Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
happens, the ct clear handling adds that same set of mod hdr actions to reset ct_state until the max of mod hdr actions is reached. Also the driver never releases the allocated mod hdr actions and causing a memleak. Fix above two issues by moving CT clear mod acts allocation into the parsing actions phase and only use it when offloading the rule. The release of mod acts will be done in the normal flow_put(). backtrace: [<000000007316e2f3>] krealloc+0x83/0xd0 [<00000000ef157de1>] mlx5e_mod_hdr_alloc+0x147/0x300 [mlx5_core] [<00000000970ce4ae>] mlx5e_tc_match_to_reg_set_and_get_id+0xd7/0x240 [mlx5_core] [<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core] [<00000000d032eb98>] ml
et_id+0xd7/0x240 [mlx5_core] [<0000000067c5fa17>] mlx5e_tc_match_to_reg_set+0xa/0x20 [mlx5_core] [<00000000d032eb98>] mlx5_tc_ct_entry_set_registers.isra.0+0x36/0xc0 [mlx5_core] [<00000000fd23b869>] mlx5_tc_ct_flow_offload+0x272/0x1f10 [mlx5_core] [<000000004fc24acc>] mlx5e_tc_offload_fdb_rules.part.0+0x150/0x620 [mlx5_core] [<00000000dc741c17>] mlx5e_tc_encap_flows_add+0x489/0x690 [mlx5_core] [<00000000e92e49d7>] mlx5e_rep_update_flows+0x6e4/0x9b0 [mlx5_core] [<00000000f60f5602>] mlx5e_rep_neigh_update+0x39a/0x5d0 [mlx5_core] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/486e8de6e233ff2999493533c6259d1cb538653b - ht
er: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/486e8de6e233ff2999493533c6259d1cb538653b - https://git.kernel.org/stable/c/806401c20a0f9c51b6c8fd7035671e6ca841f6c2
CVE ID: CVE-2021-47200 State: PUBLISHED Published: 2024-04-10T18:56:35.152Z Last Updated: 2025-05-04T07:06:15.756Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap drm_gem_ttm_mmap() drops a reference to the gem object on success. If the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that drop will free the gem object, and the subsequent drm_gem_object_get() will be a UAF. Fix by grabbing a reference before calling the mmap helper. This issue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For t
sue was forseen when the reference dropping was adding in commit 9786b65bc61ac ("drm/ttm: fix mmap refcounting"): "For that to work properly the drm_gem_object_get() call in drm_gem_ttm_mmap() must be moved so it happens before calling obj->funcs->mmap(), otherwise the gem refcount would go down to zero." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4f8e469a2384dfa4047145b0093126462cbb6dc0 - https://git.kernel.org/stable/c/8244a3bc27b3efd057da154b8d7e414670d5044f
CVE ID: CVE-2021-47201 State: PUBLISHED Published: 2024-04-10T18:56:35.774Z Last Updated: 2025-05-04T07:06:16.818Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iavf: free q_vectors before queues in iavf_disable_vf iavf_free_queues() clears adapter->num_active_queues, which iavf_free_q_vectors() relies on, so swap the order of these two function calls in iavf_disable_vf(). This resolves a panic encountered when the interface is disabled and then later brought up again after PF communication is restored. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/926
ional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/926e8c83d4c1c2dac0026637eb0d492df876489e - https://git.kernel.org/stable/c/78638b47132244e3934dc5dc79f6372d5ce8e98c - https://git.kernel.org/stable/c/9ef6589cac9a8c47f5544ccdf4c498093733bb3f - https://git.kernel.org/stable/c/89f22f129696ab53cfbc608e0a2184d0fea46ac1
CVE ID: CVE-2021-47202 State: PUBLISHED Published: 2024-04-10T18:56:36.408Z Last Updated: 2025-05-04T07:06:18.337Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal: Fix NULL pointer dereferences in of_thermal_ functions of_parse_thermal_zones() parses the thermal-zones node and registers a thermal_zone device for each subnode. However, if a thermal zone is consuming a thermal sensor and that thermal sensor device hasn't probed yet, an attempt to set trip_point_*_temp for that thermal zone device can cause a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Un
e a NULL pointer dereference. Fix it. console:/sys/class/thermal/thermal_zone87 # echo 120000 > trip_point_0_temp ... Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... Call trace: of_thermal_set_trip_temp+0x40/0xc4 trip_point_temp_store+0xc0/0x1dc dev_attr_store+0x38/0x88 sysfs_kf_write+0x64/0xc0 kernfs_fop_write_iter+0x108/0x1d0 vfs_write+0x2f4/0x368 ksys_write+0x7c/0xec __arm64_sys_write+0x20/0x30 el0_svc_common.llvm.7279915941325364641+0xbc/0x1bc do_el0_svc+0x28/0xa0 el0_svc+0x14/0x24 el0_sync_handler+0x88/0xec el0_sync+0x1c0/0x200 While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set
While at it, fix the possible NULL pointer dereference in other functions as well: of_thermal_get_temp(), of_thermal_set_emul_temp(), of_thermal_get_trend(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/828f4c31684da94ecf0b44a2cbd35bbede04f0bd - https://git.kernel.org/stable/c/6a315471cb6a07f651e1d3adc8962730f4fcccac - https://git.kernel.org/stable/c/0750f769b95841b34a9fe8c418dd792ff526bf86 - https://git.kernel.org/stable/c/ef2590a5305e0b8e9342f84c2214aa478ee7f28e - https://git.kernel.org/stable/c/96cfe05051fd8543cdedd6807ec59a0e6c409195
CVE ID: CVE-2021-47203 State: PUBLISHED Published: 2024-04-10T18:56:37.066Z Last Updated: 2025-05-04T07:06:19.424Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output. The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was
list continues, but since "fail_msg" remains set, jobs are added to the completions list regardless of whether a wqe was passed to the adapter. If successfully added to txcmplq, jobs are added to both lists resulting in list corruption. Fix by clearing the fail_msg string after adding a job to the completions list. This stops the subsequent jobs from being added to the completions list unless they had an appropriate failure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd - https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f - https://git.kernel.org/stable/c
f6d051674dd - https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f - https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305 - https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b - https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f - https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca - https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5 - https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d
CVE ID: CVE-2021-47204 State: PUBLISHED Published: 2024-04-10T18:56:37.703Z Last Updated: 2025-05-04T07:06:20.707Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove Access to netdev after free_netdev() will cause use-after-free bug. Move debug log before free_netdev() call to avoid it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d74ff10ed2d93dc9b67e99a74b36fb9a83273d8a - https://git.kernel.org/stable/c/1c4099dc0d6a01e76e4f7dd98e4b3e0d55d80ad9 - https://git.kernel.org/stable/c/32d4686224744819ddcae58b
.kernel.org/stable/c/1c4099dc0d6a01e76e4f7dd98e4b3e0d55d80ad9 - https://git.kernel.org/stable/c/32d4686224744819ddcae58b666c21d2a4ef4c88 - https://git.kernel.org/stable/c/9b5a333272a48c2f8b30add7a874e46e8b26129c
CVE ID: CVE-2021-47205 State: PUBLISHED Published: 2024-04-10T18:56:38.347Z Last Updated: 2025-05-04T07:06:21.786Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: Unregister clocks/resets when unbinding Currently, unbinding a CCU driver unmaps the device's MMIO region, while leaving its clocks/resets and their providers registered. This can cause a page fault later when some clock operation tries to perform MMIO. Fix this by separating the CCU initialization from the memory allocation, and then using a devres callback to unregister the clocks and resets. This also fixes a memory leak of the `struct ccu_reset`, and
sing a devres callback to unregister the clocks and resets. This also fixes a memory leak of the `struct ccu_reset`, and uses the correct owner (the specific platform driver) for the clocks and resets. Early OF clock providers are never unregistered, and limited error handling is possible, so they are mostly unchanged. The error reporting is made more consistent by moving the message inside of_sunxi_ccu_probe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5dd513daa70ee8f6d281a20bd28485ee9bb7db2 - https://git.kernel.org/stable/c/9bec2b9c6134052994115d2d3374e96f2ccb9b9d
CVE ID: CVE-2021-47206 State: PUBLISHED Published: 2024-04-10T18:56:38.995Z Last Updated: 2025-05-04T07:06:23.050Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/28e016e02118917e50a667bc72fb80098cf2b460 - https://git.kernel.org/stable/c/2f18f97a1a787154a372c0738f1576f14b693d91 - https://git.kernel.org/stable/c/bb6ed2e05eb6e8619b30
/git.kernel.org/stable/c/2f18f97a1a787154a372c0738f1576f14b693d91 - https://git.kernel.org/stable/c/bb6ed2e05eb6e8619b30fa854f9becd50c11723f - https://git.kernel.org/stable/c/951b8239fd24678b56c995c5c0456ab12e059d19 - https://git.kernel.org/stable/c/f98986b7acb4219f95789095eced93ed69d81d35 - https://git.kernel.org/stable/c/2474eb7fc3bfbce10f7b8ea431fcffe5dd5f5100 - https://git.kernel.org/stable/c/065334f6640d074a1caec2f8b0091467a22f9483 - https://git.kernel.org/stable/c/9eff2b2e59fda25051ab36cd1cb5014661df657b
CVE ID: CVE-2021-47207 State: PUBLISHED Published: 2024-04-10T18:56:39.655Z Last Updated: 2025-05-04T07:06:24.143Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: fix null pointer dereference on pointer block The pointer block return from snd_gf1_dma_next_block could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3e28e083dcdf03a18a083f8a47b6bb6b1604b5be - https://git.kernel.org/stable/c/cb09c760c201f82df83babc92a5ffea0a01807fc -
c/3e28e083dcdf03a18a083f8a47b6bb6b1604b5be - https://git.kernel.org/stable/c/cb09c760c201f82df83babc92a5ffea0a01807fc - https://git.kernel.org/stable/c/542fa721594a02d2aee0370a764d306ef48d030c - https://git.kernel.org/stable/c/ab4c1ebc40f699f48346f634d7b72b9c5193f315 - https://git.kernel.org/stable/c/c6d2cefdd05c4810c416fb8d384b5c377bd977bc - https://git.kernel.org/stable/c/1ac6cd87d8ddd36c43620f82c4d65b058f725f0f - https://git.kernel.org/stable/c/16721797dcef2c7c030ffe73a07f39a65f9323c3 - https://git.kernel.org/stable/c/a0d21bb3279476c777434c40d969ea88ca64f9aa
CVE ID: CVE-2021-47208 State: PUBLISHED Published: 2024-04-07T00:00:00.000Z Last Updated: 2025-03-20T14:00:47.662Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/mojolicious/mojo/issues/1736 - https://github.com/mojolicious/mojo/commit/a0c4576ffb11c235088550de9ba7ac4196e1953c
CVE ID: CVE-2021-47209 State: PUBLISHED Published: 2024-04-10T19:01:51.363Z Last Updated: 2025-05-04T07:06:25.344Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/fair: Prevent dead task groups from regaining cfs_rq's Kevin is reporting crashes which point to a use-after-free of a cfs_rq in update_blocked_averages(). Initial debugging revealed that we've live cfs_rq's (on_list=1) in an about to be kfree()'d task group in free_fair_sched_group(). However, it was unclear how that can happen. His kernel config happened to lead to a layout of struct sched_entity that put the 'my_q' member directly into the middle of the object
ig happened to lead to a layout of struct sched_entity that put the 'my_q' member directly into the middle of the object which makes it incidentally overlap with SLUB's freelist pointer. That, in combination with SLAB_FREELIST_HARDENED's freelist pointer mangling, leads to a reliable access violation in form of a #GP which made the UAF fail fast. Michal seems to have run into the same issue[1]. He already correctly diagnosed that commit a7b359fc6a37 ("sched/fair: Correctly insert cfs_rq's to list on unthrottle") is causing the preconditions for the UAF to happen by re-adding cfs_rq's also to task groups that have no more running tasks, i.e. also to dead ones. His analysis, however, misses th
g cfs_rq's also to task groups that have no more running tasks, i.e. also to dead ones. His analysis, however, misses the real root cause and it cannot be seen from the crash backtrace only, as the real offender is tg_unthrottle_up() getting called via sched_cfs_period_timer() via the timer interrupt at an inconvenient time. When unregister_fair_sched_group() unlinks all cfs_rq's from the dying task group, it doesn't protect itself from getting interrupted. If the timer interrupt triggers while we iterate over all CPUs or after unregister_fair_sched_group() has finished but prior to unlinking the task group, sched_cfs_period_timer() will execute and walk the list of task groups, trying to un
prior to unlinking the task group, sched_cfs_period_timer() will execute and walk the list of task groups, trying to unthrottle cfs_rq's, i.e. re-add them to the dying task group. These will later -- in free_fair_sched_group() -- be kfree()'ed while still being linked, leading to the fireworks Kevin and Michal are seeing. To fix this race, ensure the dying task group gets unlinked first. However, simply switching the order of unregistering and unlinking the task group isn't sufficient, as concurrent RCU walkers might still see it, as can be seen below: CPU1: CPU2: : timer IRQ: : do_sched_cfs_period_timer(): : : : distribute_cfs_runtime(): : rcu_read_lock(); : : : unthrottle_cfs_rq(): sched_
IRQ: : do_sched_cfs_period_timer(): : : : distribute_cfs_runtime(): : rcu_read_lock(); : : : unthrottle_cfs_rq(): sched_offline_group(): : : walk_tg_tree_from(…,tg_unthrottle_up,…): list_del_rcu(&tg->list); : (1) : list_for_each_entry_rcu(child, &parent->children, siblings) : : (2) list_del_rcu(&tg->siblings); : : tg_unthrottle_up(): unregister_fair_sched_group(): struct cfs_rq *cfs_rq = tg->cfs_rq[cpu_of(rq)]; : : list_del_leaf_cfs_rq(tg->cfs_rq[cpu]); : : : : if (!cfs_rq_is_decayed(cfs_rq) || cfs_rq->nr_running) (3) : list_add_leaf_cfs_rq(cfs_rq); : : : : : : : : : ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.o
ncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/512e21c150c1c3ee298852660f3a796e267e62ec - https://git.kernel.org/stable/c/b027789e5e50494c2325cc70c8642e7fd6059479
CVE ID: CVE-2021-47210 State: PUBLISHED Published: 2024-04-10T19:01:52.001Z Last Updated: 2025-07-28T11:16:17.061Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Remove WARN_ON in tps6598x_block_read Calling tps6598x_block_read with a higher than allowed len can be handled by just returning an error. There's no need to crash systems with panic-on-warn enabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2a897d384513ba7f7ef05611338b9a6ec6aeac00 - https://git.kernel.org/stable/c/30dcfcda8992dc42f18e7d35b6a1fa72372d382d - https://git.ke
ba7f7ef05611338b9a6ec6aeac00 - https://git.kernel.org/stable/c/30dcfcda8992dc42f18e7d35b6a1fa72372d382d - https://git.kernel.org/stable/c/eff8b7628410cb2eb562ca0d5d1f12e27063733e - https://git.kernel.org/stable/c/2c71811c963b6c310a29455d521d31a7ea6c5b5e - https://git.kernel.org/stable/c/b7a0a63f3fed57d413bb857de164ea9c3984bc4e
CVE ID: CVE-2021-47211 State: PUBLISHED Published: 2024-04-10T19:01:52.636Z Last Updated: 2025-05-04T07:06:27.491Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix null pointer dereference on pointer cs_desc The pointer cs_desc return from snd_usb_find_clock_source could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/58fa50de595f152900594c28ec9915c169643739 - https://git.kernel.org/stable/c/b97053df0f04747c3c1e021ecbe99d
l.org/stable/c/58fa50de595f152900594c28ec9915c169643739 - https://git.kernel.org/stable/c/b97053df0f04747c3c1e021ecbe99db675342954
CVE ID: CVE-2021-47212 State: PUBLISHED Published: 2024-04-10T19:01:53.270Z Last Updated: 2025-05-04T07:06:28.557Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Update error handler for UCTX and UMEM In the fast unload flow, the device state is set to internal error, which indicates that the driver started the destroy process. In this case, when a destroy command is being executed, it should return MLX5_CMD_STAT_OK. Fix MLX5_CMD_OP_DESTROY_UCTX and MLX5_CMD_OP_DESTROY_UMEM to return OK instead of EIO. This fixes a call trace in the umem release process - [ 2633.536695] Call Trace: [ 2633.537518] ib_uverbs_remove_one+
O. This fixes a call trace in the umem release process - [ 2633.536695] Call Trace: [ 2633.537518] ib_uverbs_remove_one+0xc3/0x140 [ib_uverbs] [ 2633.538596] remove_client_context+0x8b/0xd0 [ib_core] [ 2633.539641] disable_device+0x8c/0x130 [ib_core] [ 2633.540615] __ib_unregister_device+0x35/0xa0 [ib_core] [ 2633.541640] ib_unregister_device+0x21/0x30 [ib_core] [ 2633.542663] __mlx5_ib_remove+0x38/0x90 [mlx5_ib] [ 2633.543640] auxiliary_bus_remove+0x1e/0x30 [auxiliary] [ 2633.544661] device_release_driver_internal+0x103/0x1f0 [ 2633.545679] bus_remove_device+0xf7/0x170 [ 2633.546640] device_del+0x181/0x410 [ 2633.547606] mlx5_rescan_drivers_locked.part.10+0x63/0x160 [mlx5_core] [ 2633.54877
633.546640] device_del+0x181/0x410 [ 2633.547606] mlx5_rescan_drivers_locked.part.10+0x63/0x160 [mlx5_core] [ 2633.548777] mlx5_unregister_device+0x27/0x40 [mlx5_core] [ 2633.549841] mlx5_uninit_one+0x21/0xc0 [mlx5_core] [ 2633.550864] remove_one+0x69/0xe0 [mlx5_core] [ 2633.551819] pci_device_remove+0x3b/0xc0 [ 2633.552731] device_release_driver_internal+0x103/0x1f0 [ 2633.553746] unbind_store+0xf6/0x130 [ 2633.554657] kernfs_fop_write+0x116/0x190 [ 2633.555567] vfs_write+0xa5/0x1a0 [ 2633.556407] ksys_write+0x4f/0xb0 [ 2633.557233] do_syscall_64+0x5b/0x1a0 [ 2633.558071] entry_SYSCALL_64_after_hwframe+0x65/0xca [ 2633.559018] RIP: 0033:0x7f9977132648 [ 2633.559821] Code: 89 02 48 c7 c0 ff
entry_SYSCALL_64_after_hwframe+0x65/0xca [ 2633.559018] RIP: 0033:0x7f9977132648 [ 2633.559821] Code: 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 55 6f 2d 00 8b 00 85 c0 75 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 49 89 d4 55 [ 2633.562332] RSP: 002b:00007fffb1a83888 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2633.563472] RAX: ffffffffffffffda RBX: 000000000000000c RCX: 00007f9977132648 [ 2633.564541] RDX: 000000000000000c RSI: 000055b90546e230 RDI: 0000000000000001 [ 2633.565596] RBP: 000055b90546e230 R08: 00007f9977406860 R09: 00007f9977a54740 [ 2633.566653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99774
R08: 00007f9977406860 R09: 00007f9977a54740 [ 2633.566653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f99774056e0 [ 2633.567692] R13: 000000000000000c R14: 00007f9977400880 R15: 000000000000000c [ 2633.568725] ---[ end trace 10b4fe52945e544d ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a51a6da375d82aed5c8f83abd13e7d060421bd48 - https://git.kernel.org/stable/c/ba50cd9451f6c49cf0841c0a4a146ff6a2822699
CVE ID: CVE-2021-47213 State: REJECTED Published: 2024-04-10T19:01:53.899Z Last Updated: 2024-04-15T08:15:17.841Z Description: No description available.
CVE ID: CVE-2021-47214 State: PUBLISHED Published: 2024-04-10T19:01:54.543Z Last Updated: 2025-05-04T12:41:16.227Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hugetlb, userfaultfd: fix reservation restore on userfaultfd error Currently in the is_continue case in hugetlb_mcopy_atomic_pte(), if we bail out using "goto out_release_unlock;" in the cases where idx >= size, or !huge_pte_none(), the code will detect that new_pagecache_page == false, and so call restore_reserve_on_error(). In this case I see restore_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_h
e_reserve_on_error() delete the reservation, and the following call to remove_inode_hugepages() will increment h->resv_hugepages causing a 100% reproducible leak. We should treat the is_continue case similar to adding a page into the pagecache and set new_pagecache_page to true, to indicate that there is no reservation to restore on the error path, and we need not call restore_reserve_on_error(). Rename new_pagecache_page to page_in_pagecache to make that clear. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5069d44e2fbc4a9093d005b3ef0949add3dd27e - https://git.kernel.org/stable/c/cc30042df6fcc82ea18acf0dace831503e60
stable/c/b5069d44e2fbc4a9093d005b3ef0949add3dd27e - https://git.kernel.org/stable/c/cc30042df6fcc82ea18acf0dace831503e60a0b7
CVE ID: CVE-2021-47215 State: PUBLISHED Published: 2024-04-10T19:01:55.157Z Last Updated: 2025-05-04T07:06:30.599Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For the TLS RX resync flow, we maintain a list of TLS contexts that require some attention, to communicate their resync information to the HW. Here we fix list corruptions, by protecting the entries against movements coming from resync_handle_seq_match(), until their resync handling in napi is fully completed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/sta