Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-41064 State: PUBLISHED Published: 2024-07-29T14:57:26.086Z Last Updated: 2025-11-03T22:00:13.274Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a copy of edev->pdev->bus. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8836e1bf5838ac6c08760e0a2dd7cf6410aa7ff3 - https://git.kernel.org/stable/c/033c51dfdbb6b79ab43fb3587276fa82d0a329e1 - h
/8836e1bf5838ac6c08760e0a2dd7cf6410aa7ff3 - https://git.kernel.org/stable/c/033c51dfdbb6b79ab43fb3587276fa82d0a329e1 - https://git.kernel.org/stable/c/4fad7fef847b6028475dd7b4c14fcb82b3e51274 - https://git.kernel.org/stable/c/4bc246d2d60d071314842fa448faa4ed39082aff - https://git.kernel.org/stable/c/f23c3d1ca9c4b2d626242a4e7e1ec1770447f7b5 - https://git.kernel.org/stable/c/428d940a8b6b3350b282c14d3f63350bde65c48b - https://git.kernel.org/stable/c/a1216e62d039bf63a539bbe718536ec789a853dd
CVE ID: CVE-2024-41065 State: PUBLISHED Published: 2024-07-29T14:57:27.011Z Last Updated: 2025-11-03T22:00:14.771Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as shown below. kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt d
pSeries Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85 Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries NIP: c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8 REGS: c000000120c078c0 TRAP: 0700 Not tainted (6.10.0-rc3) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 2828220f XER: 0000000e CFAR: c0000000001fdc80 IRQMASK: 0 [ ... GPRs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Tra
Rs omitted ... ] NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0 LR [c0000000005d23d0] usercopy_abort+0x74/0xb0 Call Trace: usercopy_abort+0x74/0xb0 (unreliable) __check_heap_object+0xf8/0x120 check_heap_object+0x218/0x240 __check_object_size+0x84/0x1a4 dtl_file_read+0x17c/0x2c4 full_proxy_read+0x8c/0x110 vfs_read+0xdc/0x3a0 ksys_read+0x84/0x144 system_call_exception+0x124/0x330 system_call_vectored_common+0x15c/0x2ec --- interrupt: 3000 at 0x7fff81f3ab34 Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") requires that only whitelisted areas in slab/slub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hy
ub objects can be copied to userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY. Dtl contains hypervisor dispatch events which are expected to be read by privileged users. Hence mark this safe for user access. Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the entire object. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a7b952941ce07e1e7a2cafd08c64a98e14f553e6 - https://git.kernel.org/stable/c/6b16098148ea58a67430d90e20476be2377c3acd - https://git.kernel.org/stable/c/e59822f9d700349cd17968d22c979db23a2d347f - https://git.kernel.org/stable/c/1ee68686d1e2a5da35d5650be0be1ce06f
g/stable/c/e59822f9d700349cd17968d22c979db23a2d347f - https://git.kernel.org/stable/c/1ee68686d1e2a5da35d5650be0be1ce06fe2ceb2 - https://git.kernel.org/stable/c/e512a59b472684d8585125101ab03b86c2c1348a - https://git.kernel.org/stable/c/0f5892212c27be31792ef1daa89c8dac1b3047e4 - https://git.kernel.org/stable/c/1a14150e1656f7a332a943154fc486504db4d586
CVE ID: CVE-2024-41066 State: PUBLISHED Published: 2024-07-29T14:57:27.832Z Last Updated: 2025-11-03T22:00:16.258Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consumer_index] = IBMVNIC_INVALID_MAP; consumer_index ++; Where variable data looks like this: free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3] consumer_index^ tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null] The driver has checks to ensure that free_map[cons
ndex^ tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null] The driver has checks to ensure that free_map[consumer_index] pointed to a valid index but there was no check to ensure that this index pointed to an unused/null skb address. So, if, by some chance, our free_map and tx_buff lists become out of sync then we were previously risking an skb memory leak. This could then cause tcp congestion control to stop sending packets, eventually leading to ETIMEDOUT. Therefore, add a conditional to ensure that the skb address is null. If not then warn the user (because this is still a bug that should be patched) and free the old pointer to prevent memleak/tcp problems. Additional Analyst N
is is still a bug that should be patched) and free the old pointer to prevent memleak/tcp problems. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/16ad1557cae582e79bb82dddd612d9bdfaa11d4c - https://git.kernel.org/stable/c/267c61c4afed0ff9a2e83462abad3f41d8ca1f06 - https://git.kernel.org/stable/c/e7b75def33eae61ddaad6cb616c517dc3882eb2a - https://git.kernel.org/stable/c/0983d288caf984de0202c66641577b739caad561
CVE ID: CVE-2024-41067 State: PUBLISHED Published: 2024-07-29T14:57:28.543Z Last Updated: 2025-05-04T09:21:21.380Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: handle RST lookup error correctly [BUG] When running btrfs/060 with forced RST feature, it would crash the following ASSERT() inside scrub_read_endio(): ASSERT(sector_nr < stripe->nr_sectors); Before that, we would have tree dump from btrfs_get_raid_extent_offset(), as we failed to find the RST entry for the range. [CAUSE] Inside scrub_submit_extent_sector_read() every time we allocated a new bbio we immediately called btrfs_map_block() to make sure there
ubmit_extent_sector_read() every time we allocated a new bbio we immediately called btrfs_map_block() to make sure there was some RST range covering the scrub target. But if btrfs_map_block() fails, we immediately call endio for the bbio, while the bbio is newly allocated, it's completely empty. Then inside scrub_read_endio(), we go through the bvecs to find the sector number (as bi_sector is no longer reliable if the bio is submitted to lower layers). And since the bio is empty, such bvecs iteration would not find any sector matching the sector, and return sector_nr == stripe->nr_sectors, triggering the ASSERT(). [FIX] Instead of calling btrfs_map_block() after allocating a new bbio, call b
ipe->nr_sectors, triggering the ASSERT(). [FIX] Instead of calling btrfs_map_block() after allocating a new bbio, call btrfs_map_block() first. Since our only objective of calling btrfs_map_block() is only to update stripe_len, there is really no need to do that after btrfs_alloc_bio(). This new timing would avoid the problem of handling empty bbio completely, and in fact fixes a possible race window for the old code, where if the submission thread is the only owner of the pending_io, the scrub would never finish (since we didn't decrease the pending_io counter). Although the root cause of RST lookup failure still needs to be addressed. Additional Analyst Notes: - CVE Program Container: - CI
he root cause of RST lookup failure still needs to be addressed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/17d1fd302a53d7e456a7412da74be74a0cf63a72 - https://git.kernel.org/stable/c/2c49908634a2b97b1c3abe0589be2739ac5e7fd5
CVE ID: CVE-2024-41068 State: PUBLISHED Published: 2024-07-29T14:57:29.360Z Last Updated: 2025-11-03T22:00:17.751Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclp_init() cleanup on failure If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added several times to sclp_reg_list, which results in the following warning: ------------[ cut here ]------------ list_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0
98bf0, next=000003ffe1598c10. WARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3 Krnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 ... Call Trace: [<000003ffe0d6076a>] __list_add_valid_or_report+0xe2/0xf8 ([<000003ffe0d60766>] __list_add_valid_or_report+0xde/0xf8) [<000003ffe0a8d37e>] sclp_init+0x40e/0x450 [<000003ffe00009f2>] do_one_initcall+0x42/0x1e0 [<000003ffe15b77a6>] do_initcalls+0x126/0x150 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>]
0 [<000003ffe15b7a0a>] kernel_init_freeable+0x1ba/0x1f8 [<000003ffe0d6650e>] kernel_init+0x2e/0x180 [<000003ffe000301c>] __ret_from_fork+0x3c/0x60 [<000003ffe0d759ca>] ret_from_fork+0xa/0x30 Fix this by removing sclp_state_change_event from sclp_reg_list when sclp_init() fails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a778987afc36d5dc02a1f82d352a81edcaf7eb83 - https://git.kernel.org/stable/c/455a6653d8700a81aa8ed2b6442a3be476007090 - https://git.kernel.org/stable/c/2e51db7ab71b89dc5a17068f5e201c69f13a4c9a - https://git.kernel.org/stable/c/cf521049fcd07071ed42dc9758fce7d5ee120ec6 - https://git.kernel.org/stable/c
c69f13a4c9a - https://git.kernel.org/stable/c/cf521049fcd07071ed42dc9758fce7d5ee120ec6 - https://git.kernel.org/stable/c/79b4be70d5a160969b805f638ac5b4efd0aac7a3 - https://git.kernel.org/stable/c/0a31b3fdc7e735c4f8c65fe4339945c717ed6808 - https://git.kernel.org/stable/c/be0259796d0b76bbc7461e12c186814a9e58244c - https://git.kernel.org/stable/c/6434b33faaa063df500af355ee6c3942e0f8d982
CVE ID: CVE-2024-41069 State: PUBLISHED Published: 2024-07-29T14:57:30.245Z Last Updated: 2025-11-03T22:00:19.311Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Fix references to freed memory Most users after parsing a topology file, release memory used by it, so having pointer references directly into topology file contents is wrong. Use devm_kmemdup(), to allocate memory as needed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b188d7f3dfab10e332e3c1066e18857964a520d2 - https://git.kernel.org/stable/c/ab5a6208b4d6872b1c6ecea1867940fc66
g/stable/c/b188d7f3dfab10e332e3c1066e18857964a520d2 - https://git.kernel.org/stable/c/ab5a6208b4d6872b1c6ecea1867940fc668cc76d - https://git.kernel.org/stable/c/ccae5c6a1fab9494c86b7856faf05e296c617702 - https://git.kernel.org/stable/c/97ab304ecd95c0b1703ff8c8c3956dc6e2afe8e1
CVE ID: CVE-2024-41070 State: PUBLISHED Published: 2024-07-29T14:57:30.952Z Last Updated: 2025-11-03T22:00:20.787Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group(). It looks up `stt` from tablefd, but then continues to use it after doing fdput() on the returned fd. After the fdput() the tablefd is free to be closed by another thread. The close calls kvm_spapr_tce_release() and then release_spapr_tce_table() (via call_rcu()) which frees `stt`. Although there are calls to rcu_read_
e_release() and then release_spapr_tce_table() (via call_rcu()) which frees `stt`. Although there are calls to rcu_read_lock() in kvm_spapr_tce_attach_iommu_group() they are not sufficient to prevent the UAF, because `stt` is used outside the locked regions. With an artifcial delay after the fdput() and a userspace program which triggers the race, KASAN detects the UAF: BUG: KASAN: slab-use-after-free in kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm] Read of size 4 at addr c000200027552c30 by task kvm-vfio/2505 CPU: 54 PID: 2505 Comm: kvm-vfio Not tainted 6.10.0-rc3-next-20240612-dirty #1 Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV Call Trace: dump_s
t-20240612-dirty #1 Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV Call Trace: dump_stack_lvl+0xb4/0x108 (unreliable) print_report+0x2b4/0x6ec kasan_report+0x118/0x2b0 __asan_load4+0xb8/0xd0 kvm_spapr_tce_attach_iommu_group+0x298/0x720 [kvm] kvm_vfio_set_attr+0x524/0xac0 [kvm] kvm_device_ioctl+0x144/0x240 [kvm] sys_ioctl+0x62c/0x1810 system_call_exception+0x190/0x440 system_call_vectored_common+0x15c/0x2ec ... Freed by task 0: ... kfree+0xec/0x3e0 release_spapr_tce_table+0xd4/0x11c [kvm] rcu_core+0x568/0x16a0 handle_softirqs+0x23c/0x920 do_softirq_own_stack+0x6c/0x90 do_softirq_own_stack+0x58/0x90 __irq_exit_rcu+0x218/0x2d0 irq_exit+0x30/0x80 arch_local_irq
_softirq_own_stack+0x6c/0x90 do_softirq_own_stack+0x58/0x90 __irq_exit_rcu+0x218/0x2d0 irq_exit+0x30/0x80 arch_local_irq_restore+0x128/0x230 arch_local_irq_enable+0x1c/0x30 cpuidle_enter_state+0x134/0x5cc cpuidle_enter+0x6c/0xb0 call_cpuidle+0x7c/0x100 do_idle+0x394/0x410 cpu_startup_entry+0x60/0x70 start_secondary+0x3fc/0x410 start_secondary_prolog+0x10/0x14 Fix it by delaying the fdput() until `stt` is no longer in use, which is effectively the entire function. To keep the patch minimal add a call to fdput() at each of the existing return paths. Future work can convert the function to goto or __cleanup style cleanup. With the fix in place the test case no longer triggers the UAF. Additiona
e function to goto or __cleanup style cleanup. With the fix in place the test case no longer triggers the UAF. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/be847bb20c809de8ac124431b556f244400b0491 - https://git.kernel.org/stable/c/4cdf6926f443c84f680213c7aafbe6f91a5fcbc0 - https://git.kernel.org/stable/c/b26c8c85463ef27a522d24fcd05651f0bb039e47 - https://git.kernel.org/stable/c/5f856023971f97fff74cfaf21b48ec320147b50a - https://git.kernel.org/stable/c/82c7a4cf14aa866f8f7f09e662b02eddc49ee0bf - https://git.kernel.org/stable/c/9975f93c760a32453d7639cf6fcf3f73b4e71ffe - https://git.kernel.org/stable/c/a986fa57fd81a1430
s://git.kernel.org/stable/c/9975f93c760a32453d7639cf6fcf3f73b4e71ffe - https://git.kernel.org/stable/c/a986fa57fd81a1430e00b3c6cf8a325d6f894a63
CVE ID: CVE-2024-41071 State: REJECTED Published: 2024-07-29T14:57:31.623Z Last Updated: 2025-02-05T18:49:05.405Z Description: No description available.
CVE ID: CVE-2024-41072 State: PUBLISHED Published: 2024-07-29T14:57:32.432Z Last Updated: 2025-11-03T22:00:25.315Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MAX_FREQUENCIES and reject invalid request with -EINVAL otherwise. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b02ba9a0b55b762bd04743a22f3d9f9645005e79 - https://git.kernel.org/stable/c/de5fcf757e33596eed32
/git.kernel.org/stable/c/b02ba9a0b55b762bd04743a22f3d9f9645005e79 - https://git.kernel.org/stable/c/de5fcf757e33596eed32de170ce5a93fa44dd2ac - https://git.kernel.org/stable/c/6295bad58f988eaafcf0e6f8b198a580398acb3b - https://git.kernel.org/stable/c/a43cc0558530b6c065976b6b9246f512f8d3593b - https://git.kernel.org/stable/c/001120ff0c9e3557dee9b5ee0d358e0fc189996f - https://git.kernel.org/stable/c/fe9644efd86704afe50e56b64b609de340ab7c95 - https://git.kernel.org/stable/c/35cee10ccaee5bd451a480521bbc25dc9f07fa5b - https://git.kernel.org/stable/c/6ef09cdc5ba0f93826c09d810c141a8d103a80fc
CVE ID: CVE-2024-41073 State: PUBLISHED Published: 2024-07-29T14:57:33.253Z Last Updated: 2025-11-03T22:00:26.841Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECIAL_LOAD when the request is cleaned. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/882574942a9be8b9d70d13462ddacc80c4b385ba - https://git.kernel.org/stable/c/c5942a14f795de957ae9d66027aac8ff4fe70057 - https
574942a9be8b9d70d13462ddacc80c4b385ba - https://git.kernel.org/stable/c/c5942a14f795de957ae9d66027aac8ff4fe70057 - https://git.kernel.org/stable/c/f3ab45aacd25d957547fb6d115c1574c20964b3b - https://git.kernel.org/stable/c/ae84383c96d6662c24697ab6b44aae855ab670aa - https://git.kernel.org/stable/c/1b9fd1265fac85916f90b4648de02adccdb7220b - https://git.kernel.org/stable/c/e5d574ab37f5f2e7937405613d9b1a724811e5ad
CVE ID: CVE-2024-41074 State: PUBLISHED Published: 2024-07-29T14:57:33.976Z Last Updated: 2025-11-03T22:00:28.430Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set object to close if ondemand_id < 0 in copen If copen is maliciously called in the user mode, it may delete the request corresponding to the random id. And the request may have not been read yet. Note that when the object is set to reopen, the open request will be done with the still reopen state in above case. As a result, the request corresponding to this object is always skipped in select_req function, so the read request is never completed and blocks
corresponding to this object is always skipped in select_req function, so the read request is never completed and blocks other process. Fix this issue by simply set object to close if its id < 0 in copen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/703bea37d13e4ccdafd17ae7c4cb583752ba7663 - https://git.kernel.org/stable/c/c32ee78fbc670e6f90989a45d340748e34cad333 - https://git.kernel.org/stable/c/0845c553db11c84ff53fccd59da11b6d6ece4a60 - https://git.kernel.org/stable/c/4f8703fb3482f92edcfd31661857b16fec89c2c0
CVE ID: CVE-2024-41075 State: PUBLISHED Published: 2024-07-29T14:57:34.891Z Last Updated: 2025-11-03T22:00:30.195Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same. Additional
est has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3b744884c0431b5a62c92900e64bfd0ed61e8e2a - https://git.kernel.org/stable/c/36d845ccd7bf527110a65fe953886a176c209539 - https://git.kernel.org/stable/c/8aaa6c5dd2940ab934d6cd296175f43dbb32b34a - https://git.kernel.org/stable/c/a26dc49df37e996876f50a0210039b2d211fdd6f
CVE ID: CVE-2024-41076 State: PUBLISHED Published: 2024-07-29T14:57:35.807Z Last Updated: 2025-11-03T22:00:32.563Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/899604a7c958771840941caff9ee3dd8193d984c - https://git.kernel.org/stable/c/b98090699319e64f5de1e8db5bb75870f1eb1c6e - https://git.kernel.org/stable/c/d130220ccc94d74d70da984a199477937e7bf03c - https://git.kernel.org/stable/c/aad1147
c6e - https://git.kernel.org/stable/c/d130220ccc94d74d70da984a199477937e7bf03c - https://git.kernel.org/stable/c/aad11473f8f4be3df86461081ce35ec5b145ba68
CVE ID: CVE-2024-41077 State: PUBLISHED Published: 2024-07-29T14:57:36.680Z Last Updated: 2025-11-03T22:00:34.029Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size Block size should be between 512 and PAGE_SIZE and be a power of 2. The current check does not validate this, so update the check. Without this patch, null_blk would Oops due to a null pointer deref when loaded with bs=1536 [1]. [axboe: remove unnecessary braces and != 0 check] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9625afe1dd4a158a14bb50f81af9e2dac
gram Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9625afe1dd4a158a14bb50f81af9e2dac634c0b1 - https://git.kernel.org/stable/c/9b873bdaae64bddade9d8c6df23c8a31948d47d0 - https://git.kernel.org/stable/c/2772ed2fc075eef7df3789906fc9dae01e4e132e - https://git.kernel.org/stable/c/08f03186b96e25e3154916a2e70732557c770ea7 - https://git.kernel.org/stable/c/f92409a9da02f27d05d713bff5f865e386cef9b3 - https://git.kernel.org/stable/c/c462ecd659b5fce731f1d592285832fd6ad54053
CVE ID: CVE-2024-41078 State: PUBLISHED Published: 2024-07-29T15:04:15.812Z Last Updated: 2025-11-03T22:00:35.508Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. Thi
ave set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/94818bdb00ef34a996a06aa63d11f591074cb757 - https://git.kernel.org/stable/c/8a69529f22590b67bb018de9acbcf94abc8603cf - https://git.kernel.org/stable/c/