Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
8c7be9676f9d5884865 - https://git.kernel.org/stable/c/35782c32528d82aa21f84cb5ceb2abd3526a8159 - https://git.kernel.org/stable/c/a33d42b7fc24fe03f239fbb0880dd5b4b4b97c19 - https://git.kernel.org/stable/c/2b242ea14386a510010eabfbfc3ce81a101f3802 - https://git.kernel.org/stable/c/3ea3a256ed81f95ab0f3281a0e234b01a9cae605
CVE ID: CVE-2025-38701 State: PUBLISHED Published: 2025-09-04T15:32:53.071Z Last Updated: 2025-11-03T17:41:33.622Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_trunca
tem. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8085a7324d8ec448c4a764af7853e19bbd64e17a - https://git.kernel.org/stable/c/1199a6399895f4767f0b9a68a6ff47c3f799b7c7 - https://git.kernel.org/stable/c/7f322c12df7aeed1755acd3c6fab48c7807795fb - https://git.kernel.org/stable/c/2817ac83cb4732597bf36853fe13ca616f4ee4e2 - https://git.kernel.org/stable/c/d960f4b793912f35e9d72bd9d1e90553063fcbf1 - https://git.kernel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c - https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586
rnel.org/stable/c/81e7e2e7ba07e7c8cdce43ccad2f91adbc5a919c - https://git.kernel.org/stable/c/279c87ef7b9da34f65c2e4db586e730b667a6fb9 - https://git.kernel.org/stable/c/8a6f89d42e61788605722dd9faf98797c958a7e5 - https://git.kernel.org/stable/c/099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42
CVE ID: CVE-2025-38702 State: PUBLISHED Published: 2025-09-04T15:32:53.990Z Last Updated: 2025-11-03T17:41:34.563Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c3f5a25c62230b796
ess. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c3f5a25c62230b7965804ce7a2e9305c3ca3961 - https://git.kernel.org/stable/c/cbe740de32bb0fb7a5213731ff5f26ea6718fca3 - https://git.kernel.org/stable/c/806f85bdd3a60187c21437fc51baace11f659f35 - https://git.kernel.org/stable/c/2828a433c7d7a05b6f27c8148502095101dd0b09 - https://git.kernel.org/stable/c/248b2aab9b2af5ecf89d9d7955a2ff20c4b4a399 - https://git.kernel.org/stable/c/523b84dc7ccea9c4d79126d6ed1cf9033cf83b05
CVE ID: CVE-2025-38703 State: PUBLISHED Published: 2025-09-04T15:32:54.779Z Last Updated: 2025-09-29T10:47:41.720Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-f
after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock. References: - https://git.kernel.org/stable/c/b17fcce70733c211cb5dabf54f4f9491920b1d92 - https://git.kernel.org/stable/c/ba37807d08bae67de6139346a85650cab5f6145a - https://git.kernel.org/stable/c/683b0e397dad9f26a42dcacf6f7f545a77ce6c06 - https://g
d08bae67de6139346a85650cab5f6145a - https://git.kernel.org/stable/c/683b0e397dad9f26a42dcacf6f7f545a77ce6c06 - https://git.kernel.org/stable/c/6bd90e700b4285e6a7541e00f969cab0d696adde
CVE ID: CVE-2025-38704 State: PUBLISHED Published: 2025-09-04T15:32:55.718Z Last Updated: 2025-09-29T05:56:23.541Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid. This will cause the subsequent re-offload o
t this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid. This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthread_unpark() will access invalid rdp's->nocb_cb_kthread pointer. This commit therefore use rdp's->nocb_gp_kthread instead of rdp_gp's->nocb_gp_kthread for safety check. References: - https://git.kernel.org/stable/c/cce3d027227c69e85896af9fbc6fa9af5c68f067 - https://git.kernel.org/stable/c/1c951683a720b17c9ecaad1932bc95b29044611f - https://git.kernel.org/stable/c/9b5ec8e6b31755288a07b3abeeab8cd38e9d3c9d - https://git.kernel.org/stable/c/1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1
CVE ID: CVE-2025-38705 State: PUBLISHED Published: 2025-09-04T15:32:56.634Z Last Updated: 2025-09-29T05:56:24.827Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix null pointer access Writing a string without delimiters (' ', '\n', '\0') to the under gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile will result in a null pointer dereference. References: - https://git.kernel.org/stable/c/a83ffafd02a7af59848755c109d544e3894af737 - https://git.kernel.org/stable/c/5d8cc029e5595760c7d18c64632e8e40a86a9b2e - https://git.kernel.org/stable/c/cef79c18538e9ce2ca6e5b3fa95c38ec41dcd07a - https://git.kernel
c7d18c64632e8e40a86a9b2e - https://git.kernel.org/stable/c/cef79c18538e9ce2ca6e5b3fa95c38ec41dcd07a - https://git.kernel.org/stable/c/d524d40e3a6152a3ea1125af729f8cd8ca65efde
CVE ID: CVE-2025-38706 State: PUBLISHED Published: 2025-09-04T15:32:57.456Z Last Updated: 2025-11-03T17:41:36.437Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created. Additional Analyst Notes:
_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/8b465bedc2b417fd27c1d1ab7122882b4b60b1a0 - https://git.kernel.org/stable/c/82ba7b8cf9f6e3bf392a9f08ba3d1c0b200ccb94 - https://git.kernel.org/stable/c/7f8fc03712194fd4e2df28af7f7f7a38205934ef - https://git.kernel.org/stable/c/41f53afe53a57a7c50323f99424b598190acf192 - https://git.kernel.org/stable/c/2fce20decc6a83f16dd73744150c4e7ea6c97c21 - https://git.kernel.org/stable/c/cecc65827ef3df9754e097582d89569139e6cd1e - https://git.kernel.org/stable/c/7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e - https://git.ker
f9754e097582d89569139e6cd1e - https://git.kernel.org/stable/c/7ce0a7255ce97ed7c54afae83fdbce712a1f0c9e - https://git.kernel.org/stable/c/2d91cb261cac6d885954b8f5da28b5c176c18131
CVE ID: CVE-2025-38707 State: PUBLISHED Published: 2025-09-04T15:32:58.386Z Last Updated: 2025-11-03T17:41:37.372Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/bde58c1539f3ffddffc94d64007de16964e6b8eb - https://git.kernel.org/stable/c/f99eb9a641f4ef927d8724f4966dcfd1f0e9f835 - https://git.kernel.org/stable/c/3572737a768dadea904ebc4eb34b6ed575bb72d9 - https://git.kernel.org/stable/c/2ac47f738ddfc1957a33be163bc97ee8f
rg/stable/c/3572737a768dadea904ebc4eb34b6ed575bb72d9 - https://git.kernel.org/stable/c/2ac47f738ddfc1957a33be163bc97ee8f78e85a6 - https://git.kernel.org/stable/c/b51642fc52d1c7243a9361555d5c4b24d7569d7e - https://git.kernel.org/stable/c/27ee9a42b245efe6529e28b03453291a775cb3e4 - https://git.kernel.org/stable/c/e841ecb139339602bc1853f5f09daa5d1ea920a2
CVE ID: CVE-2025-38708 State: PUBLISHED Published: 2025-09-04T15:32:59.108Z Last Updated: 2025-11-03T17:41:39.261Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling "superseeded" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No
ulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of "two-primaries" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for "test cases", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect "write conflicts", but no longer try to be smart about them. We decided to disconnect hard inst
owadays. We still detect "write conflicts", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/0336bfe9c237476bd7c45605a36ca79c2bca62e5 - https://git.kernel.org/stable/c/810cd546a29bfac90ed1328ea01d693d4bd11cb1 - https://git.kernel.org/stable/c/84ef8dd3238330d1795745ece83b19f0295751bf - https://git.kernel.org/stable/c/57418de35420cedab035aa1da8a26c0499b7f575 - https://git.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4 - https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019
t.kernel.org/stable/c/9f53b2433ad248cd3342cc345f56f5c7904bd8c4 - https://git.kernel.org/stable/c/7d483ad300fc0a06f69b019dda8f74970714baf8 - https://git.kernel.org/stable/c/46e3763dcae0ffcf8fcfaff4fc10a90a92ffdd89 - https://git.kernel.org/stable/c/3a896498f6f577e57bf26aaa93b48c22b6d20c20 - https://git.kernel.org/stable/c/00c9c9628b49e368d140cfa61d7df9b8922ec2a8
CVE ID: CVE-2025-38709 State: PUBLISHED Published: 2025-09-04T15:32:59.818Z Last Updated: 2025-10-02T13:25:58.232Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the pr
by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it. References: - https://git.kernel.org/stable/c/457d2c5e112fd08dc1039b1ae39a83ec1782360d - https://git.kernel.org/stable/c/139a000d20f2f38ce34296feddd641d730fe1c08 - https://git.kernel.org/stable/c/b928438cc87c0bf7ae078e4b7b6e14261e84c5c5 - https://git.kernel.org/stable/c/5d67b30aefeb7a949040bbb1b4e3b84c5d29a
table/c/b928438cc87c0bf7ae078e4b7b6e14261e84c5c5 - https://git.kernel.org/stable/c/5d67b30aefeb7a949040bbb1b4e3b84c5d29a624 - https://git.kernel.org/stable/c/7e49538288e523427beedd26993d446afef1a6fb
CVE ID: CVE-2025-38710 State: PUBLISHED Published: 2025-09-04T15:33:00.629Z Last Updated: 2025-09-29T05:56:31.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth
p->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'. References: - https://git.kernel.org/stable/c/53a0249d68a210c16e961b83adfa82f94ee0a53d - https://git.kernel.org/stable/c/b5f46951e62377b6e406fadc18bc3c5bdf1632a7 - https://git.kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0 - https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c
kernel.org/stable/c/9680c58675b82348ab84d387e4fa727f7587e1a0 - https://git.kernel.org/stable/c/557c024ca7250bb65ae60f16c02074106c2f197b
CVE ID: CVE-2025-38711 State: PUBLISHED Published: 2025-09-04T15:33:01.367Z Last Updated: 2025-11-03T17:41:40.187Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs
while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/9d5012ffe14120f978ee34aef4df3d6cb026b7c4 - https://git.kernel.org/stable/c/ac98d54630d5b52e3f684d872f0d82c06c418ea9 - https://git.kernel.org/stable/c/1e858a7a51c7b8b009d8f246de7ceb7743b44a71 - https://git.kernel.org/stable/c/814cfdb6358d9b84fcbec9918c8f938cc096a43a - https://git.kernel.org/stable/c/a7dddd62578c2eb6cb28b8835556a121b5157323 - https://git.ker
b84fcbec9918c8f938cc096a43a - https://git.kernel.org/stable/c/a7dddd62578c2eb6cb28b8835556a121b5157323 - https://git.kernel.org/stable/c/a726fef6d7d4cfc365d3434e3916dbfe78991a33 - https://git.kernel.org/stable/c/d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694
CVE ID: CVE-2025-38712 State: PUBLISHED Published: 2025-09-04T15:33:02.530Z Last Updated: 2025-11-03T17:41:42.137Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool. Additional Analyst Notes: - CVE Program Container: Referen
with -EIO error with a message to suggest running fsck tool. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/bb0eea8e375677f586ad11c12e2525ed3fc698c2 - https://git.kernel.org/stable/c/9046566fa692f88954dac8c510f37ee17a15fdb7 - https://git.kernel.org/stable/c/03cd1db1494cf930e2fa042c9c13e32bffdb4eba - https://git.kernel.org/stable/c/dee5c668ad71ddbcb4b48d95e8a4f371314ad41d - https://git.kernel.org/stable/c/b3359392b75395a31af739a761f48f4041148226 - https://git.kernel.org/stable/c/1bb8da27ff15e346d4bc9e248e819c9a88ebf9d6 - https://git.kernel.org/stable/c/d768e3ed430e89a699bf89d3214dcbbf4648c939 - https://git.kernel.org/stable/c/ce5e387f396cbb5c
ps://git.kernel.org/stable/c/d768e3ed430e89a699bf89d3214dcbbf4648c939 - https://git.kernel.org/stable/c/ce5e387f396cbb5c061d9837abcac731e9e06f4d - https://git.kernel.org/stable/c/c7c6363ca186747ebc2df10c8a1a51e66e0e32d9
CVE ID: CVE-2025-38713 State: PUBLISHED Published: 2025-09-04T15:33:03.464Z Last Updated: 2025-11-03T17:41:44.035Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro No
r ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][
2/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_re
9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T980
151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13:
e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805]
67.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/73f7da507d787b489761a0fa280716f84
Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/73f7da507d787b489761a0fa280716f84fa32b2f - https://git.kernel.org/stable/c/76a4c6636a69d69409aa253b049b1be717a539c5 - https://git.kernel.org/stable/c/ccf0ad56a779e6704c0b27f555dec847f50c7557 - https://git.kernel.org/stable/c/13604b1d7e7b125fb428cddbec6b8d92baad25d5 - https://git.kernel.org/stable/c/291bb5d931c6f3cd7227b913302a17be21cf53b0 - https://git.kernel.org/stable/c/f7534cbfac0a9ffa4fa17cacc6e8b6446dae24ee - https://git.kernel.org/stable/c/6f93694bcbc2c2ab3e01cd8fba2f296faf34e6b9 - https://git.kernel.org/stable/c/1ca69007e52a73bd8b84b988b61b319816ca8b01 - https://git.kernel.org/stable/c/94458781aee60
https://git.kernel.org/stable/c/1ca69007e52a73bd8b84b988b61b319816ca8b01 - https://git.kernel.org/stable/c/94458781aee6045bd3d0ad4b80b02886b9e2219b