Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40924 State: PUBLISHED Published: 2024-07-12T12:25:04.991Z Last Updated: 2025-11-03T21:57:53.715Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries to rewrite the PTEs via a stale CPU mapping. This causes panic. [vsyrjala: Add TODO comment] (cherry picked from commit 51064d471c53dcc8eddd2333c3f1c1d9131ba36c) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/327280149066f0e5f2e50356b5823f76dabfe86e - https://git.kernel.org/stable/c/7a9883be3b98673333eec65c4a21cc18e60292eb - https://git.kernel.org/stable/c/a2552020fb714ff357182c3c179abfac2289f84d - https://git.kernel.org/stable/c/43e2b37e2ab660c3565d4cff27922bc70e79c3f1
CVE ID: CVE-2024-40925 State: PUBLISHED Published: 2024-07-12T12:25:05.747Z Last Updated: 2025-05-04T09:17:58.688Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: fix request.queuelist usage in flush Friedrich Weber reported a kernel crash problem and bisected to commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine"). The root cause is that we use "list_move_tail(&rq->queuelist, pending)" in the PREFLUSH/POSTFLUSH sequences. But rq->queuelist.next == xxx since it's popped out from plug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, althou
lug->cached_rq in __blk_mq_alloc_requests_batch(). We don't initialize its queuelist just for this first request, although the queuelist of all later popped requests will be initialized. Fix it by changing to use "list_add_tail(&rq->queuelist, pending)" so rq->queuelist doesn't need to be initialized. It should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH, has no move actually. Please note the commit 81ada09cc25e ("blk-flush: reuse rq queuelist in flush state machine") also has another requirement that no drivers would touch rq->queuelist after blk_mq_end_request() since we will reuse it to add rq to the post-flush pending list in POSTFLUSH. If this is not true, we will hav
request() since we will reuse it to add rq to the post-flush pending list in POSTFLUSH. If this is not true, we will have to revert that commit IMHO. This updated version adds "list_del_init(&rq->queuelist)" in flush rq callback since the dm layer may submit request of a weird invalid format (REQ_FSEQ_PREFLUSH | REQ_FSEQ_POSTFLUSH), which causes double list_add if without this "list_del_init(&rq->queuelist)". The weird invalid format problem should be fixed in dm layer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fe1e395563ccb051e9dbd8fa99859f5caaad2e71 - https://git.kernel.org/stable/c/87907bd69721a8506618a954d41a
nel.org/stable/c/fe1e395563ccb051e9dbd8fa99859f5caaad2e71 - https://git.kernel.org/stable/c/87907bd69721a8506618a954d41a1de3040e88aa - https://git.kernel.org/stable/c/d0321c812d89c5910d8da8e4b10c891c6b96ff70
CVE ID: CVE-2024-40926 State: PUBLISHED Published: 2024-07-12T12:25:06.435Z Last Updated: 2025-05-04T09:18:00.093Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't attempt to schedule hpd_work on headless cards If the card doesn't have display hardware, hpd_work and hpd_lock are left uninitialized which causes BUG when attempting to schedule hpd_work on runtime PM resume. Fix it by adding headless flag to DRM and skip any hpd if it's set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f - https://gi
SA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/227349998e5740f14d531b0f0d704e66b1ed3c2f - https://git.kernel.org/stable/c/b96a225377b6602299a03d2ce3c289b68cd41bb7
CVE ID: CVE-2024-40927 State: PUBLISHED Published: 2024-07-12T12:25:07.101Z Last Updated: 2025-11-03T21:57:55.158Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset properly and the caches cleared. Change the logic so that any N>1 TDs found active for different streams are deferred until after the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue a
fter the first one is processed, calling xhci_invalidate_cancelled_tds() again from xhci_handle_cmd_set_deq() to queue another command until we are done with all of them. Also change the error/"should never happen" paths to ensure we at least clear any affected TDs, even if we can't issue a command to clear the hardware cache, and complain loudly with an xhci_warn() if this ever happens. This problem case dates back to commit e9df17eb1408 ("USB: xhci: Correct assumptions about number of rings per endpoint.") early on in the XHCI driver's life, when stream support was first added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted
added. It was then identified but not fixed nor made into a warning in commit 674f8438c121 ("xhci: split handling halted endpoints into two steps"), which added a FIXME comment for the problem case (without materially changing the behavior as far as I can tell, though the new logic made the problem more obvious). Then later, in commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs."), it was acknowledged again. [Mathias: commit 94f339147fc3 ("xhci: Fix failure to give back some cached cancelled URBs.") was a targeted regression fix to the previously mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the
y mentioned patch. Users reported issues with usb stuck after unmounting/disconnecting UAS devices. This rolled back the TD clearing of multiple streams to its original state.] Apparently the commit author was aware of the problem (yet still chose to submit it): It was still mentioned as a FIXME, an xhci_dbg() was added to log the problem condition, and the remaining issue was mentioned in the commit description. The choice of making the log type xhci_dbg() for what is, at this point, a completely unhandled and known broken condition is puzzling and unfortunate, as it guarantees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you tur
ntees that no actual users would see the log in production, thereby making it nigh undebuggable (indeed, even if you turn on DEBUG, the message doesn't really hint at there being a problem at all). It took me *months* of random xHC crashes to finally find a reliable repro and be able to do a deep dive debug session, which could all have been avoided had this unhandled, broken condition been actually reported with a warning, as it should have been as a bug intentionally left in unfixed (never mind that it shouldn't have been left in at all). > Another fix to solve clearing the caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 yea
he caches of all stream rings with > cancelled TDs is needed, but not as urgent. 3 years after that statement and 14 years after the original bug was introduced, I think it's finally time to fix it. And maybe next time let's not leave bugs unfixed (that are actually worse than the original bug), and let's actually get people to review kernel commits please. Fixes xHC crashes and IOMMU faults with UAS devices when handling errors/faults. Easiest repro is to use `hdparm` to mark an early sector (e.g. 1024) on a disk as bad, then `cat /dev/sdX > /dev/null` in a loop. At least in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to differen
in the case of JMicron controllers, the read errors end up having to cancel two TDs (for two queued requests to different streams) and the one that didn't get cleared properly ends up faulting the xHC entirely when it tries to access DMA pages that have since been unmapped, referred to by the stale TDs. This normally happens quickly (after two or three loops). After this fix, I left the `cat` in a loop running overnight and experienced no xHC failures, with all read errors recovered properly. Repro'd and tested on an Apple M1 Mac Mini (dwc3 host). On systems without an IOMMU, this bug would instead silently corrupt freed memory, making this a ---truncated--- Additional Analyst Notes: - CVE P
U, this bug would instead silently corrupt freed memory, making this a ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/26460c1afa311524f588e288a4941432f0de6228 - https://git.kernel.org/stable/c/633f72cb6124ecda97b641fbc119340bd88d51a9 - https://git.kernel.org/stable/c/949be4ec5835e0ccb3e2a8ab0e46179cb5512518 - https://git.kernel.org/stable/c/61593dc413c3655e4328a351555235bc3089486a - https://git.kernel.org/stable/c/5ceac4402f5d975e5a01c806438eb4e554771577
CVE ID: CVE-2024-40928 State: PUBLISHED Published: 2024-07-12T12:25:07.769Z Last Updated: 2025-05-04T09:18:02.742Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() Clang static checker (scan-build) warning: net/ethtool/ioctl.c:line 2233, column 2 Called function pointer is null (null dereference). Return '-EOPNOTSUPP' when 'ops->get_ethtool_phy_stats' is NULL to fix this typo error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6548d543a27449a1a3d8079925de93f5764d6f22 - https://git.k
ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6548d543a27449a1a3d8079925de93f5764d6f22 - https://git.kernel.org/stable/c/92196be82a4eb61813833dc62876fd198ae51ab1 - https://git.kernel.org/stable/c/0dcc53abf58d572d34c5313de85f607cd33fc691
CVE ID: CVE-2024-40929 State: PUBLISHED Published: 2024-07-12T12:25:08.434Z Last Updated: 2025-11-03T21:57:56.614Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids In some versions of cfg80211, the ssids poinet might be a valid one even though n_ssids is 0. Accessing the pointer in this case will cuase an out-of-bound access. Fix this by checking n_ssids first. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b - https://git.kernel.org/stable/c/f777792952d03bb
tps://git.kernel.org/stable/c/3c4771091ea8016c8601399078916f722dd8833b - https://git.kernel.org/stable/c/f777792952d03bbaf8329fdfa99393a5a33e2640 - https://git.kernel.org/stable/c/9e719ae3abad60e245ce248ba3f08148f375a614 - https://git.kernel.org/stable/c/29a18d56bd64b95bd10bda4afda512558471382a - https://git.kernel.org/stable/c/62e007bdeb91c6879a4652c3426aef1cd9d2937b - https://git.kernel.org/stable/c/60d62757df30b74bf397a2847a6db7385c6ee281
CVE ID: CVE-2024-40930 State: PUBLISHED Published: 2024-07-12T12:25:09.110Z Last Updated: 2025-05-04T09:18:10.619Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate HE operation element parsing Validate that the HE operation element has the correct length before parsing it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f15e3e13e14cc5ae8f950c16efe706add18ac8e2 - https://git.kernel.org/stable/c/4dc3a3893dae5a7f73e5809273aca0f1f3548d55
CVE ID: CVE-2024-40931 State: PUBLISHED Published: 2024-07-12T12:25:09.778Z Last Updated: 2025-11-03T21:57:58.084Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkaller can trigger the retransmit after fallback and before processing any other incoming packet - so that snd_una is still left uninitialized. Address the issue explicitly initializing snd_una together with snd_nxt and write_seq. Additional Analyst Notes: - CVE Program Container: - C
licitly initializing snd_una together with snd_nxt and write_seq. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/208cd22ef5e57f82d38ec11c1a1703f9401d6dde - https://git.kernel.org/stable/c/7b9c7fc8600b64a86e4b47b2d190bba380267726 - https://git.kernel.org/stable/c/f03c46eabb3a67bd2993e237ab5517f00a5f1813 - https://git.kernel.org/stable/c/f1f0a46f8bb8890b90ab7194f0a0c8fe2a3fb57f - https://git.kernel.org/stable/c/ef473bf1dd7e8dd08bcc04b9e2d1bfed69a0a7ce - https://git.kernel.org/stable/c/8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3
CVE ID: CVE-2024-40932 State: PUBLISHED Published: 2024-07-12T12:25:10.444Z Last Updated: 2025-11-03T21:57:59.558Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/exynos/vidi: fix memory leak in .get_modes() The duplicated EDID is never freed. Fix it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/540ca99729e28dbe902b01039a3b4bd74520a819 - https://git.kernel.org/stable/c/ebcf81504fef03f701b9711e43fea4fe2d82ebc8 - https://git.kernel.org/stable/c/0acc356da8546b5c55aabfc2e2c5caa0ac9b0003 - https://git.kernel.org/stable/c/777838c9b571674ef14dbddf671f37226
rg/stable/c/0acc356da8546b5c55aabfc2e2c5caa0ac9b0003 - https://git.kernel.org/stable/c/777838c9b571674ef14dbddf671f372265879226 - https://git.kernel.org/stable/c/dcba6bedb439581145d8aa6b0925209f23184ae1 - https://git.kernel.org/stable/c/a269c5701244db2722ae0fce5d1854f5d8f31224 - https://git.kernel.org/stable/c/cb3ac233434dba130281db330c4b15665b2d2c4d - https://git.kernel.org/stable/c/38e3825631b1f314b21e3ade00b5a4d737eb054e
CVE ID: CVE-2024-40933 State: PUBLISHED Published: 2024-07-12T12:25:11.106Z Last Updated: 2025-05-04T09:18:14.667Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe() When devm_regmap_init_i2c() fails, regmap_ee could be error pointer, instead of checking for IS_ERR(regmap_ee), regmap is checked which looks like a copy paste error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5a5595ae8cc7cdaa1a10b56a26ddbe3429245c6c - https://git.kernel.org/stable/c/a23c14b062d8800a2192077d83273bbfe6c75
table/c/5a5595ae8cc7cdaa1a10b56a26ddbe3429245c6c - https://git.kernel.org/stable/c/a23c14b062d8800a2192077d83273bbfe6c7552d
CVE ID: CVE-2024-40934 State: PUBLISHED Published: 2024-07-12T12:25:11.836Z Last Updated: 2025-11-03T21:58:01.007Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode() Fix a memory leak on logi_dj_recv_send_report() error path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/15122dc140d82c51c216535c57b044c4587aae45 - https://git.kernel.org/stable/c/caa9c9acb93db7ad7b74b157cf101579bac9596d - https://git.kernel.org/stable/c/a0503757947f2e46e59c1962326b53b3208c8213 - https://git.kernel.org/stabl
101579bac9596d - https://git.kernel.org/stable/c/a0503757947f2e46e59c1962326b53b3208c8213 - https://git.kernel.org/stable/c/789c99a1d7d2c8f6096d75fc2930505840ec9ea0 - https://git.kernel.org/stable/c/f677ca8cfefee2a729ca315f660cd4868abdf8de - https://git.kernel.org/stable/c/1df2ead5dfad5f8f92467bd94889392d53100b98 - https://git.kernel.org/stable/c/ce3af2ee95170b7d9e15fff6e500d67deab1e7b3
CVE ID: CVE-2024-40935 State: PUBLISHED Published: 2024-07-12T12:25:12.483Z Last Updated: 2025-11-03T21:58:02.518Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cachefiles: flush all requests after setting CACHEFILES_DEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILES_DEAD, the cachefiles_daemon_write() will always return -EIO, so the daemon can't pass the copen to the kernel. Then the kernel process that is waiting for the copen triggers a hung_task. Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cac
sk. Since the DEAD state is irreversible, it can only be exited by closing /dev/cachefiles. Therefore, after calling cachefiles_io_error() to mark the cache as CACHEFILES_DEAD, if in ondemand mode, flush all requests to avoid the above hungtask. We may still be able to read some of the cached data before closing the fd of /dev/cachefiles. Note that this relies on the patch that adds reference counting to the req, otherwise it may UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/320ba9cbca78be79c912143bbba1d1b35ca55cf0 - https://git.kernel.org/stable/c/3bf0b8030296e9ee60d3d4c15849ad9ac0b47081 - https://git.kernel.or
2143bbba1d1b35ca55cf0 - https://git.kernel.org/stable/c/3bf0b8030296e9ee60d3d4c15849ad9ac0b47081 - https://git.kernel.org/stable/c/e73fac95084839c5178d97e81c6a2051251bdc00 - https://git.kernel.org/stable/c/85e833cd7243bda7285492b0653c3abb1e2e757b
CVE ID: CVE-2024-40936 State: PUBLISHED Published: 2024-07-12T12:25:13.155Z Last Updated: 2025-05-04T09:18:18.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix memregion leaks in devm_cxl_add_region() Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d8316838aa0686da63a8be4194b7a17b0103ae4a - https://git.kernel.org/stable/c/bbb5d8746381c82f7e0fb6171094d375b492f266 - https://git.kernel.org/stable/c/49ba7b515c4c0719b866d16f068e62d16a
g/stable/c/bbb5d8746381c82f7e0fb6171094d375b492f266 - https://git.kernel.org/stable/c/49ba7b515c4c0719b866d16f068e62d16a8a3dd1
CVE ID: CVE-2024-40937 State: PUBLISHED Published: 2024-07-12T12:25:13.807Z Last Updated: 2025-11-03T21:58:03.988Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gve: Clear napi->skb before dev_kfree_skb_any() gve_rx_free_skb incorrectly leaves napi->skb referencing an skb after it is freed with dev_kfree_skb_any(). This can result in a subsequent call to napi_get_frags returning a dangling pointer. Fix this by clearing napi->skb before the skb is freed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc - https://git
A ADP Vulnrichment: References: - https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc - https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442 - https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037 - https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50 - https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e
CVE ID: CVE-2024-40938 State: PUBLISHED Published: 2024-07-12T12:25:14.463Z Last Updated: 2025-11-03T21:58:05.436Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: landlock: Fix d_parent walk The WARN_ON_ONCE() in collect_domain_accesses() can be triggered when trying to link a root mount point. This cannot work in practice because this directory is mounted, but the VFS check is done after the call to security_path_link(). Do not use source directory's d_parent when the source directory is the mount point. [mic: Fix commit message] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://g
Fix commit message] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b6e5e696435832b33e40775f060ef5c95f4fda1f - https://git.kernel.org/stable/c/cc30d05b34f9a087a6928d09b131f7b491e9ab11 - https://git.kernel.org/stable/c/c7618c7b0b8c45bcef34410cc1d1e953eb17f8f6 - https://git.kernel.org/stable/c/88da52ccd66e65f2e63a6c35c9dff55d448ef4dc
CVE ID: CVE-2024-40939 State: PUBLISHED Published: 2024-07-12T12:25:15.148Z Last Updated: 2025-11-03T21:58:06.908Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipc_devlink_create_region(), previously created regions delete process starts from tainted pointer which actually holds error code value. Fix this bug by decreasing region index before delete. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.k
org) with SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fe394d59cdae81389dbf995e87c83c1acd120597 - https://git.kernel.org/stable/c/040d9384870386eb5dc55472ac573ac7756b2050 - https://git.kernel.org/stable/c/37a438704d19bdbe246d51d3749b6b3a8fe65afd - https://git.kernel.org/stable/c/b0c9a26435413b81799047a7be53255640432547
CVE ID: CVE-2024-40940 State: PUBLISHED Published: 2024-07-12T12:25:15.808Z Last Updated: 2025-11-03T21:58:08.367Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail In case of flow rule creation fail in mlx5_lag_create_port_sel_table(), instead of previously created rules, the tainted pointer is deleted deveral times. Fix this bug by using correct flow rules pointers. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/531eab
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/531eab2da27dd42d68dfb841d82e987f4a6738b8 - https://git.kernel.org/stable/c/d857df86837ac1c30592e8a068204d16feac9930 - https://git.kernel.org/stable/c/a03a3fa12769e25f4385bee587afe1445aee7f7a - https://git.kernel.org/stable/c/229bedbf62b13af5aba6525ad10b62ad38d9ccb5
CVE ID: CVE-2024-40941 State: PUBLISHED Published: 2024-07-12T12:25:16.471Z Last Updated: 2025-11-03T21:58:09.834Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a notification that claims it has more data than it has, we will read past that was allocated for the notification. Remove the print of the buffer, we won't see it by default. If needed, we can see the content with tracing. This was reported by KFENCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/15b37c6fab9d