Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdbeeb7d1ff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 c9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 1c 8e 02 00 48 RSP: 002b:00007fdbee5ff000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fdbeed36058 RCX: 00007fdbeeb7d1ff RDX: 000000000000008e RSI: 0000000020000040 RDI: 00000000000000c8 RBP: 00007fdbeebf12be R08: 0000000 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - htt
8: 0000000 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4f7b586aae53c2ed820661803da8ce18b1361921 - https://git.kernel.org/stable/c/fef63832317d9d24e1214cdd8f204d02ebdf8499 - https://git.kernel.org/stable/c/f85b057e34419e5ec0583a65078a11ccc1d4540a - https://git.kernel.org/stable/c/4ed234fe793f27a3b151c43d2106df2ff0d81aac
CVE ID: CVE-2024-50257 State: PUBLISHED Published: 2024-11-09T10:15:10.373Z Last Updated: 2025-11-03T22:27:37.629Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: Fix use-after-free in get_info() ip6table_nat module unload has refcnt warning for UAF. call trace is: WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Modules linked in: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc4-00047-gc2ee9f594da8-dirty #205 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Call Trace
FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:module_put+0x6f/0x80 Call Trace: <TASK> get_info+0x128/0x180 do_ip6t_get_ctl+0x6a/0x430 nf_getsockopt+0x46/0x80 ipv6_getsockopt+0xb9/0x100 rawv6_getsockopt+0x42/0x190 do_sock_getsockopt+0xaa/0x180 __sys_getsockopt+0x70/0xc0 __x64_sys_getsockopt+0x20/0x30 do_syscall_64+0xa2/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Concurrent execution of module unload and get_info() trigered the warning. The root cause is as follows: cpu0 cpu1 module_exit //mod->state = MODULE_STATE_GOING ip6table_nat_exit xt_unregister_template kfree(t) //removed from templ_list getinfo() t = xt_find_table_lock list_for_each_entry(
nat_exit xt_unregister_template kfree(t) //removed from templ_list getinfo() t = xt_find_table_lock list_for_each_entry(tmpl, &xt_templates[af]...) if (strcmp(tmpl->name, name)) continue; //table not found try_module_get list_for_each_entry(t, &xt_net->tables[af]...) return t; //not get refcnt module_put(t->me) //uaf unregister_pernet_subsys //remove table from xt_net list While xt_table module was going away and has been removed from xt_templates list, we couldnt get refcnt of xt_table->me. Check module in xt_net->tables list re-traversal to fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba22ea01348384df19cc1
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba22ea01348384df19cc1fabc7964be6e7189749 - https://git.kernel.org/stable/c/cb7c388b5967946f097afdb759b7c860305f2d96 - https://git.kernel.org/stable/c/6a1f088f9807f5166f58902d26246d0b88da03a8 - https://git.kernel.org/stable/c/bab3bb35c03b263c486833d50d50c081d9e9832b - https://git.kernel.org/stable/c/f48d258f0ac540f00fa617dac496c4c18b5dc2fa
CVE ID: CVE-2024-50258 State: PUBLISHED Published: 2024-11-09T10:15:11.311Z Last Updated: 2025-11-03T20:44:40.488Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix crash when config small gso_max_size/gso_ipv4_max_size Config a small gso_max_size/gso_ipv4_max_size will lead to an underflow in sk_dst_gso_max_size(), which may trigger a BUG_ON crash, because sk->sk_gso_max_size would be much bigger than device limits. Call Trace: tcp_write_xmit tso_segs = tcp_init_tso_segs(skb, mss_now); tcp_set_skb_tso_segs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -> 0 tso_segs = DIV_ROUND_UP
egs tcp_skb_pcount_set // skb->len = 524288, mss_now = 8 // u16 tso_segs = 524288/8 = 65535 -> 0 tso_segs = DIV_ROUND_UP(skb->len, mss_now) BUG_ON(!tso_segs) Add check for the minimum value of gso_max_size and gso_ipv4_max_size. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/90c8482a5d9791259ba77bfdc1849fc5128b4be7 - https://git.kernel.org/stable/c/e9365368b483328639c03fc730448dccd5a25b6b - https://git.kernel.org/stable/c/ac5977001eee7660c643f8e07a2de9001990b7b8 - https://git.kernel.org/stable/c/e72fd1389a5364bc6aa6312ecf30bdb5891b9486 - https://git.kernel.org/stable/c/9ab5cf19fb0e4680f95e506d6c544259bf1111c4
CVE ID: CVE-2024-50259 State: PUBLISHED Published: 2024-11-09T10:15:12.251Z Last Updated: 2025-11-03T22:27:39.103Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() This was found by a static analyzer. We should not forget the trailing zero after copy_from_user() if we will further do some string operations, sscanf() in this case. Adding a trailing zero will ensure that the function performs properly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c2150f666c6fc301d5
otes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c2150f666c6fc301d5d1643ed0f92251f1a0ff0d - https://git.kernel.org/stable/c/bcba86e03b3aac361ea671672cf48eed11f9011c - https://git.kernel.org/stable/c/6a604877160fe5ab2e1985d5ce1ba6a61abe0693 - https://git.kernel.org/stable/c/27bd7a742e171362c9eb52ad5d1d71d3321f949f - https://git.kernel.org/stable/c/4ce1f56a1eaced2523329bef800d004e30f2f76c
CVE ID: CVE-2024-50260 State: PUBLISHED Published: 2024-11-09T10:15:13.271Z Last Updated: 2025-10-01T20:17:24.123Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sock_map: fix a NULL pointer dereference in sock_map_link_update_prog() The following race condition could trigger a NULL pointer dereference: sock_map_link_detach(): sock_map_link_update_prog(): mutex_lock(&sockmap_mutex); ... sockmap_link->map = NULL; mutex_unlock(&sockmap_mutex); mutex_lock(&sockmap_mutex); ... sock_map_prog_link_lookup(sockmap_link->map); mutex_unlock(&sockmap_mutex); <continue> Fix it by adding a NULL pointer check. In this specific case, it makes
k->map); mutex_unlock(&sockmap_mutex); <continue> Fix it by adding a NULL pointer check. In this specific case, it makes no sense to update a link which is being released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9afe35fdda16e09d5bd3c49a68ba8c680dd678bd - https://git.kernel.org/stable/c/740be3b9a6d73336f8c7d540842d0831dc7a808b
CVE ID: CVE-2024-50261 State: PUBLISHED Published: 2024-11-09T10:15:14.259Z Last Updated: 2025-11-03T22:27:40.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: macsec: Fix use-after-free while sending the offloading packet KASAN reports the following UAF. The metadata_dst, which is used to store the SCI value for macsec offload, is already freed by metadata_dst_free() in macsec_free_netdev(), while driver still use it for sending the packet. To fix this issue, dst_release() is used instead to release metadata_dst. So it is not freed instantly in macsec_free_netdev() if still referenced by skb. BUG: KASAN: slab-use-after-free
a_dst. So it is not freed instantly in macsec_free_netdev() if still referenced by skb. BUG: KASAN: slab-use-after-free in mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] Read of size 2 at addr ffff88813e42e038 by task kworker/7:2/714 [...] Workqueue: mld mld_ifc_work Call Trace: <TASK> dump_stack_lvl+0x51/0x60 print_report+0xc1/0x600 kasan_report+0xab/0xe0 mlx5e_xmit+0x1e8f/0x4190 [mlx5_core] dev_hard_start_xmit+0x120/0x530 sch_direct_xmit+0x149/0x11e0 __qdisc_run+0x3ad/0x1730 __dev_queue_xmit+0x1196/0x2ed0 vlan_dev_hard_start_xmit+0x32e/0x510 [8021q] dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 macsec_start_xmit+0x13e9/0x2340 dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0
__dev_queue_xmit+0x14a7/0x2ed0 macsec_start_xmit+0x13e9/0x2340 dev_hard_start_xmit+0x120/0x530 __dev_queue_xmit+0x14a7/0x2ed0 ip6_finish_output2+0x923/0x1a70 ip6_finish_output+0x2d7/0x970 ip6_output+0x1ce/0x3a0 NF_HOOK.constprop.0+0x15f/0x190 mld_sendpack+0x59a/0xbd0 mld_ifc_work+0x48a/0xa80 process_one_work+0x5aa/0xe50 worker_thread+0x79c/0x1290 kthread+0x28f/0x350 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x11/0x20 </TASK> Allocated by task 3922: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x77/0x90 __kmalloc_noprof+0x188/0x400 metadata_dst_alloc+0x1f/0x4e0 macsec_newlink+0x914/0x1410 __rtnl_newlink+0xe08/0x15b0 rtnl_newlink+0x5f/0x90 rtnetlink_rcv_msg+0x667/0xa80
+0x1f/0x4e0 macsec_newlink+0x914/0x1410 __rtnl_newlink+0xe08/0x15b0 rtnl_newlink+0x5f/0x90 rtnetlink_rcv_msg+0x667/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Freed by task 4011: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x50 poison_slab_object+0x10c/0x190 __kasan_slab_free+0x11/0x30 kfree+0xe0/0x290 macsec_free_netdev+0x3f/0x140 netdev_run_todo+0x450/0xc70 rtnetlink_rcv_msg+0x66f/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770
/0x140 netdev_run_todo+0x450/0xc70 rtnetlink_rcv_msg+0x66f/0xa80 netlink_rcv_skb+0x12c/0x360 netlink_unicast+0x551/0x770 netlink_sendmsg+0x72d/0xbd0 __sock_sendmsg+0xc5/0x190 ____sys_sendmsg+0x52e/0x6a0 ___sys_sendmsg+0xeb/0x170 __sys_sendmsg+0xb5/0x140 do_syscall_64+0x4c/0x100 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/872932cf75cf859804370a265dd58118129386fa - https://git.kernel.org/stable/c/9f5ae743dbe9a2458540a7d35fff0f990df025cf - https://git.kernel.org/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8 - https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f
rg/stable/c/4614640f1d5c93c22272117dc256e9940ccac8e8 - https://git.kernel.org/stable/c/f1e54d11b210b53d418ff1476c6b58a2f434dfc0
CVE ID: CVE-2024-50262 State: PUBLISHED Published: 2024-11-09T10:17:50.461Z Last Updated: 2025-11-03T22:27:42.104Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with s
ed. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e8494ac079814a53fbc2258d2743e720907488ed - https://git.kernel.org/stable/c/91afbc0eb3c90258ae378ae3c6ead3d2371e926d - https://git.kernel.org/stable/c/590976f921723d53ac199c01d5b7b73a94875e68 - https://git.kernel.org/stable/c/86c8ebe02d8806dd8878d0063e8e185622ab6ea6 - https://git.kernel.org/stable/c/a035df0b98df424559fd383e8e1a268f422ea2ba - https://git.kernel.org/stable/c/90a6e0e1e151ef7a9282e78f54c3091de2dcc99c - https://git.kernel.org/stable/c/c
f422ea2ba - https://git.kernel.org/stable/c/90a6e0e1e151ef7a9282e78f54c3091de2dcc99c - https://git.kernel.org/stable/c/c4b4f9a9ab82238cb158fa4fe61a8c0ae21a4980 - https://git.kernel.org/stable/c/13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21
CVE ID: CVE-2024-50263 State: PUBLISHED Published: 2024-11-11T13:58:18.577Z Last Updated: 2025-05-04T09:50:13.551Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fork: only invoke khugepaged, ksm hooks if no error There is no reason to invoke these hooks early against an mm that is in an incomplete state. The change in commit d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") makes this more pertinent as we may be in a state where entries in the maple tree are not yet consistent. Their placement early in dup_mmap() only appears to have been meaningful for early error checking, and since functionally it'
placement early in dup_mmap() only appears to have been meaningful for early error checking, and since functionally it'd require a very small allocation to fail (in practice 'too small to fail') that'd only occur in the most dire circumstances, meaning the fork would fail or be OOM'd in any case. Since both khugepaged and KSM tracking are there to provide optimisations to memory performance rather than critical functionality, it doesn't really matter all that much if, under such dire memory pressure, we fail to register an mm with these. As a result, we follow the example of commit d2081b2bf819 ("mm: khugepaged: make khugepaged_enter() void function") and make ksm_fork() a void function als
of commit d2081b2bf819 ("mm: khugepaged: make khugepaged_enter() void function") and make ksm_fork() a void function also. We only expose the mm to these functions once we are done with them and only if no error occurred in the fork operation. References: - https://git.kernel.org/stable/c/3b85aa0da8cd01173b9afd1f70080fbb9576c4b0 - https://git.kernel.org/stable/c/985da552a98e27096444508ce5d853244019111f - https://project-zero.issues.chromium.org/issues/373391951
CVE ID: CVE-2024-50264 State: PUBLISHED Published: 2024-11-19T01:29:59.511Z Last Updated: 2025-11-03T22:27:43.580Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df - https://git.kernel.org/stable/c/fd8ae3466
: - https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df - https://git.kernel.org/stable/c/fd8ae346692a56b4437d626c5460c7104980f389 - https://git.kernel.org/stable/c/eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1 - https://git.kernel.org/stable/c/2a6a4e69f255b7aed17f93995691ab4f0d3c2203 - https://git.kernel.org/stable/c/44d29897eafd0e1196453d3003a4d5e0b968eeab - https://git.kernel.org/stable/c/b110196fec44fe966952004bd426967c2a8fd358 - https://git.kernel.org/stable/c/5f970935d09934222fdef3d0e20c648ea7a963c1 - https://git.kernel.org/stable/c/6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f - https://a13xp0p0v.github.io/2025/09/02/kernel-hack-drill-and-CVE-2024-50264.html
CVE ID: CVE-2024-50265 State: PUBLISHED Published: 2024-11-19T01:30:00.861Z Last Updated: 2025-11-03T22:27:45.242Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): [ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 [ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57
clusters and removing the entry [ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 [...] [ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [...] [ 57.331328] Call Trace: [ 57.331477] <TASK> [...] [ 57.333511] ? do_user_addr_fault+0x3e5/0x740 [ 57.333778] ? exc_page_fault+0x70/0x170 [ 57.334016] ? asm_exc_page_fault+0x2b/0x30 [ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 [ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 [ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 [ 57.335164] ocfs2_xa_set+0x704/0xcf0 [ 57.335381] ? _raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70
_raw_spin_unlock+0x1a/0x40 [ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 [ 57.335915] ? trace_preempt_on+0x1e/0x70 [ 57.336153] ? start_this_handle+0x16c/0x500 [ 57.336410] ? preempt_count_sub+0x50/0x80 [ 57.336656] ? _raw_read_unlock+0x20/0x40 [ 57.336906] ? start_this_handle+0x16c/0x500 [ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 [ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 [ 57.337706] ? ocfs2_start_trans+0x13d/0x290 [ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 [ 57.338207] ? dput+0x46/0x1c0 [ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.3
r_trusted_set+0x28/0x30 [ 57.338948] __vfs_removexattr+0x92/0xc0 [ 57.339182] __vfs_removexattr_locked+0xd5/0x190 [ 57.339456] ? preempt_count_sub+0x50/0x80 [ 57.339705] vfs_removexattr+0x5f/0x100 [...] Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> ocfs2_xa_value_truncate() with -ENOMEM. In this case the comment mentions that we can return 0 if ocfs2_xa_cleanup_value_truncate() is going to wipe the entry anyway. But the following 'rc' check is wrong and execution flow do 'ocfs2_xa_remove_entry(loc);' twice: * 1st: in ocfs2_xa_cleanup_value_truncate(); * 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same ent
2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. Fix this by skipping the 2nd removal of the same entry and making syzkaller repro happy. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/38cbf13b2e7a31362babe411f7c2c3c52cd2734b - https://git.kernel.org/stable/c/168a9b8303fcb0317db4c06b23ce1c0ce2af4e10 - https://git.kernel.org/stable/c/6a7e6dcf90fe7721d0863067b6ca9a9442134692 - https://git.kernel.org/stable/c/dcc8fe8c83145041cb6c80cac21f6173a3ff0204 - https://git.kernel.org/stable/c/86dd0e8d42828923c68ad506933336bcd6f2317d - https://git.kernel.org/stable/c/dd73c942eed76a014c7a5597e6926435274d2c4c - htt
6dd0e8d42828923c68ad506933336bcd6f2317d - https://git.kernel.org/stable/c/dd73c942eed76a014c7a5597e6926435274d2c4c - https://git.kernel.org/stable/c/2b5369528ee63c88371816178a05b5e664c87386 - https://git.kernel.org/stable/c/0b63c0e01fba40e3992bc627272ec7b618ccaef7
CVE ID: CVE-2024-50266 State: PUBLISHED Published: 2024-11-19T01:30:02.413Z Last Updated: 2025-10-01T20:17:23.854Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: qcom: videocc-sm8350: use HW_CTRL_TRIGGER for vcodec GDSCs A recent change in the venus driver results in a stuck clock on the Lenovo ThinkPad X13s, for example, when streaming video in firefox: video_cc_mvs0_clk status stuck at 'off' WARNING: CPU: 6 PID: 2885 at drivers/clk/qcom/clk-branch.c:87 clk_branch_wait+0x144/0x15c ... Call trace: clk_branch_wait+0x144/0x15c clk_branch2_enable+0x30/0x40 clk_core_enable+0xd8/0x29c clk_enable+0x2c/0x4c vcodec_clks_enable.isr
nch_wait+0x144/0x15c clk_branch2_enable+0x30/0x40 clk_core_enable+0xd8/0x29c clk_enable+0x2c/0x4c vcodec_clks_enable.isra.0+0x94/0xd8 [venus_core] coreid_power_v4+0x464/0x628 [venus_core] vdec_start_streaming+0xc4/0x510 [venus_dec] vb2_start_streaming+0x6c/0x180 [videobuf2_common] vb2_core_streamon+0x120/0x1dc [videobuf2_common] vb2_streamon+0x1c/0x6c [videobuf2_v4l2] v4l2_m2m_ioctl_streamon+0x30/0x80 [v4l2_mem2mem] v4l_streamon+0x24/0x30 [videodev] using the out-of-tree sm8350/sc8280xp venus support. [1] Update also the sm8350/sc8280xp GDSC definitions so that the hw control mode can be changed at runtime as the venus driver now requires. Additional Analyst Notes: - CISA ADP Vulnrichment: R
ol mode can be changed at runtime as the venus driver now requires. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d055f6f2bdfb8b9c9bc071f748c16bd3afb2db0f - https://git.kernel.org/stable/c/f903663a8dcd6e1656e52856afbf706cc14cbe6d
CVE ID: CVE-2024-50267 State: PUBLISHED Published: 2024-11-19T01:30:03.929Z Last Updated: 2025-11-03T22:27:46.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) is a use after free of the "urb" pointer. Store the "dev" pointer at the start of the function to avoid this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e6ceb04eeb6115d872d4c4078d12f1170ed755ce - https://git.kernel.org/stable/c/39709ce93f5c3f9eb535efe2afe
rnel.org/stable/c/e6ceb04eeb6115d872d4c4078d12f1170ed755ce - https://git.kernel.org/stable/c/39709ce93f5c3f9eb535efe2afea088805d1128f - https://git.kernel.org/stable/c/e567fc8f7a4460e486e52c9261b1e8b9f5dc42aa - https://git.kernel.org/stable/c/44fff2c16c5aafbdb70c7183dae0a415ae74705e - https://git.kernel.org/stable/c/275258c30bbda29467216e96fb655b16bcc9992b - https://git.kernel.org/stable/c/13d6ff3ca76056d06a9d88300be2a293442ff595 - https://git.kernel.org/stable/c/314bdf446053e123f37543aa535197ee75f8aa97 - https://git.kernel.org/stable/c/37bb5628379295c1254c113a407cab03a0f4d0b4
CVE ID: CVE-2024-50268 State: PUBLISHED Published: 2024-11-19T01:30:05.437Z Last Updated: 2025-11-03T22:27:48.152Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() The "*cmd" variable can be controlled by the user via debugfs. That means "new_cam" can be as high as 255 while the size of the uc->updated[] array is UCSI_MAX_ALTMODES (30). The call tree is: ucsi_cmd() // val comes from simple_attr_write_xsigned() -> ucsi_send_command() -> ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control() Additiona
ucsi_send_command_common() -> ucsi_run_command() // calls ucsi->ops->sync_control() -> ucsi_ccg_sync_control() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d76923164705821aa1b01b8d9d1741f20c654ab4 - https://git.kernel.org/stable/c/8f47984b35f3be0cfc652c2ca358d5768ea3456b - https://git.kernel.org/stable/c/604314ecd682913925980dc955caea2d036eab5f - https://git.kernel.org/stable/c/69e19774f15e12dda6c6c58001d059e30895009b - https://git.kernel.org/stable/c/3a2ba841659a0f15102585120dea75d8d5209616 - https://git.kernel.org/stable/c/7dd08a0b4193087976db6b3ee7807de7e8316f96