Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42077 State: PUBLISHED Published: 2024-07-29T15:52:39.661Z Last Updated: 2025-11-03T22:01:11.373Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix DIO failure due to insufficient transaction credits The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This however does not take into account that the IO could be arbitrarily large and can contain arbitrary number of extents. Extent tree manipulations do often extend the current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_m
e current transaction but not in all of the cases. For example if we have only single block extents in the tree, ocfs2_mark_extent_written() will end up calling ocfs2_replace_extent_rec() all the time and we will never extend the current transaction and eventually exhaust all the transaction credits if the IO contains many single block extents. Once that happens a WARN_ON(jbd2_handle_buffer_credits(handle) <= 0) is triggered in jbd2_journal_dirty_metadata() and subsequently OCFS2 aborts in response to this error. This was actually triggered by one of our customers on a heavily fragmented OCFS2 filesystem. To fix the issue make sure the transaction always has enough credits for one extent ins
ily fragmented OCFS2 filesystem. To fix the issue make sure the transaction always has enough credits for one extent insert before each call of ocfs2_mark_extent_written(). Heming Zhao said: ------ PANIC: "Kernel panic - not syncing: OCFS2: (device dm-1): panic forced after error" PID: xxx TASK: xxxx CPU: 5 COMMAND: "SubmitThread-CA" #0 machine_kexec at ffffffff8c069932 #1 __crash_kexec at ffffffff8c1338fa #2 panic at ffffffff8c1d69b9 #3 ocfs2_handle_error at ffffffffc0c86c0c [ocfs2] #4 __ocfs2_abort at ffffffffc0c88387 [ocfs2] #5 ocfs2_journal_dirty at ffffffffc0c51e98 [ocfs2] #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] #8 ocfs2_
fs2] #6 ocfs2_split_extent at ffffffffc0c27ea3 [ocfs2] #7 ocfs2_change_extent_flag at ffffffffc0c28053 [ocfs2] #8 ocfs2_mark_extent_written at ffffffffc0c28347 [ocfs2] #9 ocfs2_dio_end_io_write at ffffffffc0c2bef9 [ocfs2] #10 ocfs2_dio_end_io at ffffffffc0c2c0f5 [ocfs2] #11 dio_complete at ffffffff8c2b9fa7 #12 do_blockdev_direct_IO at ffffffff8c2bc09f #13 ocfs2_direct_IO at ffffffffc0c2b653 [ocfs2] #14 generic_file_direct_write at ffffffff8c1dcf14 #15 __generic_file_write_iter at ffffffff8c1dd07b #16 ocfs2_file_write_iter at ffffffffc0c49f1f [ocfs2] #17 aio_write at ffffffff8c2cc72e #18 kmem_cache_alloc at ffffffff8c248dde #19 do_io_submit at ffffffff8c2ccada #20 do_syscall_64 at ffffffff8c0
f8c2cc72e #18 kmem_cache_alloc at ffffffff8c248dde #19 do_io_submit at ffffffff8c2ccada #20 do_syscall_64 at ffffffff8c004984 #21 entry_SYSCALL_64_after_hwframe at ffffffff8c8000ba Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687 - https://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a - https://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4 - https://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111 - https://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6 - https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827
it.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6 - https://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36
CVE ID: CVE-2024-42078 State: PUBLISHED Published: 2024-07-29T15:52:40.632Z Last Updated: 2025-05-04T09:22:29.680Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: initialise nfsd_info.mutex early. nfsd_info.mutex can be dereferenced by svc_pool_stats_start() immediately after the new netns is created. Currently this can trigger an oops. Move the initialisation earlier before it can possibly be dereferenced. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7e8b94045bc77ce4f085ddfb9eb04e5760e66169 - https://git.kernel.org/stable/c/e0011bca603c101f2a3c00
it.kernel.org/stable/c/7e8b94045bc77ce4f085ddfb9eb04e5760e66169 - https://git.kernel.org/stable/c/e0011bca603c101f2a3c007bdb77f7006fa78fb1
CVE ID: CVE-2024-42079 State: PUBLISHED Published: 2024-07-29T15:52:41.360Z Last Updated: 2025-05-04T09:22:31.018Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion against gfs2_log_flush(). In gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before dereferencing it. Otherwise, we could run into a NULL pointer dereference when outstanding glock work races with an unmount (glock_work_func -> run_queue -> do_xmote -> inode_go_sync -> gfs2_log_flush). Additional Analyst Notes: - CVE P
unmount (glock_work_func -> run_queue -> do_xmote -> inode_go_sync -> gfs2_log_flush). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3429ef5f50909cee9e498c50f0c499b9397116ce - https://git.kernel.org/stable/c/f54f9d5368a4e92ede7dd078a62788dae3a7c6ef - https://git.kernel.org/stable/c/35264909e9d1973ab9aaa2a1b07cda70f12bb828
CVE ID: CVE-2024-42080 State: PUBLISHED Published: 2024-07-29T15:52:42.228Z Last Updated: 2025-11-03T22:01:12.864Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Fix potential invalid address access struct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME in ib_create_cq(), while if the module exited but forgot del this rdma_restrack_entry, it would cause a invalid address access in rdma_restrack_clean() when print the owner of this rdma_restrack_entry. These code is used to help find one forgotten PD release in one of the ULPs. But it is not needed anymore, so delete them. Additional Analyst Notes: - CVE
e forgotten PD release in one of the ULPs. But it is not needed anymore, so delete them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8656ef8a9288d6c932654f8d3856dc4ab1cfc6b5 - https://git.kernel.org/stable/c/782bdaf9d01658281bc813f3f873e6258aa1fd8d - https://git.kernel.org/stable/c/8ac281d42337f36cf7061cf1ea094181b84bc1a9 - https://git.kernel.org/stable/c/f45b43d17240e9ca67ebf3cc82bb046b07cc1c61 - https://git.kernel.org/stable/c/ca537a34775c103f7b14d7bbd976403f1d1525d8
CVE ID: CVE-2024-42081 State: PUBLISHED Published: 2024-07-29T15:52:43.176Z Last Updated: 2025-05-04T09:22:33.980Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/xe_devcoredump: Check NULL before assignments Assign 'xe_devcoredump_snapshot *' and 'xe_device *' only if 'coredump' is not NULL. v2 - Fix commit messages. v3 - Define variables before code.(Ashutosh/Jose) v4 - Drop return check for coredump_to_xe. (Jose/Rodrigo) v5 - Modify misleading commit message. (Matt) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/76ec0e33707282d5321555698d902f4e0
gram Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/76ec0e33707282d5321555698d902f4e067aff37 - https://git.kernel.org/stable/c/b15e65349553b1689d15fbdebea874ca5ae2274a
CVE ID: CVE-2024-42082 State: PUBLISHED Published: 2024-07-29T15:52:43.989Z Last Updated: 2025-11-03T22:01:14.321Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __xdp_reg_mem_model(). The warning occurs only if __mem_id_init_hash_table() returns an error. It returns the error in two cases: 1. memory allocation fails; 2. rhashtable_init() fails when some fields of rhashtable_params struct are not initialized properly. The second case cannot happen since there is a static const rhashtable_params struct with valid fields. So, warning is only triggered wh
cannot happen since there is a static const rhashtable_params struct with valid fields. So, warning is only triggered when there is a problem with memory allocation. Thus, there is no sense in using WARN() to handle this error and it can be safely removed. WARNING: CPU: 0 PID: 5065 at net/core/xdp.c:299 __xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299 CPU: 0 PID: 5065 Comm: syz-executor883 Not tainted 6.8.0-syzkaller-05271-gf99c5f563c17 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 RIP: 0010:__xdp_reg_mem_model+0x2d9/0x650 net/core/xdp.c:299 Call Trace: xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344 xdp_test_run_setup net/bpf/test_run.c:188 [i
t/core/xdp.c:299 Call Trace: xdp_reg_mem_model+0x22/0x40 net/core/xdp.c:344 xdp_test_run_setup net/bpf/test_run.c:188 [inline] bpf_test_run_xdp_live+0x365/0x1e90 net/bpf/test_run.c:377 bpf_prog_test_run_xdp+0x813/0x11b0 net/bpf/test_run.c:1267 bpf_prog_test_run+0x33a/0x3b0 kernel/bpf/syscall.c:4240 __sys_bpf+0x48d/0x810 kernel/bpf/syscall.c:5649 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Found by Linux Verification Center (linuxtesting.org) with syzkaller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
ication Center (linuxtesting.org) with syzkaller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1095b8efbb13a6a5fa583ed373ee1ccab29da2d0 - https://git.kernel.org/stable/c/1d3e3b3aa2cbe9bc7db9a7f8673a9fa6d2990d54 - https://git.kernel.org/stable/c/4e0c539ee265d5c6e7fa7d229cd4aa7bc01816e2 - https://git.kernel.org/stable/c/14e51ea78b4ccacb7acb1346b9241bb790a2054c - https://git.kernel.org/stable/c/f92298b0467fd77edc4c1a2c3e48833e69840ec4 - https://git.kernel.org/stable/c/7e9f79428372c6eab92271390851be34ab26bfb4
CVE ID: CVE-2024-42083 State: PUBLISHED Published: 2024-07-29T15:54:44.106Z Last Updated: 2025-05-04T09:22:36.572Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ionic: fix kernel panic due to multi-buffer handling Currently, the ionic_run_xdp() doesn't handle multi-buffer packets properly for XDP_TX and XDP_REDIRECT. When a jumbo frame is received, the ionic_run_xdp() first makes xdp frame with all necessary pages in the rx descriptor. And if the action is either XDP_TX or XDP_REDIRECT, it should unmap dma-mapping and reset page pointer to NULL for all pages, not only the first page. But it doesn't for SG pages. So, SG pages u
pping and reset page pointer to NULL for all pages, not only the first page. But it doesn't for SG pages. So, SG pages unexpectedly will be reused. It eventually causes kernel panic. Oops: general protection fault, probably for non-canonical address 0x504f4e4dbebc64ff: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.10.0-rc3+ #25 RIP: 0010:xdp_return_frame+0x42/0x90 Code: 01 75 12 5b 4c 89 e6 5d 31 c9 41 5c 31 d2 41 5d e9 73 fd ff ff 44 8b 6b 20 0f b7 43 0a 49 81 ed 68 01 00 00 49 29 c5 49 01 fd <41> 80 7d0 RSP: 0018:ffff99d00122ce08 EFLAGS: 00010202 RAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001 RDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f
RAX: 0000000000005453 RBX: ffff8d325f904000 RCX: 0000000000000001 RDX: 00000000670e1000 RSI: 000000011f90d000 RDI: 504f4e4d4c4b4a49 RBP: ffff99d003907740 R08: 0000000000000000 R09: 0000000000000000 R10: 000000011f90d000 R11: 0000000000000000 R12: ffff8d325f904010 R13: 504f4e4dbebc64fd R14: ffff8d3242b070c8 R15: ffff99d0039077c0 FS: 0000000000000000(0000) GS:ffff8d399f780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f41f6c85e38 CR3: 000000037ac30000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ? die_addr+0x33/0x90 ? exc_general_protection+0x251/0x2f0 ? asm_exc_general_protection+0x22/0x30 ? xdp_return_frame+0x42/0x90 ionic_tx_clean+0x21
c_general_protection+0x251/0x2f0 ? asm_exc_general_protection+0x22/0x30 ? xdp_return_frame+0x42/0x90 ionic_tx_clean+0x211/0x280 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_tx_cq_service+0xd3/0x210 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] ionic_txrx_napi+0x41/0x1b0 [ionic 15881354510e6a9c655c59c54812b319ed2cd015] __napi_poll.constprop.0+0x29/0x1b0 net_rx_action+0x2c4/0x350 handle_softirqs+0xf4/0x320 irq_exit_rcu+0x78/0xa0 common_interrupt+0x77/0x90 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f - https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed
org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f - https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed6b55bab5
CVE ID: CVE-2024-42084 State: PUBLISHED Published: 2024-07-29T16:26:20.581Z Last Updated: 2025-11-03T22:01:15.790Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based v
avior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c329760749b5419769e57cb2be80955d2805f9c9 - https://git.kernel.org/stable/c/f531d4bc6c5588d713359e42ed65e46816d841d8 - https://git.kernel.org/stable/c/84bf6b64a1a0dfc6de7e1b1c776d58d608e7865a - https://git.kernel.org/stable/c/dbb226d81cd02cee140139c2369791e6f61f2007 - https://git.kernel.org/stable/c/5ae6af68410bdad6181ec82104bb9985a7a6a0fa - https://git.kernel.org/stable/c/836359247b0403
ttps://git.kernel.org/stable/c/5ae6af68410bdad6181ec82104bb9985a7a6a0fa - https://git.kernel.org/stable/c/836359247b0403e0634bfbc83e5bb8063fad287a - https://git.kernel.org/stable/c/930a4c369f74da26816eaaa71b5888d29b759c27 - https://git.kernel.org/stable/c/4b8e88e563b5f666446d002ad0dc1e6e8e7102b0
CVE ID: CVE-2024-42085 State: PUBLISHED Published: 2024-07-29T16:26:26.284Z Last Updated: 2025-11-03T22:01:17.253Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system to enter suspend status with below command: echo mem > /sys/power/state There will be a deadlock issue occurring. Detailed invoking path as below: dwc3_suspend_common() spin_lock_irqsave(&dwc->lock, flags); <-- 1st dwc3_gadget_suspend(dwc); dwc3_gadget_soft_disconnect(dwc); spin_lock_irqsave(&dwc->lock, flags); <-
ck, flags); <-- 1st dwc3_gadget_suspend(dwc); dwc3_gadget_soft_disconnect(dwc); spin_lock_irqsave(&dwc->lock, flags); <-- 2nd This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes the code of checking whether dwc->gadget_driver is NULL or not. It causes the following code is executed and deadlock occurs when trying to get the spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3: Remove DWC3 locking during gadget suspend/resume") that forgot to remove the lock of otg mode. So, remove the redundant lock of otg mode during gadget suspend/resume. Additional Analyst Notes: - CVE Program Container: -
emove the redundant lock of otg mode during gadget suspend/resume. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8731a0b180f6b5d52397c7aeea6eda9511a467a7 - https://git.kernel.org/stable/c/7026576e89094aa9a0062aa6d10cba18aa99944c - https://git.kernel.org/stable/c/d77e2b5104c51d3668b9717c825a4a06998efe63 - https://git.kernel.org/stable/c/17e2956633ca560b95f1cbbb297cfc2adf650649 - https://git.kernel.org/stable/c/f1274cfab183e69a7c7bafffcb4f50703c876276 - https://git.kernel.org/stable/c/7838de15bb700c2898a7d741db9b1f3cbc86c136
CVE ID: CVE-2024-42086 State: PUBLISHED Published: 2024-07-29T16:26:27.075Z Last Updated: 2025-11-03T22:01:18.697Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: chemical: bme680: Fix overflows in compensate() functions There are cases in the compensate functions of the driver that there could be overflows of variables due to bit shifting ops. These implications were initially discussed here [1] and they were mentioned in log message of Commit 1b3bd8592780 ("iio: chemical: Add support for Bosch BME680 sensor"). [1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/ Additional Analyst Notes: - CVE Program
sor"). [1]: https://lore.kernel.org/linux-iio/20180728114028.3c1bbe81@archlinux/ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6fa31bbe2ea8665ee970258eb8320cbf231dbe9e - https://git.kernel.org/stable/c/b0af334616ed425024bf220adda0f004806b5feb - https://git.kernel.org/stable/c/c326551e99f5416986074ce78bef94f6a404b517 - https://git.kernel.org/stable/c/7a13d1357658d3a3c1cd7b3b9543c805a6e5e6e9 - https://git.kernel.org/stable/c/ba1bb3e2a38a7fef1c1818dd4f2d9abbfdde553a - https://git.kernel.org/stable/c/b5967393d50e3c6e632efda3ea3fdde14c1bfd0e - https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e - http
967393d50e3c6e632efda3ea3fdde14c1bfd0e - https://git.kernel.org/stable/c/3add41bbda92938e9a528d74659dfc552796be4e - https://git.kernel.org/stable/c/fdd478c3ae98c3f13628e110dce9b6cfb0d9b3c8
CVE ID: CVE-2024-42087 State: PUBLISHED Published: 2024-07-29T16:26:27.855Z Last Updated: 2025-11-03T22:01:20.186Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep The ilitek-ili9881c controls the reset GPIO using the non-sleeping gpiod_set_value() function. This complains loudly when the GPIO controller needs to sleep. As the caller can sleep, use gpiod_set_value_cansleep() to fix the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b71348be1236398be2d04c5e145fd6eaae86a91b - htt
r: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b71348be1236398be2d04c5e145fd6eaae86a91b - https://git.kernel.org/stable/c/98686ec1824728ff41d7b358131f7d0227c2ba2a - https://git.kernel.org/stable/c/cae52f61fda0f5d2949dc177f984c9e187d4c6a0 - https://git.kernel.org/stable/c/489f38de3375ab84b3d269d0a1d64d6ee95d7044 - https://git.kernel.org/stable/c/5f41401219fbe7663b3cf65ebd4ed95ebbb8ffb9 - https://git.kernel.org/stable/c/1618f7a875ffd916596392fd29880c0429b8af60 - https://git.kernel.org/stable/c/e646402bf82145349fcf5dcbe395afaf02a8ce47 - https://git.kernel.org/stable/c/ee7860cd8b5763017f8dc785c2851fecb7a0c565
CVE ID: CVE-2024-42088 State: PUBLISHED Published: 2024-07-29T16:26:28.523Z Last Updated: 2025-05-04T09:22:43.516Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") removed the codec entry for the ETDM1_OUT_BE dai link entirely instead of replacing it with COMP_EMPTY(). This worked by accident as the remaining COMP_EMPTY() platform entry became the codec entry, and the platform entry became completely empty, effectively the same as COMP_DUMMY() since snd_soc_fill_dummy_
ec entry, and the platform entry became completely empty, effectively the same as COMP_DUMMY() since snd_soc_fill_dummy_dai() doesn't do anything for platform entries. This causes a KASAN out-of-bounds warning in mtk_soundcard_common_probe() in sound/soc/mediatek/common/mtk-soundcard-driver.c: for_each_card_prelinks(card, i, dai_link) { if (adsp_node && !strncmp(dai_link->name, "AFE_SOF", strlen("AFE_SOF"))) dai_link->platforms->of_node = adsp_node; else if (!dai_link->platforms->name && !dai_link->platforms->of_node) dai_link->platforms->of_node = platform_node; } where the code expects the platforms array to have space for at least one entry. Add an COMP_EMPTY() entry so that dai_link->pla
e code expects the platforms array to have space for at least one entry. Add an COMP_EMPTY() entry so that dai_link->platforms has space. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/42b9ab7a4d7e6c5efd71847541e4fcc213585aad - https://git.kernel.org/stable/c/282a4482e198e03781c152c88aac8aa382ef9a55
CVE ID: CVE-2024-42089 State: PUBLISHED Published: 2024-07-29T16:26:29.288Z Last Updated: 2025-11-03T22:01:21.638Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl-asoc-card: set priv->pdev before using it priv->pdev pointer was set after being used in fsl_asoc_card_audmux_init(). Move this assignment at the start of the probe function, so sub-functions can correctly use pdev through priv. fsl_asoc_card_audmux_init() dereferences priv->pdev to get access to the dev struct, used with dev_err macros. As priv is zero-initialised, there would be a NULL pointer dereference. Note that if priv->dev is dereferenced before assig
priv is zero-initialised, there would be a NULL pointer dereference. Note that if priv->dev is dereferenced before assignment but never used, for example if there is no error to be printed, the driver won't crash probably due to compiler optimisations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ae81535ce2503aabc4adab3472f4338070cdeb6a - https://git.kernel.org/stable/c/8896e18b7c366f8faf9344abfd0971435f1c723a - https://git.kernel.org/stable/c/3662eb2170e59b58ad479982dc1084889ba757b9 - https://git.kernel.org/stable/c/544ab46b7ece6d6bebbdee5d5659c0a0f804a99a - https://git.kernel.org/stable/c/8faf91e58425c2f6ce773250d
kernel.org/stable/c/544ab46b7ece6d6bebbdee5d5659c0a0f804a99a - https://git.kernel.org/stable/c/8faf91e58425c2f6ce773250dfd995f1c2d461ac - https://git.kernel.org/stable/c/29bc9e7c75398b0d12fc30955f2e9b2dd29ffaed - https://git.kernel.org/stable/c/7c18b4d89ff9c810b6e562408afda5ce165c4ea6 - https://git.kernel.org/stable/c/90f3feb24172185f1832636264943e8b5e289245
CVE ID: CVE-2024-42090 State: PUBLISHED Published: 2024-07-29T16:26:30.139Z Last Updated: 2025-11-03T22:01:23.115Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER, create_pinctrl() calls pinctrl_free(). However, pinctrl_free() attempts to acquire pinctrl_maps_mutex, which is already held by create_pinctrl(), leading to a potential deadlock. This patch resolves the issue by releasing pinctrl_maps_mutex before calling pinctrl_free(), preventin