:49:48.153Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: ts2020: fix null-ptr-deref in ts2020_probe() KASAN reported a null-ptr-deref issue when executing the following command: # echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020] RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202 RAX:
ndard PC (Q35 + ICH9, 2009) RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020] RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809 RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010 RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6 R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790 R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001 FS: 00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 000000000000000
55d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ts2020_probe+0xad/0xe10 [ts2020] i2c_device_probe+0x421/0xb40 really_probe+0x266/0x850 ... The cause of the problem is that when using sysfs to dynamically register an i2c device, there is no platform data, but the probe process of ts2020 needs to use platform data, resulting in a null pointer being accessed. Solve this problem by adding checks to platform data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ced1c0
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ced1c04e82e3ecc246b921b9733f0df0866aa50d - https://git.kernel.org/stable/c/5a53f97cd5977911850b695add057f9965c1a2d6 - https://git.kernel.org/stable/c/b6208d1567f929105011bcdfd738f59a6bdc1088 - https://git.kernel.org/stable/c/dc03866b5f4aa2668946f8384a1e5286ae53bbaa - https://git.kernel.org/stable/c/a2ed3b780f34e4a6403064208bc2c99d1ed85026 - https://git.kernel.org/stable/c/901070571bc191d1d8d7a1379bc5ba9446200999 - https://git.kernel.org/stable/c/4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba
CVE ID: CVE-2024-56575 State: PUBLISHED Published: 2024-12-27T14:23:17.925Z Last Updated: 2025-11-03T20:49:49.546Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Ensure power suppliers be suspended before detach them The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensure proper synchronization of this function with power management callbacks. otherwise the detach may led to kernel panic, like below: [ 1457.107934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040 [ 1457.116777] Mem abort info: [ 1457.119589] ESR
le kernel NULL pointer dereference at virtual address 0000000000000040 [ 1457.116777] Mem abort info: [ 1457.119589] ESR = 0x0000000096000004 [ 1457.123358] EC = 0x25: DABT (current EL), IL = 32 bits [ 1457.128692] SET = 0, FnV = 0 [ 1457.131764] EA = 0, S1PTW = 0 [ 1457.134920] FSC = 0x04: level 0 translation fault [ 1457.139812] Data abort info: [ 1457.142707] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 1457.148196] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1457.153256] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1457.158563] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001138b6000 [ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000 [ 1457.171792] Internal err
0000001138b6000 [ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000 [ 1457.171792] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 1457.178045] Modules linked in: v4l2_jpeg wave6_vpu_ctrl(-) [last unloaded: mxc_jpeg_encdec] [ 1457.186383] CPU: 0 PID: 51938 Comm: kworker/0:3 Not tainted 6.6.36-gd23d64eea511 #66 [ 1457.194112] Hardware name: NXP i.MX95 19X19 board (DT) [ 1457.199236] Workqueue: pm pm_runtime_work [ 1457.203247] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1457.210188] pc : genpd_runtime_suspend+0x20/0x290 [ 1457.214886] lr : __rpm_callback+0x48/0x1d8 [ 1457.218968] sp : ffff80008250bc50 [ 1457.222270] x29: ffff80008250bc5
0 [ 1457.214886] lr : __rpm_callback+0x48/0x1d8 [ 1457.218968] sp : ffff80008250bc50 [ 1457.222270] x29: ffff80008250bc50 x28: 0000000000000000 x27: 0000000000000000 [ 1457.229394] x26: 0000000000000000 x25: 0000000000000008 x24: 00000000000f4240 [ 1457.236518] x23: 0000000000000000 x22: ffff00008590f0e4 x21: 0000000000000008 [ 1457.243642] x20: ffff80008099c434 x19: ffff00008590f000 x18: ffffffffffffffff [ 1457.250766] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 63343a6d726f6674 [ 1457.257890] x14: 0000000000000004 x13: 00000000000003a4 x12: 0000000000000002 [ 1457.265014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0 [ 1457.272138] x8 : ffff000092937200 x7 : ffff00
5014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0 [ 1457.272138] x8 : ffff000092937200 x7 : ffff0003fdf6af80 x6 : 0000000000000000 [ 1457.279262] x5 : 00000000410fd050 x4 : 0000000000200000 x3 : 0000000000000000 [ 1457.286386] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008590f000 [ 1457.293510] Call trace: [ 1457.295946] genpd_runtime_suspend+0x20/0x290 [ 1457.300296] __rpm_callback+0x48/0x1d8 [ 1457.304038] rpm_callback+0x6c/0x78 [ 1457.307515] rpm_suspend+0x10c/0x570 [ 1457.311077] pm_runtime_work+0xc4/0xc8 [ 1457.314813] process_one_work+0x138/0x248 [ 1457.318816] worker_thread+0x320/0x438 [ 1457.322552] kthread+0x110/0x114 [ 1457.325767] ret_from_fork+0x
+0x138/0x248 [ 1457.318816] worker_thread+0x320/0x438 [ 1457.322552] kthread+0x110/0x114 [ 1457.325767] ret_from_fork+0x10/0x20 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f3c4e088ec01cae45931a18ddf7cae0f4d72e1c5 - https://git.kernel.org/stable/c/12914fd765ba4f9d6a9a50439e8dd2e9f91423f2 - https://git.kernel.org/stable/c/b7a830bbc25da0f641e3ef2bac3b1766b2777a8b - https://git.kernel.org/stable/c/2f86d104539fab9181ea7b5721f40e7b92a8bf67 - https://git.kernel.org/stable/c/fd0af4cd35da0eb550ef682b71cda70a4e36f6b9
CVE ID: CVE-2024-56576 State: PUBLISHED Published: 2024-12-27T14:23:18.792Z Last Updated: 2025-11-03T20:49:52.421Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise the timer is called with arguments that are already freed, which results in a crash. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardw
er.c:1830 __run_timers+0x244/0x268 Modules linked in: CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __run_timers+0x244/0x268 lr : __run_timers+0x1d4/0x268 sp : ffffff80eff2baf0 x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00 x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00 x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000 x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e x14: 0000000000000000 x13: 00000000000054da x12: 000000000000000
fc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000 x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009 x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480 x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240 x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0 Call trace: __run_timers+0x244/0x268 timer_expire_remote+0x50/0x68 tmigr_handle_remote+0x388/0x39c run_timer_softirq+0x38/0x44 handle_softirqs+0x138/0x298 __do_softirq+0x14/0x20 ____do_softirq+0x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_
x10/0x1c call_on_irq_stack+0x24/0x4c do_softirq_own_stack+0x1c/0x2c irq_exit_rcu+0x9c/0xcc el1_interrupt+0x48/0xc0 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x7c/0x80 default_idle_call+0x34/0x68 do_idle+0x23c/0x294 cpu_startup_entry+0x38/0x3c secondary_start_kernel+0x128/0x160 __secondary_switched+0xb8/0xbc ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/13193a97ddd5a6a5b11408ddbc1ae85588b1860c - https://git.kernel.org/stable/c/5c9ab34c87af718bdbf9faa2b1a6ba41d15380ea - https://git.kernel.org/stable/c/815d14147068347e88c258233eb951b41b2792a6 - https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e968648
org/stable/c/815d14147068347e88c258233eb951b41b2792a6 - https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e96864886d460eb - https://git.kernel.org/stable/c/b59ab89bc83f7bff67f78c6caf484a84a6dd30f7 - https://git.kernel.org/stable/c/1def915b1564f4375330bd113ea1d768a569cfd8 - https://git.kernel.org/stable/c/869f38ae07f7df829da4951c3d1f7a2be09c2e9a
CVE ID: CVE-2024-56577 State: PUBLISHED Published: 2024-12-27T14:23:19.725Z Last Updated: 2025-10-01T20:07:14.975Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix null-ptr-deref during unload module The workqueue should be destroyed in mtk_jpeg_core.c since commit 09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise the below calltrace can be easily triggered. [ 677.862514] Unable to handle kernel paging request at virtual address dfff800000000023 [ 677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] ... [ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O
tr-deref in range [0x0000000000000118-0x000000000000011f] ... [ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O 6.8.12-mtk+gfa1a78e5d24b+ #17 ... [ 677.882838] pc : destroy_workqueue+0x3c/0x770 [ 677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw] [ 677.884314] sp : ffff80008ad974f0 [ 677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070 [ 677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690 [ 677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000 [ 677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0 [ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1
00000000000 x19: 0000000000000000 x18: ffff800085397ac0 [ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10 [ 677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d [ 677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90 [ 677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001 [ 677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000 [ 677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118 [ 677.893977] Call trace: [ 677.894297] destroy_workqueue+0x3c/0x770 [ 677.894826] mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw] [ 677.895677] devm_acti
roy_workqueue+0x3c/0x770 [ 677.894826] mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw] [ 677.895677] devm_action_release+0x50/0x90 [ 677.896211] release_nodes+0xe8/0x170 [ 677.896688] devres_release_all+0xf8/0x178 [ 677.897219] device_unbind_cleanup+0x24/0x170 [ 677.897785] device_release_driver_internal+0x35c/0x480 [ 677.898461] device_release_driver+0x20/0x38 ... [ 677.912665] ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0ba08c21c6a92e6512e73644555120427c9a49d4 - https://git.kernel.org/stable/c/bc3889a39baf783c64c6d628bbb74d76ce164bb1 - https://git.kernel.org/stable/c/17af2b39daf12870cac61ffc
.kernel.org/stable/c/bc3889a39baf783c64c6d628bbb74d76ce164bb1 - https://git.kernel.org/stable/c/17af2b39daf12870cac61ffc360e62bc35798afb
CVE ID: CVE-2024-56578 State: PUBLISHED Published: 2024-12-27T14:23:20.659Z Last Updated: 2025-11-03T20:49:53.815Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f68bb1210fbea252552d97242757f69a219e942b - https://git.kernel.org/stable/c/b88556e82dc18cb708744d062770853a2d5095b2 - https://git.ker
252552d97242757f69a219e942b - https://git.kernel.org/stable/c/b88556e82dc18cb708744d062770853a2d5095b2 - https://git.kernel.org/stable/c/68efeff2f7fccdfedc55f92e92be32997127d16e - https://git.kernel.org/stable/c/5ade59d28eade49194eb09765afdeb0ba717c39a - https://git.kernel.org/stable/c/d2b7ecc26bd5406d5ba927be1748aa99c568696c
CVE ID: CVE-2024-56579 State: PUBLISHED Published: 2024-12-27T14:23:21.438Z Last Updated: 2025-11-03T20:49:55.236Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: amphion: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() file ops, and led to oops. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cfe96c7c3382293179e291f66644d789e39e99f3 - https://git.kernel.org/stable/c/988cc10ddbdee0369fe1f193d389da38ad760492 - https://git.kern
3179e291f66644d789e39e99f3 - https://git.kernel.org/stable/c/988cc10ddbdee0369fe1f193d389da38ad760492 - https://git.kernel.org/stable/c/182b9edc02c4cbb6fe6b97105c23c7047a3340d2 - https://git.kernel.org/stable/c/8cbb1a7bd5973b57898b26eb804fe44af440bb63
CVE ID: CVE-2024-56580 State: PUBLISHED Published: 2024-12-27T14:23:22.380Z Last Updated: 2025-10-01T20:07:14.600Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: fix error path on configuration of power domains There is a chance to meet runtime issues during configuration of CAMSS power domains, because on the error path dev_pm_domain_detach() is unexpectedly called with NULL or error pointer. One of the simplest ways to reproduce the problem is to probe CAMSS driver before registration of CAMSS power domains, for instance if a platform CAMCC driver is simply not built. Warning backtrace example: Unable to h
CAMSS power domains, for instance if a platform CAMCC driver is simply not built. Warning backtrace example: Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2 <snip> pc : dev_pm_domain_detach+0x8/0x48 lr : camss_probe+0x374/0x9c0 <snip> Call trace: dev_pm_domain_detach+0x8/0x48 platform_probe+0x70/0xf0 really_probe+0xc4/0x2a8 __driver_probe_device+0x80/0x140 driver_probe_device+0x48/0x170 __device_attach_driver+0xc0/0x148 bus_for_each_drv+0x88/0xf0 __device_attach+0xb0/0x1c0 device_initial_probe+0x1c/0x30 bus_probe_device+0xb4/0xc0 deferred_probe_work_func+0x90/0xd0 process_one_work+0x164/0x3e0 worker_thread+0x310/0x420 kthread+0x120/0x130 ret_from_fork+0x1
d_probe_work_func+0x90/0xd0 process_one_work+0x164/0x3e0 worker_thread+0x310/0x420 kthread+0x120/0x130 ret_from_fork+0x10/0x20 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c98586d8d01c9e860e7acc3807c2afeb1dc14e8a - https://git.kernel.org/stable/c/4f45d65b781499d2a79eca12155532739c876aa2
CVE ID: CVE-2024-56581 State: PUBLISHED Published: 2024-12-27T14:23:23.193Z Last Updated: 2025-11-03T20:49:58.257Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all b
entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it. Syzbot report this with the following stack traces: BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0