Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
portion of the block buffer to be read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d074d5ff5ae77b18300e5079c6bda6342a4d44b7 - https://git.kernel.org/stable/c/7a14b8a477b88607d157c24aeb23e7389ec3319f - https://git.kernel.org/stable/c/1f8d0691c50581ba6043f009ec9e8b9f78f09d5a - https://git.kernel.org/stable/c/491528935c9c48bf341d8b40eabc6c4fc5df6f2c - https://git.kernel.org/stable/c/6be99c51829b24c914cef5bff6164877178e84d9 - https://git.kernel.org/stable/c/609c7c1cc976e740d0fed4dbeec688b3ecb5dce2 - https://git.kernel.org/stable/c/c1c9d0f6f7f1dbf29db996bd8e166242843a5f21
CVE ID: CVE-2024-26594 State: PUBLISHED Published: 2024-02-23T13:26:46.577Z Last Updated: 2025-05-04T08:51:49.289Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dd1de9268745f0eac83a430db7afc32cbd62e84b - https://git.kernel.org/stable/c/6eb8015492bcc84e40646390e50a862b2c0529c9 - https://git.kernel.org/stable/c/a2b21ef1ea4cf632d19b3a7cc4d4245b8e63202a - ht
6eb8015492bcc84e40646390e50a862b2c0529c9 - https://git.kernel.org/stable/c/a2b21ef1ea4cf632d19b3a7cc4d4245b8e63202a - https://git.kernel.org/stable/c/5e6dfec95833edc54c48605a98365a7325e5541e - https://git.kernel.org/stable/c/92e470163d96df8db6c4fa0f484e4a229edb903d
CVE ID: CVE-2024-26595 State: PUBLISHED Published: 2024-02-23T14:46:24.767Z Last Updated: 2025-11-03T20:36:56.580Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path When calling mlxsw_sp_acl_tcam_region_destroy() from an error path after failing to attach the region to an ACL group, we hit a NULL pointer dereference upon 'region->group->tcam' [1]. Fix by retrieving the 'tcam' pointer using mlxsw_sp_acl_to_tcam(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_s
eference, address: 0000000000000000 [...] RIP: 0010:mlxsw_sp_acl_tcam_region_destroy+0xa0/0xd0 [...] Call Trace: mlxsw_sp_acl_tcam_vchunk_get+0x88b/0xa20 mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0 mlxsw_sp_acl_rule_add+0x47/0x240 mlxsw_sp_flower_replace+0x1a9/0x1d0 tc_setup_cb_add+0xdc/0x1c0 fl_hw_replace_filter+0x146/0x1f0 fl_change+0xc17/0x1360 tc_new_tfilter+0x472/0xb90 rtnetlink_rcv_msg+0x313/0x3b0 netlink_rcv_skb+0x58/0x100 netlink_unicast+0x244/0x390 netlink_sendmsg+0x1e4/0x440 ____sys_sendmsg+0x164/0x260 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xc0 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
/0xe0 entry_SYSCALL_64_after_hwframe+0x63/0x6b Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/75fa2d8b3c0175b519c99ace54ab8474cfd0077e - https://git.kernel.org/stable/c/817840d125a370626895df269c50c923b79b0a39 - https://git.kernel.org/stable/c/d0a1efe417c97a1e9b914056ee6b86f1ef75fe1f - https://git.kernel.org/stable/c/efeb7dfea8ee10cdec11b6b6ba4e405edbe75809
CVE ID: CVE-2024-26596 State: PUBLISHED Published: 2024-02-23T14:46:25.420Z Last Updated: 2025-11-03T19:29:25.649Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events After the blamed commit, we started doing this dereference for every NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event in the system. static inline struct dsa_port *dsa_user_to_port(const struct net_device *dev) { struct dsa_user_priv *p = netdev_priv(dev); return p->dp; } Which is obviously bogus, because not all net_devices have a netdev_priv() of type struct dsa_user_priv. But struct d
} Which is obviously bogus, because not all net_devices have a netdev_priv() of type struct dsa_user_priv. But struct dsa_user_priv is fairly small, and p->dp means dereferencing 8 bytes starting with offset 16. Most drivers allocate that much private memory anyway, making our access not fault, and we discard the bogus data quickly afterwards, so this wasn't caught. But the dummy interface is somewhat special in that it calls alloc_netdev() with a priv size of 0. So every netdev_priv() dereference is invalid, and we get this when we emit a NETDEV_PRECHANGEUPPER event with a VLAN as its new upper: $ ip link add dummy1 type dummy $ ip link add link dummy1 name dummy1.100 type vlan id 100 [ 43
a VLAN as its new upper: $ ip link add dummy1 type dummy $ ip link add link dummy1 name dummy1.100 type vlan id 100 [ 43.309174] ================================================================== [ 43.316456] BUG: KASAN: slab-out-of-bounds in dsa_user_prechangeupper+0x30/0xe8 [ 43.323835] Read of size 8 at addr ffff3f86481d2990 by task ip/374 [ 43.330058] [ 43.342436] Call trace: [ 43.366542] dsa_user_prechangeupper+0x30/0xe8 [ 43.371024] dsa_user_netdevice_event+0xb38/0xee8 [ 43.375768] notifier_call_chain+0xa4/0x210 [ 43.379985] raw_notifier_call_chain+0x24/0x38 [ 43.384464] __netdev_upper_dev_link+0x3ec/0x5d8 [ 43.389120] netdev_upper_dev_link+0x70/0xa8 [ 43.393424] register_vlan_dev+0x1b
64] __netdev_upper_dev_link+0x3ec/0x5d8 [ 43.389120] netdev_upper_dev_link+0x70/0xa8 [ 43.393424] register_vlan_dev+0x1bc/0x310 [ 43.397554] vlan_newlink+0x210/0x248 [ 43.401247] rtnl_newlink+0x9fc/0xe30 [ 43.404942] rtnetlink_rcv_msg+0x378/0x580 Avoid the kernel oops by dereferencing after the type check, as customary. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9e9953f5e4d6d11a9dad56fdee307bb923302809 - https://git.kernel.org/stable/c/69a1e2d938dbbfcff0e064269adf60ad26dbb102 - https://git.kernel.org/stable/c/dbd909c20c11f0d29c0054d41e0d1f668a60e8c8 - https://git.kernel.org/stable/c/844f104790bd69c2e4dbb9ee3eba46f
.org/stable/c/dbd909c20c11f0d29c0054d41e0d1f668a60e8c8 - https://git.kernel.org/stable/c/844f104790bd69c2e4dbb9ee3eba46fde1fcea7b
CVE ID: CVE-2024-26597 State: PUBLISHED Published: 2024-02-23T14:46:26.042Z Last Updated: 2025-05-04T08:51:54.016Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c4
: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x172/0x475 mm/kasan/report.c:395 kasan_report+0xbb/0x1c0 mm/kasan/report.c:495 validate_nla lib/nlattr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse
attr.c:386 [inline] __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 __nla_parse+0x3e/0x50 lib/nlattr.c:697 nla_parse_nested_deprecated include/net/netlink.h:1248 [inline] __rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:24
sg_nosec net/socket.c:714 [inline] sock_sendmsg+0x154/0x190 net/socket.c:734 ____sys_sendmsg+0x6df/0x840 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fdcf2072359 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 0
SP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359 RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000 </TASK> The buggy address belongs to the variable: rmnet_policy+0x30/0xe0 The buggy address belongs to the physical page: page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c
0000000000 index:0x0 pfn:0x155243 flags: 0x200000000001000(reserved|node=0|zone=2) raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07 ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9 >ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 ^ ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_depre
f9 ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 According to the comment of `nla_parse_nested_deprecated`, the maxtype should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/093dab655808207f7a9f54cf156240aeafc70590 - https://git.kernel.org/stable/c/02467ab8b404d80429107588e0f3425cf5fcd2e5 - https://git.kernel.org/stable/c/2295c22348faf795e1ccdf618f6eb7afdb2f7447 - https://git.kernel.org/stable/c/3b5254862258b595662a0ccca6e9eeb88d6e7468 - https://git.kernel.org/stable/c/ee1dc3bf86f2df777038506b139371a9add02534 - https://git.kernel.org/s
cca6e9eeb88d6e7468 - https://git.kernel.org/stable/c/ee1dc3bf86f2df777038506b139371a9add02534 - https://git.kernel.org/stable/c/c4734535034672f59f2652e1e0058c490da62a5c - https://git.kernel.org/stable/c/17d06a5c44d8fd2e8e61bac295b09153496f87e1 - https://git.kernel.org/stable/c/b33fb5b801c6db408b774a68e7c8722796b59ecc
CVE ID: CVE-2024-26598 State: PUBLISHED Published: 2024-02-23T14:46:26.672Z Last Updated: 2025-05-04T08:51:55.492Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the
k that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d04acadb6490aa3314f9c9e087691e55de153b88 - https://git.kernel.org/stable/c/ba7be666740847d967822bed15500656b26bc703 - https://git.kernel.org/stable/c/12c2759ab1343c124ed46ba48f27bd1ef5d2dff4 - https://git.kernel.org/stable/c/dba788e25f05209adf2b0175eb1691dc89fb1ba6 - https://git.kernel.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 - https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890
el.org/stable/c/65b201bf3e9af1b0254243a5881390eda56f72d1 - https://git.kernel.org/stable/c/dd3956a1b3dd11f46488c928cb890d6937d1ca80 - https://git.kernel.org/stable/c/ad362fe07fecf0aba839ff2cc59a3617bd42c33f
CVE ID: CVE-2024-26599 State: PUBLISHED Published: 2024-02-23T14:46:27.290Z Last Updated: 2025-05-04T08:51:56.817Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pwm: Fix out-of-bounds access in of_pwm_single_xlate() With args->args_count == 2 args->args[2] is not defined. Actually the flags are contained in args->args[1]. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7b85554c7c2aee91171e038e4d5442ffa130b282 - https://git.kernel.org/stable/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7 - https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce921
able/c/e5f2b4b62977fb6c2efcbc5779e0c9dce18215f7 - https://git.kernel.org/stable/c/bae45b7ebb31984b63b13c3519fd724b3ce92123 - https://git.kernel.org/stable/c/a297d07b9a1e4fb8cda25a4a2363a507d294b7c9
CVE ID: CVE-2024-26600 State: PUBLISHED Published: 2024-02-24T14:56:55.674Z Last Updated: 2025-05-04T08:51:58.052Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 L
wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from
from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/486218c11e8d1c8f515a3bdd70d62203609d4b6b - https://git.kernel.org/stable/c/
eferences: - https://git.kernel.org/stable/c/486218c11e8d1c8f515a3bdd70d62203609d4b6b - https://git.kernel.org/stable/c/8398d8d735ee93a04fb9e9f490e8cacd737e3bf5 - https://git.kernel.org/stable/c/be3b82e4871ba00e9b5d0ede92d396d579d7b3b3 - https://git.kernel.org/stable/c/8cc889b9dea0579726be9520fcc766077890b462 - https://git.kernel.org/stable/c/0430bfcd46657d9116a26cd377f112cbc40826a4 - https://git.kernel.org/stable/c/14ef61594a5a286ae0d493b8acbf9eac46fd04c4 - https://git.kernel.org/stable/c/396e17af6761b3cc9e6e4ca94b4de7f642bfece1 - https://git.kernel.org/stable/c/7104ba0f1958adb250319e68a15eff89ec4fd36d
CVE ID: CVE-2024-26601 State: PUBLISHED Published: 2024-02-24T14:56:56.324Z Last Updated: 2025-05-04T08:52:05.085Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Cont
y bitmap so we need to regenerate it in that case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/94ebf71bddbcd4ab1ce43ae32c6cb66396d2d51a - https://git.kernel.org/stable/c/c1317822e2de80e78f137d3a2d99febab1b80326 - https://git.kernel.org/stable/c/78327acd4cdc4a1601af718b781eece577b6b7d4 - https://git.kernel.org/stable/c/ea42d6cffb0dd27a417f410b9d0011e9859328cb - https://git.kernel.org/stable/c/6b0d48647935e4b8c7b75d1eccb9043fcd4ee581 - https://git.kernel.org/stable/c/c9b528c35795b711331ed36dc3dbee90d5812d4e
CVE ID: CVE-2024-26602 State: PUBLISHED Published: 2024-02-24T14:56:56.992Z Last Updated: 2025-05-04T08:52:06.429Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in order to serialize the accesses to prevent the ability for this to be called at too high of a frequency and saturate the machine. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3cd139875e9a7688b3fc7152640326
ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3cd139875e9a7688b3fc715264032620812a5fa3 - https://git.kernel.org/stable/c/2441a64070b85c14eecc3728cc87e883f953f265 - https://git.kernel.org/stable/c/db896bbe4a9c67cee377e5f6a743350d3ae4acf6 - https://git.kernel.org/stable/c/50fb4e17df319bb33be6f14e2a856950c1577dee - https://git.kernel.org/stable/c/24ec7504a08a67247fbe798d1de995208a8c128a - https://git.kernel.org/stable/c/b6a2a9cbb67545c825ec95f06adb7ff300a2ad71 - https://git.kernel.org/stable/c/c5b2063c65d05e79fad8029324581d86cfba7eea - https://git.kernel.org/stable/c/944d5fe50f3f03daacfea16300e656a1691c4a23
CVE ID: CVE-2024-26603 State: PUBLISHED Published: 2024-02-24T14:56:57.628Z Last Updated: 2025-11-04T18:29:51.152Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can be changed from user-space, so it is possible construct a sigreturn frame where: * fx_sw->xstate_size is smaller than the size required by valid bits in fx_sw->xfeatures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessib
atures. * user-space unmaps parts of the sigrame fpu buffer so that not all of the buffer required by xrstor is accessible. In this case, xrstor tries to restore and accesses the unmapped area which results in a fault. But fault_in_readable succeeds because buf + fx_sw->xstate_size is within the still mapped area, so it goes back and tries xrstor again. It will spin in this loop forever. Instead, fault in the maximum size which can be touched by XRSTOR (taken from fpstate->user_size). [ dhansen: tweak subject / changelog ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a - https:
- CVE Program Container: References: - https://git.kernel.org/stable/c/8bd3eee7720c14b59a206bd05b98d7586bccf99a - https://git.kernel.org/stable/c/627339cccdc9166792ecf96bc3c9f711a60ce996 - https://git.kernel.org/stable/c/b2479ab426cef7ab79a13005650eff956223ced2 - https://git.kernel.org/stable/c/627e28cbb65564e55008315d9e02fbb90478beda - https://git.kernel.org/stable/c/d877550eaf2dc9090d782864c96939397a3c6835
CVE ID: CVE-2024-26604 State: PUBLISHED Published: 2024-02-24T14:56:58.273Z Last Updated: 2025-11-04T18:29:52.350Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "kobject: Remove redundant checks for whether ktype is NULL" This reverts commit 1b28cb81dab7c1eedc6034206f4e8d644046ad31. It is reported to cause problems, so revert it for now until the root cause can be found. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7f414d306320f837cc3df96cf52161cb8290fb1b - https://git.kernel.org/stable/c/b746d52ce7bcac325a2fa264216ead85b7fbbfaa - https://git.k
0f837cc3df96cf52161cb8290fb1b - https://git.kernel.org/stable/c/b746d52ce7bcac325a2fa264216ead85b7fbbfaa - https://git.kernel.org/stable/c/3ca8fbabcceb8bfe44f7f50640092fd8f1de375c
CVE ID: CVE-2024-26605 State: PUBLISHED Published: 2024-02-24T15:17:13.899Z Last Updated: 2025-05-04T12:54:15.125Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix deadlock when enabling ASPM A last minute revert in 6.7-final introduced a potential deadlock when enabling ASPM during probe of Qualcomm PCIe controllers as reported by lockdep: ============================================ WARNING: possible recursive locking detected 6.7.0 #40 Not tainted -------------------------------------------- kworker/u16:5/90 is trying to acquire lock: ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pcie_aspm_pm_state_change+0x58/
rker/u16:5/90 is trying to acquire lock: ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pcie_aspm_pm_state_change+0x58/0xdc but task is already holding lock: ffffacfa78ced000 (pci_bus_sem){++++}-{3:3}, at: pci_walk_bus+0x34/0xbc other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(pci_bus_sem); lock(pci_bus_sem); *** DEADLOCK *** Call trace: print_deadlock_bug+0x25c/0x348 __lock_acquire+0x10a4/0x2064 lock_acquire+0x1e8/0x318 down_read+0x60/0x184 pcie_aspm_pm_state_change+0x58/0xdc pci_set_full_power_state+0xa8/0x114 pci_set_power_state+0xc4/0x120 qcom_pcie_enable_aspm+0x1c/0x3c [pcie_qcom] pci_walk_bus+0x64/0xbc qcom_pcie_host_post_init_2_7_0+0x28/0x34
+0xc4/0x120 qcom_pcie_enable_aspm+0x1c/0x3c [pcie_qcom] pci_walk_bus+0x64/0xbc qcom_pcie_host_post_init_2_7_0+0x28/0x34 [pcie_qcom] The deadlock can easily be reproduced on machines like the Lenovo ThinkPad X13s by adding a delay to increase the race window during asynchronous probe where another thread can take a write lock. Add a new pci_set_power_state_locked() and associated helper functions that can be called with the PCI bus semaphore held to avoid taking the read lock twice. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0f7908a016c092cfdaa16d785fa5099d867bc1a3 - https://git.kernel.org/stable/c/b0f4478838be1f1d