Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
cause the check for sock_owned_by_user() and corresponding handling is missing. Ideas for a future clean-up patch: A) Correct usage of bh_lock_sock() in tasklet context, as described in Re-enqueue, if needed. This may require adding return values to the tasklet functions and thus changes to all users of iucv. B) Change iucv tasklet into worker and use only lock_sock() in af_iucv. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/84f40b46787ecb67c7ad08a5bb1376141fa10c01 - https://git.kernel.org/stable/c/37652fbef9809411cea55ea5fa1a170e299efcd0 - https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895 - ht
37652fbef9809411cea55ea5fa1a170e299efcd0 - https://git.kernel.org/stable/c/c65f72eec60a34ace031426e04e9aff8e5f04895 - https://git.kernel.org/stable/c/ac758e1f663fe9bc64f6b47212a2aa18697524f5 - https://git.kernel.org/stable/c/8b424c9e44111c5a76f41c6b741f8d4c4179d876 - https://git.kernel.org/stable/c/01437282fd3904810603f3dc98d2cac6b8b6fc84 - https://git.kernel.org/stable/c/69620522c48ce8215e5eb55ffbab8cafee8f407d - https://git.kernel.org/stable/c/f558120cd709682b739207b48cf7479fd9568431
CVE ID: CVE-2024-42272 State: PUBLISHED Published: 2024-08-17T08:54:26.755Z Last Updated: 2025-11-03T22:03:10.064Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtable_lookup() is not using the padding bytes which are not initialized. BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline] BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup
ninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 rht_ptr_rcu include/linux/rhashtable.h:376 [inline] __rhashtable_lookup include/linux/rhashtable.h:607 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 tcf_action_init_1+0x6c
ow_table_get+0x611/0x2260 net/sched/act_ct.c:329 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425 tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488 tcf_action_add net/sched/act_api.c:2061 [inline] tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118 rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647 netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] _
etlink.c:1357 netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 ____sys_sendmsg+0x877/0xb60 net/socket.c:2597 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651 __sys_sendmsg net/socket.c:2680 [inline] __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687 x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable key created at: tcf_ct_flow_table_g
0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable key created at: tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324 tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee - https://git.kernel.org/stable/c/3ddefcb8f75e312535e2e7d5fef9932019ba60f2 - https://git.kernel.org/stable/c/d06daf0ad645d9225a3ff6958dd82e1f3988fa64 - https://git.kernel.org/stable/c/d7cc186d0973afce0e1237c37f7512c01981fb79 - https://git.kernel.org/stable/c/3a5b68869dbe14f1157c6a24ac71923db060eeab - https://git.kernel.org/stabl
7512c01981fb79 - https://git.kernel.org/stable/c/3a5b68869dbe14f1157c6a24ac71923db060eeab - https://git.kernel.org/stable/c/2191a54f63225b548fd8346be3611c3219a24738
CVE ID: CVE-2024-42273 State: PUBLISHED Published: 2024-08-17T08:54:27.422Z Last Updated: 2025-11-03T22:03:11.549Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid mkdir /mnt/test/comp f2fs_io setflags compression /mnt/test/comp dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1 truncate --size 13 /mnt/test/comp/testfile In the above scenario, we can get a BUG_ON. kernel BUG at fs/f2fs/segment.c:3589! Call Trace: do_write_page+0x78/0x390 [f2fs] f2fs_outplace_write_data+0x62/0xb0 [f2fs] f2fs_do_write_data_page+0x275/0x740 [f2fs] f2fs_write_single_data_page+0x1dc/0x8f0 [f
tplace_write_data+0x62/0xb0 [f2fs] f2fs_do_write_data_page+0x275/0x740 [f2fs] f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs] f2fs_write_multi_pages+0x1e5/0xae0 [f2fs] f2fs_write_cache_pages+0xab1/0xc60 [f2fs] f2fs_write_data_pages+0x2d8/0x330 [f2fs] do_writepages+0xcf/0x270 __writeback_single_inode+0x44/0x350 writeback_sb_inodes+0x242/0x530 __writeback_inodes_wb+0x54/0xf0 wb_writeback+0x192/0x310 wb_workfn+0x30d/0x400 The reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the page was set the gcing flag by set_cluster_dirty(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297
lnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1 - https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa8394039187c34439 - https://git.kernel.org/stable/c/0cd106612396656d6f1ca17ef192c6759bb60791 - https://git.kernel.org/stable/c/8cb1f4080dd91c6e6b01dbea013a3f42341cb6a1
CVE ID: CVE-2024-42274 State: PUBLISHED Published: 2024-08-17T08:54:28.169Z Last Updated: 2025-11-03T22:03:13.014Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the process context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove its overhead. With RME Fireface 800, this lead to a regression since Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA
nce Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA operation: thread 0: * (lock A) acquire substream lock by snd_pcm_stream_lock_irq() in snd_pcm_status64() * (lock B) wait for tasklet to finish by calling tasklet_unlock_spin_wait() in tasklet_disable_in_atomic() in ohci_flush_iso_completions() of ohci.c thread 1: * (lock B) enter tasklet * (lock A) attempt to acquire substream lock, waiting for it to be released: snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed() in update_pcm_pointers() in process_ctx_payloads() in process_rx_packets() of amdtp-stream.c ? tasklet_unlock_spin_wait </NMI> <TASK> ohci_flush_iso_comple
_ctx_payloads() in process_rx_packets() of amdtp-stream.c ? tasklet_unlock_spin_wait </NMI> <TASK> ohci_flush_iso_completions firewire_ohci amdtp_domain_stream_pcm_pointer snd_firewire_lib snd_pcm_update_hw_ptr0 snd_pcm snd_pcm_status64 snd_pcm ? native_queued_spin_lock_slowpath </NMI> <IRQ> _raw_spin_lock_irqsave snd_pcm_period_elapsed snd_pcm process_rx_packets snd_firewire_lib irq_target_callback snd_firewire_lib handle_it_packet firewire_ohci context_tasklet firewire_ohci Restore the process context work queue to prevent deadlock AB/BA deadlock competition for ALSA substream lock of snd_pcm_stream_lock_irq() in snd_pcm_status64() and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapse
tream lock of snd_pcm_stream_lock_irq() in snd_pcm_status64() and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed(). revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") Replace inline description to prevent future deadlock. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7c07220cf634002f93a87ca2252a32766850f2d1 - https://git.kernel.org/stable/c/b239a37d68e8bc59f9516444da222841e3b13ba9 - https://git.kernel.org/stable/c/f5043e69aeb2786f32e84132817a007a6430aa7d - https://git.kernel.org/stable/c/36c255db5a25edd42d1aca48e38b8e95ee5fd9ef - https://git.kernel.org/stabl
7a007a6430aa7d - https://git.kernel.org/stable/c/36c255db5a25edd42d1aca48e38b8e95ee5fd9ef - https://git.kernel.org/stable/c/3dab73ab925a51ab05543b491bf17463a48ca323
CVE ID: CVE-2024-42275 State: PUBLISHED Published: 2024-08-17T08:54:28.902Z Last Updated: 2025-05-04T09:25:42.647Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix error code in drm_client_buffer_vmap_local() This function accidentally returns zero/success on the failure path. It leads to locking issues and an uninitialized *map_copy in the caller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c0f412961653237f52e2f16ee8747fb330bcf074 - https://git.kernel.org/stable/c/b5fbf924f125ba3638cfdc21c0515eb7e76264ca
CVE ID: CVE-2024-42276 State: PUBLISHED Published: 2024-08-17T09:08:44.694Z Last Updated: 2025-11-03T22:03:15.961Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoid dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec - https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba - https://git.kernel.org/stab
8301973fa5a01ec - https://git.kernel.org/stable/c/be23ae63080e0bf9e246ab20207200bca6585eba - https://git.kernel.org/stable/c/7cc1f4cd90a00b6191cb8cda2d1302fdce59361c - https://git.kernel.org/stable/c/d135c3352f7c947a922da93c8e763ee6bc208b64 - https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83 - https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7 - https://git.kernel.org/stable/c/c31fad1470389666ac7169fe43aa65bf5b7e2cfd
CVE ID: CVE-2024-42277 State: PUBLISHED Published: 2024-08-17T09:08:45.486Z Last Updated: 2025-11-03T22:03:17.418Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en() dom->sdev is equal to NULL, which leads to null dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8c79ceb4ecf823e6ec10fee6febb0fca3de79922 - https://git.kernel.org/stable/c/dfe90030a0cfa26dca4cb6510de28920
org/stable/c/8c79ceb4ecf823e6ec10fee6febb0fca3de79922 - https://git.kernel.org/stable/c/dfe90030a0cfa26dca4cb6510de28920e5ad22fb - https://git.kernel.org/stable/c/b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb - https://git.kernel.org/stable/c/d5fe884ce28c5005f8582c35333c195a168f841c - https://git.kernel.org/stable/c/630482ee0653decf9e2482ac6181897eb6cde5b8
CVE ID: CVE-2024-42278 State: PUBLISHED Published: 2024-08-17T09:08:46.120Z Last Updated: 2025-05-04T12:57:55.123Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS2781: Fix tasdev_load_calibrated_data() This function has a reversed if statement so it's either a no-op or it leads to a NULL dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6d98741dbd1309a6f2d7cffbb10a8f036ec3ca06 - https://git.kernel.org/stable/c/51be301d29d674ff328dfcf23705851f326f35b3 - https://git.kernel.org/stable/c/92c78222168e9035a9bfb8841c2e56ce23e51f73
CVE ID: CVE-2024-42279 State: PUBLISHED Published: 2024-08-17T09:08:46.829Z Last Updated: 2025-05-04T09:25:48.623Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer While transmitting with rx_len == 0, the RX FIFO is not going to be emptied in the interrupt handler. A subsequent transfer could then read crap from the previous transfer out of the RX FIFO into the start RX buffer. The core provides a register that will empty the RX and TX FIFOs, so do that before each transfer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.ker
FIFOs, so do that before each transfer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3feda3677e8bbe833c3a62a4091377a08f015b80 - https://git.kernel.org/stable/c/45e03d35229b680b79dfea1103a1f2f07d0b5d75 - https://git.kernel.org/stable/c/9cf71eb0faef4bff01df4264841b8465382d7927
CVE ID: CVE-2024-42280 State: PUBLISHED Published: 2024-08-17T09:08:47.699Z Last Updated: 2025-11-03T22:03:20.326Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/70db2c84631f50e02e6b32b543700699dd395803 - https://git.kernel.org/stable/c/d3e4d4a98c5629ccdcb762a0ff6c82ba9738a0c3 - https://git.kernel.org/stable/c/9460ac3dd1ae033bc2b021a458fb535a0c36ddb2 - https://git.kernel.org/stable/c/8f4030277dfb9dbe04fd78566
kernel.org/stable/c/9460ac3dd1ae033bc2b021a458fb535a0c36ddb2 - https://git.kernel.org/stable/c/8f4030277dfb9dbe04fd78566b19931097c9d629 - https://git.kernel.org/stable/c/4d8b642985ae24f4b3656438eb8489834a17bb80 - https://git.kernel.org/stable/c/ddc79556641ee070d36be0de4a1f0a16a71f1fc7 - https://git.kernel.org/stable/c/7e4a539bca7d8d20f2c5d93c18cce8ef77cd78e0 - https://git.kernel.org/stable/c/61ab751451f5ebd0b98e02276a44e23a10110402
CVE ID: CVE-2024-42281 State: PUBLISHED Published: 2024-08-17T09:08:48.477Z Last Updated: 2025-11-03T22:03:23.250Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2]. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a689f5eb13a90f892a088865478b3cd39f53d5dc - https://git.kernel.org/stable/c/dda518dea60d556a2d171c0122ca7d9fdb7d473a - https://git.kernel.org/stable/c/f6bb8c90cab97a3e0
s://git.kernel.org/stable/c/dda518dea60d556a2d171c0122ca7d9fdb7d473a - https://git.kernel.org/stable/c/f6bb8c90cab97a3e03f8d30e3069efe6a742e0be - https://git.kernel.org/stable/c/11ec79f5c7f74261874744039bc1551023edd6b2 - https://git.kernel.org/stable/c/c3496314c53e7e82ddb544c825defc3e8c0e45cf - https://git.kernel.org/stable/c/ec4eea14d75f7b0491194dd413f540dd19b8c733 - https://git.kernel.org/stable/c/fa5ef655615a01533035c6139248c5b33aa27028
CVE ID: CVE-2024-42282 State: PUBLISHED Published: 2024-08-17T09:08:49.145Z Last Updated: 2025-05-04T09:25:52.309Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling Move the freeing of the dummy net_device from mtk_free_dev() to mtk_remove(). Previously, if alloc_netdev_dummy() failed in mtk_probe(), eth->dummy_dev would be NULL. The error path would then call mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev was allocated (but it was not), potentially causing a NULL pointer dereference. By moving free_netdev() to mtk_remove(), w
s allocated (but it was not), potentially causing a NULL pointer dereference. By moving free_netdev() to mtk_remove(), we ensure it's only called when mtk_probe() has succeeded and dummy_dev is fully allocated. This addresses a potential NULL pointer dereference detected by Smatch[1]. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/af6bd5c9901b13a26eaf4d57d97a813297791596 - https://git.kernel.org/stable/c/16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef
CVE ID: CVE-2024-42283 State: PUBLISHED Published: 2024-08-17T09:08:49.866Z Last Updated: 2025-11-03T22:03:26.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and there
a_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fd06cb4a5fc7bda3dea31712618a62af72a1c6cb - https://git.kernel.org/stable/c/5cc4d71dda2dd4f1520f40e634a527022e48ccd8 - https://git.kernel.org/stable/c/9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0 - https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b - http
8f558a3afe99ce51a642ce0d3637ddc2b5d5d0 - https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b - https://git.kernel.org/stable/c/7704460acd7f5d35eb07c52500987dc9b95313fb - https://git.kernel.org/stable/c/a13d3864b76ac87085ec530b2ff8e37482a63a96 - https://git.kernel.org/stable/c/6d745cd0e9720282cd291d36b9db528aea18add2
CVE ID: CVE-2024-42284 State: PUBLISHED Published: 2024-08-17T09:08:50.576Z Last Updated: 2025-11-03T22:03:29.114Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP media address. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7ec3335dd89c8d169e9650e4bac64fde71fdf15b - https://git.kernel.org/stabl
r: References: - https://git.kernel.org/stable/c/7ec3335dd89c8d169e9650e4bac64fde71fdf15b - https://git.kernel.org/stable/c/253405541be2f15ffebdeac2f4cf4b7e9144d12f - https://git.kernel.org/stable/c/aa38bf74899de07cf70b50cd17f8ad45fb6654c8 - https://git.kernel.org/stable/c/5eea127675450583680c8170358bcba43227bd69 - https://git.kernel.org/stable/c/728734352743a78b4c5a7285b282127696a4a813 - https://git.kernel.org/stable/c/76ddf84a52f0d8ec3f5db6ccce08faf202a17d28 - https://git.kernel.org/stable/c/2abe350db1aa599eeebc6892237d0bce0f1de62a - https://git.kernel.org/stable/c/fa96c6baef1b5385e2f0c0677b32b3839e716076
CVE ID: CVE-2024-42285 State: PUBLISHED Published: 2024-08-17T09:08:51.302Z Last Updated: 2025-11-03T22:03:32.078Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pend
re that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d91d253c87fd1efece521ff2612078a35af673c6 - https://git.kernel.org/stable/c/7f25f296fc9bd0435be14e89bf657cd615a23574 - https://git.kernel.org/stable/c/94ee7ff99b87435ec63211f632918dc7f44dac79 - https://git.kernel.org/stable/c/557d035fe88d78dd51664f4dc0e1896c04c97cf6 - https://git.kernel.org/stable/c/dc8074b8901caabb97c2d353abd6b4e7fa5a59a5 - https://git.kernel.org/stable/c/ff5bbbdee08287d75d72e65b72a2b76d9637892a - https://git.kerne
b97c2d353abd6b4e7fa5a59a5 - https://git.kernel.org/stable/c/ff5bbbdee08287d75d72e65b72a2b76d9637892a - https://git.kernel.org/stable/c/ee39384ee787e86e9db4efb843818ef0ea9cb8ae - https://git.kernel.org/stable/c/aee2424246f9f1dadc33faa78990c1e2eb7826e4
CVE ID: CVE-2024-42286 State: PUBLISHED Published: 2024-08-17T09:08:52.036Z Last Updated: 2025-11-03T22:03:35.011Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 Workqueue: events_unbound qla_register_fcport_fn [qla2xxx] RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX:
teport+0x16/0x430 [nvme_fc] RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9dfb46b78c00 RCX: 0000000000000000 RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: 0000000000000000 RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030 R10: 34303a303030305b R11: 2078787832616c71 R12: ffff9dfb46b78dd4 R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8 FS: 0000000000000000(0000) GS:ffff9dfc67c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000070 CR3: 000000018da10004 CR4: 00000000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]
0000000206f0 Call Trace: qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx] ? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx] qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx] qla_register_fcport_fn+0x54/0xc0 [qla2xxx] Exit the qla_nvme_register_remote() function when qla_nvme_register_hba() fails and correctly validate nvme_local_port. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/549aac9655320c9b245a24271b204668c5d40430 - https://git.kernel.org/stable/c/e1f010844443c389bc552884ac5cfa47de34d54c - https://git.kernel.org/stable/c/a3ab508a4853a9f5ae25a7816a4889f09938f63c - https://git.kernel.org/stable/c/cde43031df533751b4ead37d17