Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
91074cb757 - https://git.kernel.org/stable/c/8a69529f22590b67bb018de9acbcf94abc8603cf - https://git.kernel.org/stable/c/5ef3961682e5310f2221bae99bcf9f5d0f4b0d51 - https://git.kernel.org/stable/c/f88aeff5a173e8ba3133314eb4b964236ef3589d - https://git.kernel.org/stable/c/7dd6a5b96157a21245566b21fd58276a214357ff - https://git.kernel.org/stable/c/a7e4c6a3031c74078dba7fa36239d0f4fe476c53
CVE ID: CVE-2024-41079 State: PUBLISHED Published: 2024-07-29T15:04:16.733Z Last Updated: 2025-11-03T22:00:36.974Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specified). Though, the target implemention returns 0 for TCP and FC but not for RDMA. Let's make RDMA behave the same and thus explicitly initializing the result field. This prevents leaking any data from the stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
This prevents leaking any data from the stack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/30d35b24b7957922f81cfdaa66f2e1b1e9b9aed2 - https://git.kernel.org/stable/c/10967873b80742261527a071954be8b54f0f8e4d - https://git.kernel.org/stable/c/0990e8a863645496b9e3f91cfcfd63cd95c80319 - https://git.kernel.org/stable/c/cd0c1b8e045a8d2785342b385cb2684d9b48e426
CVE ID: CVE-2024-41080 State: PUBLISHED Published: 2024-07-29T15:04:17.642Z Last Updated: 2025-11-03T22:00:38.428Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix possible deadlock in io_register_iowq_max_workers() The io_register_iowq_max_workers() function calls io_put_sq_data(), which acquires the sqd->lock without releasing the uring_lock. Similar to the commit 009ad9f0c6ee ("io_uring: drop ctx->uring_lock before acquiring sqd->lock"), this can lead to a potential deadlock situation. To resolve this issue, the uring_lock is released before calling io_put_sq_data(), and then it is re-acquired after the function
e this issue, the uring_lock is released before calling io_put_sq_data(), and then it is re-acquired after the function call. This change ensures that the locks are acquired in the correct order, preventing the possibility of a deadlock. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b17397a0a5c56e111f61cb5b77d162664dc00de9 - https://git.kernel.org/stable/c/97ed7ff58de66c544692b3c2b988f3f594348de0 - https://git.kernel.org/stable/c/fdacd09f2ddf7a00787291f08ee48c0421e5b709 - https://git.kernel.org/stable/c/950ac86cff338ab56e2eaf611f4936ee34893b63 - https://git.kernel.org/stable/c/b571a367502c7ef94c688ef9c7f7d69a2ce3bcca
le/c/950ac86cff338ab56e2eaf611f4936ee34893b63 - https://git.kernel.org/stable/c/b571a367502c7ef94c688ef9c7f7d69a2ce3bcca - https://git.kernel.org/stable/c/73254a297c2dd094abec7c9efee32455ae875bdf
CVE ID: CVE-2024-41081 State: PUBLISHED Published: 2024-07-29T15:04:18.459Z Last Updated: 2025-11-03T22:00:39.886Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is called from lwtunnel_output() possibly from process context, and under rcu_read_lock(). We might be interrupted by a softirq, re-enter ila_output() and corrupt dst_cache data structures. Fix the race by using local_bh_disable(). Additional Analyst Notes: - CVE Program Container: - C
_cache data structures. Fix the race by using local_bh_disable(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7435bd2f84a25aba607030237261b3795ba782da - https://git.kernel.org/stable/c/96103371091c6476eb07f4c66624bdd1b42f758a - https://git.kernel.org/stable/c/a0cafb7b0b94d18e4813ee4b712a056f280e7b5a - https://git.kernel.org/stable/c/feac2391e26b086f73be30e9b1ab215eada8d830 - https://git.kernel.org/stable/c/b4eb25a3d70df925a9fa4e82d17a958a0a228f5f - https://git.kernel.org/stable/c/522c3336c2025818fa05e9daf0ac35711e55e316 - https://git.kernel.org/stable/c/9f9c79d8e527d867e0875868b14fb76e6011e70c - https://git.kernel.
a05e9daf0ac35711e55e316 - https://git.kernel.org/stable/c/9f9c79d8e527d867e0875868b14fb76e6011e70c - https://git.kernel.org/stable/c/cf28ff8e4c02e1ffa850755288ac954b6ff0db8c
CVE ID: CVE-2024-41082 State: PUBLISHED Published: 2024-07-29T15:04:19.372Z Last Updated: 2025-05-04T09:21:40.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin_q. If a reset (nvme reset or IO timeout) occurs before these commands finish, reconnect routine may fail to update nvme regs due to insufficient tags, which will cause kernel hang forever. In order to workaround this issue, maybe we can let reg_read32()/reg_read64()/reg_write32()
cause kernel hang forever. In order to workaround this issue, maybe we can let reg_read32()/reg_read64()/reg_write32() use reserved tags. This maybe safe for nvmf: 1. For the disable ctrl path, we will not issue connect command 2. For the enable ctrl / fw activate path, since connect and reg_xx() are called serially. So the reserved tags may still be enough while reg_xx() use reserved tags. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/165da9c67a26f08c9b956c15d701da7690f45bcb - https://git.kernel.org/stable/c/7dc3bfcb4c9cc58970fff6aaa48172cb224d85aa
CVE ID: CVE-2024-41083 State: PUBLISHED Published: 2024-07-29T15:47:59.419Z Last Updated: 2025-05-04T09:21:42.155Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid Fix netfs_page_mkwrite() to check that folio->mapping is valid once it has taken the folio lock (as filemap_page_mkwrite() does). Without this, generic/247 occasionally oopses with something like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:trace_event_raw_event_netfs_folio+0x6
or read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:trace_event_raw_event_netfs_folio+0x61/0xc0 ... Call Trace: <TASK> ? __die_body+0x1a/0x60 ? page_fault_oops+0x6e/0xa0 ? exc_page_fault+0xc2/0xe0 ? asm_exc_page_fault+0x22/0x30 ? trace_event_raw_event_netfs_folio+0x61/0xc0 trace_netfs_folio+0x39/0x40 netfs_page_mkwrite+0x14c/0x1d0 do_page_mkwrite+0x50/0x90 do_pte_missing+0x184/0x200 __handle_mm_fault+0x42d/0x500 handle_mm_fault+0x121/0x1f0 do_user_addr_fault+0x23e/0x3c0 exc_page_fault+0xc2/0xe0 asm_exc_page_fault+0x22/0x30 This is due to the invalidate_inode_pages2_range() issued at the end of the DIO write interfering with the mmap'd writes. Additional Analyst
nvalidate_inode_pages2_range() issued at the end of the DIO write interfering with the mmap'd writes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3473eb87afd402e415a8ca885b284ea0420dde25 - https://git.kernel.org/stable/c/a81c98bfa40c11f8ea79b5a9b3f5fda73bfbb4d2
CVE ID: CVE-2024-41084 State: PUBLISHED Published: 2024-07-29T15:48:00.323Z Last Updated: 2025-05-04T09:21:43.444Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl/region: Avoid null pointer dereference in region lookup cxl_dpa_to_region() looks up a region based on a memdev and DPA. It wrongly assumes an endpoint found mapping the DPA is also of a fully assembled region. When not true it leads to a null pointer dereference looking up the region name. This appears during testing of region lookup after a failure to assemble a BIOS defined region or if the lookup raced with the assembly of the BIOS defined region. Failure to cl
ure to assemble a BIOS defined region or if the lookup raced with the assembly of the BIOS defined region. Failure to clean up BIOS defined regions that fail assembly is an issue in itself and a fix to that problem will alleviate some of the impact. It will not alleviate the race condition so let's harden this path. The behavior change is that the kernel oops due to a null pointer dereference is replaced with a dev_dbg() message noting that an endpoint was mapped. Additional comments are added so that future users of this function can more clearly understand what it provides. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stab
s. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a9e099e29e925f8b31cfe53e8a786b9796f8e453 - https://git.kernel.org/stable/c/b8a40a6dbfb0150c1081384caa9bbe28ce5d5060 - https://git.kernel.org/stable/c/285f2a08841432fc3e498b1cd00cce5216cdf189
CVE ID: CVE-2024-41085 State: PUBLISHED Published: 2024-07-29T15:48:01.267Z Last Updated: 2025-05-04T09:21:45.066Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix no cxl_nvd during pmem region auto-assembling When CXL subsystem is auto-assembling a pmem region during cxl endpoint port probing, always hit below calltrace. BUG: kernel NULL pointer dereference, address: 0000000000000078 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page RIP: 0010:cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x160 ? do_user_addr_fault+0x65/0x6
e+0x22e/0x360 [cxl_pmem] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x160 ? do_user_addr_fault+0x65/0x6b0 ? exc_page_fault+0x7d/0x170 ? asm_exc_page_fault+0x26/0x30 ? cxl_pmem_region_probe+0x22e/0x360 [cxl_pmem] ? cxl_pmem_region_probe+0x1ac/0x360 [cxl_pmem] cxl_bus_probe+0x1b/0x60 [cxl_core] really_probe+0x173/0x410 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x80/0x170 driver_probe_device+0x1e/0x90 __device_attach_driver+0x90/0x120 bus_for_each_drv+0x84/0xe0 __device_attach+0xbc/0x1f0 bus_probe_device+0x90/0xa0 device_add+0x51c/0x710 devm_cxl_add_pmem_region+0x1b5/0x380 [cxl_core] cxl_bus_probe+0x1b/0x60 [cxl_core] The cxl_nvd of the memdev needs to be a
vm_cxl_add_pmem_region+0x1b5/0x380 [cxl_core] cxl_bus_probe+0x1b/0x60 [cxl_core] The cxl_nvd of the memdev needs to be available during the pmem region probe. Currently the cxl_nvd is registered after the endpoint port probe. The endpoint probe, in the case of autoassembly of regions, can cause a pmem region probe requiring the not yet available cxl_nvd. Adjust the sequence so this dependency is met. This requires adding a port parameter to cxl_find_nvdimm_bridge() that can be used to query the ancestor root port. The endpoint port is not yet available, but will share a common ancestor with its parent, so start the query from there instead. Additional Analyst Notes: - CVE Program Container:
mon ancestor with its parent, so start the query from there instead. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1d064e4fbebcf5b18dc10c1f3973487eb163b600 - https://git.kernel.org/stable/c/84ec985944ef34a34a1605b93ce401aa8737af96
CVE ID: CVE-2024-41086 State: PUBLISHED Published: 2024-07-29T15:48:02.175Z Last Updated: 2025-05-04T09:21:46.571Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bcachefs: Fix sb_field_downgrade validation - bch2_sb_downgrade_validate() wasn't checking for a downgrade entry extending past the end of the superblock section - for_each_downgrade_entry() is used in to_text() and needs to work on malformed input; it also was missing a check for a field extending past the end of the section Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bf920ed92ef24dcd6970c88
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bf920ed92ef24dcd6970c88881cd4700b3acf05b - https://git.kernel.org/stable/c/692aa7a54b2b28d59f24b3bf8250837805484b99
CVE ID: CVE-2024-41087 State: PUBLISHED Published: 2024-07-29T15:48:03.127Z Last Updated: 2025-11-03T22:00:41.841Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump to the err_out label, which will call devres_release_group(). devres_release_group() will trigger a call to ata_host_release(). ata_host_release() calls kfree(host), so executing the kfree(host) in ata_host_alloc() will lead to a double free: kernel BUG at mm/slub.c:553! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 11 PID: 599 Comm: (udev-worke
free: kernel BUG at mm/slub.c:553! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 11 PID: 599 Comm: (udev-worker) Not tainted 6.10.0-rc5 #47 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:kfree+0x2cf/0x2f0 Code: 5d 41 5e 41 5f 5d e9 80 d6 ff ff 4d 89 f1 41 b8 01 00 00 00 48 89 d9 48 89 da RSP: 0018:ffffc90000f377f0 EFLAGS: 00010246 RAX: ffff888112b1f2c0 RBX: ffff888112b1f2c0 RCX: ffff888112b1f320 RDX: 000000000000400b RSI: ffffffffc02c9de5 RDI: ffff888112b1f2c0 RBP: ffffc90000f37830 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780 R13: ffff888100046400 R14: ffffffffc02c9de5 R
00000000 R10: ffffc90000f37610 R11: 617461203a736b6e R12: ffffea00044ac780 R13: ffff888100046400 R14: ffffffffc02c9de5 R15: 0000000000000006 FS: 00007f2f1cabe980(0000) GS:ffff88813b380000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2f1c3acf75 CR3: 0000000111724000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? kfree+0x2cf/0x2f0 ? exc_invalid_op+0x50/0x70 ? kfree+0x2cf/0x2f0 ? asm_exc_invalid_op+0x1a/0x20 ? ata_host_alloc+0xf5/0x120 [libata] ? ata_host_alloc+0xf5/0x120 [libata] ? kfree+0x2cf/0x2f0 ata_host_alloc+0xf5/0x120 [libata] ata_host_alloc_p
20 [libata] ? ata_host_alloc+0xf5/0x120 [libata] ? kfree+0x2cf/0x2f0 ata_host_alloc+0xf5/0x120 [libata] ata_host_alloc_pinfo+0x14/0xa0 [libata] ahci_init_one+0x6c9/0xd20 [ahci] Ensure that we will not call kfree(host) twice, by performing the kfree() only if the devres_open_group() call failed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/290073b2b557e4dc21ee74a1e403d9ae79e393a2 - https://git.kernel.org/stable/c/56f1c7e290cd6c69c948fcd2e2a49e6a637ec38f - https://git.kernel.org/stable/c/010de9acbea58fbcbda08e3793d6262086a493fe - https://git.kernel.org/stable/c/5dde5f8b790274723640d29a07c5a97d57d62047 - https://git.ke
8fbcbda08e3793d6262086a493fe - https://git.kernel.org/stable/c/5dde5f8b790274723640d29a07c5a97d57d62047 - https://git.kernel.org/stable/c/702c1edbafb2e6f9d20f6d391273b5be09d366a5 - https://git.kernel.org/stable/c/062e256516d7db5e7dcdef117f52025cd5c456e3 - https://git.kernel.org/stable/c/8106da4d88bbaed809e023cc8014b766223d6e76 - https://git.kernel.org/stable/c/ab9e0c529eb7cafebdd31fe1644524e80a48b05d
CVE ID: CVE-2024-41088 State: PUBLISHED Published: 2024-07-29T15:48:04.035Z Last Updated: 2025-11-03T22:00:43.442Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: mcp251xfd: fix infinite loop when xmit fails When the mcp251xfd_start_xmit() function fails, the driver stops processing messages, and the interrupt routine does not return, running indefinitely even after killing the running application. Error messages: [ 441.298819] mcp251xfd spi2.0 can0: ERROR in mcp251xfd_start_xmit: -16 [ 441.306498] mcp251xfd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head
fd spi2.0 can0: Transmit Event FIFO buffer not empty. (seq=0x000017c7, tef_tail=0x000017cf, tef_head=0x000017d0, tx_head=0x000017d3). ... and repeat forever. The issue can be triggered when multiple devices share the same SPI interface. And there is concurrent access to the bus. The problem occurs because tx_ring->head increments even if mcp251xfd_start_xmit() fails. Consequently, the driver skips one TX package while still expecting a response in mcp251xfd_handle_tefif_one(). Resolve the issue by starting a workqueue to write the tx obj synchronously if err = -EBUSY. In case of another error, decrement tx_ring->head, remove skb from the echo stack, and drop the message. [mkl: use more imper
se of another error, decrement tx_ring->head, remove skb from the echo stack, and drop the message. [mkl: use more imperative wording in patch description] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f926c022ebaabf7963bebf89a97201d66978a025 - https://git.kernel.org/stable/c/3e72558c1711d524e3150103739ddd06650e291b - https://git.kernel.org/stable/c/6c6b4afa59c2fb4d1759235f866d8caed2aa4729 - https://git.kernel.org/stable/c/d8fb63e46c884c898a38f061c2330f7729e75510
CVE ID: CVE-2024-41089 State: PUBLISHED Published: 2024-07-29T15:48:04.875Z Last Updated: 2025-11-03T22:00:44.940Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes In nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). The same applies to drm_cvt_mode(). Add a check to avoid null pointer dereference. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ffabad4aa91e3
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ffabad4aa91e33ced3c6ae793fb37771b3e9cb51 - https://git.kernel.org/stable/c/1c9f2e60150b4f13789064370e37f39e6e060f50 - https://git.kernel.org/stable/c/56fc4d3b0bdef691831cd95715a7ca3ebea98b2d - https://git.kernel.org/stable/c/5eecb49a6c268dc229005bf6e8167d4001dc09a0 - https://git.kernel.org/stable/c/30cbf6ffafbbdd8a6e4e5f0a2e9a9827ee83f3ad - https://git.kernel.org/stable/c/7ece609b0ce7a7ea8acdf512a77d1fee26621637 - https://git.kernel.org/stable/c/6e49a157d541e7e97b815a56f4bdfcbc89844a59 - https://git.kernel.org/stable/c/6d411c8ccc0137a612e0044489030a194ff5c843
CVE ID: CVE-2024-41090 State: PUBLISHED Published: 2024-07-29T06:18:10.896Z Last Updated: 2025-11-03T22:00:46.396Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inco
, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea - https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f - https://git.kernel.org/stable/c
75a1a93bdea - https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f - https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6 - https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46 - https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa - https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da - https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309 - https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3
CVE ID: CVE-2024-41091 State: PUBLISHED Published: 2024-07-29T06:18:12.019Z Last Updated: 2025-11-03T22:00:47.849Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect
smitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP. This is to drop any frame shorter than the Ethernet header size just like how tun_get_user() does. CVE: CVE-2024-41091 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 - https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 - https://git.
bc85816898167d9b5d45a22eae82e9 - https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 - https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 - https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 - https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a - https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb - https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 - https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3
CVE ID: CVE-2024-41092 State: PUBLISHED Published: 2024-07-29T15:48:05.853Z Last Updated: 2025-11-03T22:00:49.323Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines: <6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence ... <6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled <6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled <3> [414.070354] Unable to pin Y-tiled fence; err:-4 <3>