Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 524288 ath12k_pci 0000:04:00.0: qmi mem seg type 4 size 65536 ath12k_pci 0000:04:00.0: qmi mem seg type 1 size 524288 Now ath12k is working. If suspend is triggered, firmware will be reloaded during resume. As same as before, firmware requests two large segments at first. In ath12k_qmi_msg_mem_request_cb() segment count and size are assigned: ab->qmi.mem_seg_count == 2 ab->qmi.target_mem[0].size == 7077888 ab->qmi.target_mem[1].size == 8454144 Then allocation failed like before and ath12k_qmi_free_target_mem_chunk() is called to free all allocated segments. Note th
n allocation failed like before and ath12k_qmi_free_target_mem_chunk() is called to free all allocated segments. Note the first segment is skipped because its v.addr is cleared due to allocation failure: chunk->v.addr = dma_alloc_coherent() Also note that this leaks that segment because it has not been freed. While freeing the second segment, a size of 8454144 is passed to dma_free_coherent(). However remember that this segment is allocated at the first time firmware is loaded, before suspend. So its real size is 524288, much smaller than 8454144. As a result kernel found we are freeing some memory which is in use and thus cras ---truncated--- Additional Analyst Notes: - CVE Program Containe
e are freeing some memory which is in use and thus cras ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bb50a4e711ff95348ad53641acb1306d89eb4c3a - https://git.kernel.org/stable/c/303c017821d88ebad887814114d4e5966d320b28
CVE ID: CVE-2024-40980 State: PUBLISHED Published: 2024-07-12T12:32:15.569Z Last Updated: 2025-11-03T21:58:44.987Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drop_monitor: replace spin_lock by raw_spin_lock trace_drop_common() is called with preemption disabled, and it acquires a spin_lock. This is problematic for RT kernels because spin_locks are sleeping locks in this configuration, which causes the following splat: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 preempt_count: 1, expected: 0 RCU nest depth: 2,
atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 449, name: rcuc/47 preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 2 5 locks held by rcuc/47/449: #0: ff1100086ec30a60 ((softirq_ctrl.lock)){+.+.}-{2:2}, at: __local_bh_disable_ip+0x105/0x210 #1: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: rt_spin_lock+0xbf/0x130 #2: ffffffffb394a280 (rcu_read_lock){....}-{1:2}, at: __local_bh_disable_ip+0x11c/0x210 #3: ffffffffb394a160 (rcu_callback){....}-{0:0}, at: rcu_do_batch+0x360/0xc70 #4: ff1100086ee07520 (&data->lock){+.+.}-{2:2}, at: trace_drop_common.constprop.0+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+
+0xb5/0x290 irq event stamp: 139909 hardirqs last enabled at (139908): [<ffffffffb1df2b33>] _raw_spin_unlock_irqrestore+0x63/0x80 hardirqs last disabled at (139909): [<ffffffffb19bd03d>] trace_drop_common.constprop.0+0x26d/0x290 softirqs last enabled at (139892): [<ffffffffb07a1083>] __local_bh_enable_ip+0x103/0x170 softirqs last disabled at (139898): [<ffffffffb0909b33>] rcu_cpu_kthread+0x93/0x1f0 Preemption disabled at: [<ffffffffb1de786b>] rt_mutex_slowunlock+0xab/0x2e0 CPU: 47 PID: 449 Comm: rcuc/47 Not tainted 6.9.0-rc2-rt1+ #7 Hardware name: Dell Inc. PowerEdge R650/0Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f
Y2G81, BIOS 1.6.5 04/15/2022 Call Trace: <TASK> dump_stack_lvl+0x8c/0xd0 dump_stack+0x14/0x20 __might_resched+0x21e/0x2f0 rt_spin_lock+0x5e/0x130 ? trace_drop_common.constprop.0+0xb5/0x290 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_drop_common.constprop.0+0xb5/0x290 ? preempt_count_sub+0x1c/0xd0 ? _raw_spin_unlock_irqrestore+0x4a/0x80 ? __pfx_trace_drop_common.constprop.0+0x10/0x10 ? rt_mutex_slowunlock+0x26a/0x2e0 ? skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_rt_mutex_slowunlock+0x10/0x10 ? skb_queue_purge_reason.part.0+0x1bf/0x230 trace_kfree_skb_hit+0x15/0x20 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_pur
0 trace_kfree_skb+0xe9/0x150 kfree_skb_reason+0x7b/0x110 skb_queue_purge_reason.part.0+0x1bf/0x230 ? __pfx_skb_queue_purge_reason.part.0+0x10/0x10 ? mark_lock.part.0+0x8a/0x520 ... trace_drop_common() also disables interrupts, but this is a minor issue because we could easily replace it with a local_lock. Replace the spin_lock with raw_spin_lock to avoid sleeping in atomic context. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/594e47957f3fe034645e6885393ce96c12286334 - https://git.kernel.org/stable/c/96941f29ebcc1e9cbf570dc903f30374909562f5 - https://git.kernel.org/stable/c/b3722fb69468693555f531cddda5c30444726dac -
c/96941f29ebcc1e9cbf570dc903f30374909562f5 - https://git.kernel.org/stable/c/b3722fb69468693555f531cddda5c30444726dac - https://git.kernel.org/stable/c/f251ccef1d864790e5253386e95544420b7cd8f3 - https://git.kernel.org/stable/c/76ce2f9125244e1708d29c1d3f9d1d50b347bda0 - https://git.kernel.org/stable/c/07ea878684dfb78a9d4f564c39d07e855a9e242e - https://git.kernel.org/stable/c/f1e197a665c2148ebc25fe09c53689e60afea195
CVE ID: CVE-2024-40981 State: PUBLISHED Published: 2024-07-12T12:32:16.277Z Last Updated: 2025-11-03T21:58:46.464Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: batman-adv: bypass empty buckets in batadv_purge_orig_ref() Many syzbot reports are pointing to soft lockups in batadv_purge_orig_ref() [1] Root cause is unknown, but we can avoid spending too much time there and perhaps get more interesting reports. [1] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:6:621] Modules linked in: irq event stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.
stamp: 6182794 hardirqs last enabled at (6182793): [<ffff8000801dae10>] __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 hardirqs last disabled at (6182794): [<ffff80008ad66a78>] __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] hardirqs last disabled at (6182794): [<ffff80008ad66a78>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:551 softirqs last enabled at (6182792): [<ffff80008aab71c4>] spin_unlock_bh include/linux/spinlock.h:396 [inline] softirqs last enabled at (6182792): [<ffff80008aab71c4>] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inli
ginator.c:1287 softirqs last disabled at (6182790): [<ffff80008aab61dc>] spin_lock_bh include/linux/spinlock.h:356 [inline] softirqs last disabled at (6182790): [<ffff80008aab61dc>] batadv_purge_orig_ref+0x164/0x1228 net/batman-adv/originator.c:1271 CPU: 0 PID: 621 Comm: kworker/u4:6 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_purge_orig pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : should_resched arch/arm64/include/asm/preempt.h:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/sof
:79 [inline] pc : __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:388 lr : __local_bh_enable_ip+0x224/0x44c kernel/softirq.c:386 sp : ffff800099007970 x29: ffff800099007980 x28: 1fffe00018fce1bd x27: dfff800000000000 x26: ffff0000d2620008 x25: ffff0000c7e70de8 x24: 0000000000000001 x23: 1fffe00018e57781 x22: dfff800000000000 x21: ffff80008aab71c4 x20: ffff0001b40136c0 x19: ffff0000c72bbc08 x18: 1fffe0001a817bb0 x17: ffff800125414000 x16: ffff80008032116c x15: 0000000000000001 x14: 1fffe0001ee9d610 x13: 0000000000000000 x12: 0000000000000003 x11: 0000000000000000 x10: 0000000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 00000000000000
000000ff0100 x9 : 0000000000000000 x8 : 00000000005e5789 x7 : ffff80008aab61dc x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000000000080 x0 : ffff800125414000 Call trace: __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline] arch_local_irq_enable arch/arm64/include/asm/irqflags.h:49 [inline] __local_bh_enable_ip+0x228/0x44c kernel/softirq.c:386 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_o
nclude/linux/spinlock.h:396 [inline] batadv_purge_orig_ref+0x114c/0x1228 net/batman-adv/originator.c:1287 batadv_purge_orig+0x20/0x70 net/batman-adv/originator.c:1300 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc7-syzkaller-g707081b61156 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -S
e Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:51 lr : default_idle_call+0xf8/0x128 kernel/sched/idle.c:103 sp : ffff800093a17d30 x29: ffff800093a17d30 x28: dfff800000000000 x27: 1ffff00012742fb4 x26: ffff80008ec9d000 x25: 0000000000000000 x24: 0000000000000002 x23: 1ffff00011d93a74 x22: ffff80008ec9d3a0 x21: 0000000000000000 x20: ffff0000c19dbc00 x19: ffff8000802d0fd8 x18: 1fffe00036804396 x17: ffff80008ec9d000 x16: ffff8000802d089c x15: 0000000000000001 ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
f8000802d089c x15: 0000000000000001 ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/79636f636126775436a11ee9cf00a9253a33ac11 - https://git.kernel.org/stable/c/154e3f862ba33675cf3f4abf0a0a309a89df87d2 - https://git.kernel.org/stable/c/82cdea8f3af1e36543c937df963d108c60bea030 - https://git.kernel.org/stable/c/92176caf9896572f00e741a93cecc0ef1172da07 - https://git.kernel.org/stable/c/fed7914858a1f1f3e6350bb0f620d6ef15107d16 - https://git.kernel.org/stable/c/2685008a5f9a636434a8508419cee8158a2f52c8 - https://git.kernel.org/stable/c/ae7f3cffe86aea3da0e8e079525a1ae619b8862a - https://git.kernel.org/stable/c/4
58a2f52c8 - https://git.kernel.org/stable/c/ae7f3cffe86aea3da0e8e079525a1ae619b8862a - https://git.kernel.org/stable/c/40dc8ab605894acae1473e434944924a22cfaaa0
CVE ID: CVE-2024-40982 State: REJECTED Published: 2024-07-12T12:32:16.938Z Last Updated: 2025-02-24T12:54:47.105Z Description: No description available.
CVE ID: CVE-2024-40983 State: PUBLISHED Published: 2024-07-12T12:33:57.263Z Last Updated: 2025-11-03T21:58:47.921Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: force a dst refcount before doing decryption As it says in commit 3bc07321ccc2 ("xfrm: Force a dst refcount before entering the xfrm type handlers"): "Crypto requests might return asynchronous. In this case we leave the rcu protected region, so force a refcount on the skb's destination entry before we enter the xfrm type input/output handlers." On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a
On TIPC decryption path it has the same problem, and skb_dst_force() should be called before doing decryption to avoid a possible crash. Shuang reported this issue when this warning is triggered: [] WARNING: include/net/dst.h:337 tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Kdump: loaded Tainted: G W --------- - - 4.18.0-496.el8.x86_64+debug [] Workqueue: crypto cryptd_queue_worker [] RIP: 0010:tipc_sk_rcv+0x1055/0x1ea0 [tipc] [] Call Trace: [] tipc_sk_mcast_rcv+0x548/0xea0 [tipc] [] tipc_rcv+0xcf5/0x1060 [tipc] [] tipc_aead_decrypt_done+0x215/0x2e0 [tipc] [] cryptd_aead_crypt+0xdb/0x190 [] cryptd_queue_worker+0xed/0x190 [] process_one_work+0x93d/0x17e0 Additional Analyst Notes: - CVE Program Contain
0x190 [] cryptd_queue_worker+0xed/0x190 [] process_one_work+0x93d/0x17e0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3eb1b39627892c4e26cb0162b75725aa5fcc60c8 - https://git.kernel.org/stable/c/692803b39a36e63ac73208e0a3769ae6a2f9bc76 - https://git.kernel.org/stable/c/623c90d86a61e3780f682b32928af469c66ec4c2 - https://git.kernel.org/stable/c/b57a4a2dc8746cea58a922ebe31b6aa629d69d93 - https://git.kernel.org/stable/c/6808b41371670c51feea14f63ade211e78100930 - https://git.kernel.org/stable/c/2ebe8f840c7450ecbfca9d18ac92e9ce9155e269
CVE ID: CVE-2024-40984 State: PUBLISHED Published: 2024-07-12T12:33:57.947Z Last Updated: 2025-11-03T21:58:49.395Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." Undo the modifications made in commit d410ee5109a1 ("ACPICA: avoid "Info: mapping multiple BARs. Your kernel is fine.""). The initial purpose of this commit was to stop memory mappings for operation regions from overlapping page boundaries, as it can trigger warnings if different page attributes are present. However, it was found that when this situation arises, mapping continues until the
ifferent page attributes are present. However, it was found that when this situation arises, mapping continues until the boundary's end, but there is still an attempt to read/write the entire length of the map, leading to a NULL pointer deference. For example, if a four-byte mapping request is made but only one byte is mapped because it hits the current page boundary's end, a four-byte read/write attempt is still made, resulting in a NULL pointer deference. Instead, map the entire length, as the ACPI specification does not mandate that it must be within the same page boundary. It is permissible for it to be mapped across different regions. Additional Analyst Notes: - CVE Program Container: -
ry. It is permissible for it to be mapped across different regions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/435ecc978c3d5d0c4e172ec5b956dc1904061d98 - https://git.kernel.org/stable/c/ae465109d82f4fb03c5adbe85f2d6a6a3d59124c - https://git.kernel.org/stable/c/6eca23100e9030725f69c1babacd58803f29ec8d - https://git.kernel.org/stable/c/dc5017c57f5eee80020c73ff8b67ba7f9fd08b1f - https://git.kernel.org/stable/c/ddc1f5f124479360a1fd43f73be950781d172239 - https://git.kernel.org/stable/c/434c6b924e1f4c219aab2d9e05fe79c5364e37d3 - https://git.kernel.org/stable/c/e21a4c9129c72fa54dd00f5ebf71219b41d43c04 - https://git.kerne
19aab2d9e05fe79c5364e37d3 - https://git.kernel.org/stable/c/e21a4c9129c72fa54dd00f5ebf71219b41d43c04 - https://git.kernel.org/stable/c/a83e1385b780d41307433ddbc86e3c528db031f0
CVE ID: CVE-2024-40985 State: PUBLISHED Published: 2024-07-12T12:37:31.133Z Last Updated: 2025-05-04T09:19:22.334Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/tcp_ao: Don't leak ao_info on error-path It seems I introduced it together with TCP_AO_CMDF_AO_REQUIRED, on version 5 [1] of TCP-AO patches. Quite frustrative that having all these selftests that I've written, running kmemtest & kcov was always in todo. [1]: https://lore.kernel.org/netdev/20230215183335.800122-5-dima@arista.com/ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ebaa7d3c26332330
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ebaa7d3c26332330a48f9a15f8e518d526cc0f21 - https://git.kernel.org/stable/c/f9ae848904289ddb16c7c9e4553ed4c64300de49
CVE ID: CVE-2024-40986 State: PUBLISHED Published: 2024-07-12T12:37:31.800Z Last Updated: 2025-05-04T12:57:21.310Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr() Requests the vchan lock before using xdma->stop_request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8e1f54e4a3f3207c9dc68bb5000603b75802e7f0 - https://git.kernel.org/stable/c/462237d2d93fc9e9221d1cf9f773954d27da83c0
CVE ID: CVE-2024-40987 State: PUBLISHED Published: 2024-07-12T12:37:32.490Z Last Updated: 2025-11-03T21:58:50.845Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4ad7d49059358ceadd352b4e2511425bdb68f400 - https://git.kernel.org/stable/c/1c44f7759a5650acf8f13d3e0a184d09e03be9e4 - https://git.kernel.org/stable/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388 - https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049
able/c/d8a04a6bfa75251ba7bcc3651ed211e82f13f388 - https://git.kernel.org/stable/c/4d020c1dbd2b2304f44d003e6de956ae570049dc - https://git.kernel.org/stable/c/fc5cb952e6723c5c55e47b8cf94a891bd4af1a86 - https://git.kernel.org/stable/c/b065d79ed06a0bb4377bc6dcc2ff0cb1f55a798f - https://git.kernel.org/stable/c/b0d612619ed70cab476c77b19e00d13aa414e14f - https://git.kernel.org/stable/c/f0d576f840153392d04b2d52cf3adab8f62e8cb6
CVE ID: CVE-2024-40988 State: PUBLISHED Published: 2024-07-12T12:37:33.133Z Last Updated: 2025-11-03T21:58:52.301Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix UBSAN warning in kv_dpm.c Adds bounds check for sumo_vid_mapping_entry. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/07e8f15fa16695cf4c90e89854e59af4a760055b - https://git.kernel.org/stable/c/a8c6df9fe5bc390645d1e96eff14ffe414951aad - https://git.kernel.org/stable/c/febe794b83693257f21a23d2e03ea695a62449c8 - https://git.kernel.org/stable/c/cf1cc8fcfe517e108794fb711f7faabfca0dc8
able/c/febe794b83693257f21a23d2e03ea695a62449c8 - https://git.kernel.org/stable/c/cf1cc8fcfe517e108794fb711f7faabfca0dc855 - https://git.kernel.org/stable/c/f803532bc3825384100dfc58873e035d77248447 - https://git.kernel.org/stable/c/9e57611182a817824a17b1c3dd300ee74a174b42 - https://git.kernel.org/stable/c/468a50fd46a09bba7ba18a11054ae64b6479ecdc - https://git.kernel.org/stable/c/a498df5421fd737d11bfd152428ba6b1c8538321
CVE ID: CVE-2024-40989 State: PUBLISHED Published: 2024-07-12T12:37:33.823Z Last Updated: 2025-11-03T21:58:53.765Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Disassociate vcpus from redistributor region on teardown When tearing down a redistributor region, make sure we don't have any dangling pointer to that region stored in a vcpu. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77 - https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c - https://git.kernel.org/stable/c/152b4123f21e
https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c - https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76 - https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8
CVE ID: CVE-2024-40990 State: PUBLISHED Published: 2024-07-12T12:37:34.485Z Last Updated: 2025-11-03T21:58:55.239Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Add check for srq max_sge attribute max_sge attribute is passed by the user, and is inserted and used unchecked, so verify that the value doesn't exceed maximum allowed value before using it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511 - https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c - https://git.kernel.org/stable/
951728ed3511 - https://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c - https://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf - https://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2 - https://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3 - https://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d
CVE ID: CVE-2024-40991 State: PUBLISHED Published: 2024-07-12T12:37:35.138Z Last Updated: 2025-05-04T09:19:30.933Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id() The of_k3_udma_glue_parse_chn_by_id() helper function erroneously invokes "of_node_put()" on the "udmax_np" device-node passed to it, without having incremented its reference count at any point. Fix it. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e - https://git.kernel.org/stable/c/ba27e9
ces: - https://git.kernel.org/stable/c/a5ab5f413d1e4c7ed5f64271b025f0726374509e - https://git.kernel.org/stable/c/ba27e9d2207784da748b19170a2e56bd7770bd81
CVE ID: CVE-2024-40992 State: PUBLISHED Published: 2024-07-12T12:37:35.800Z Last Updated: 2025-05-04T09:19:32.485Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder length checking for UD request packets According to the IBA specification: If a UD request packet is detected with an invalid length, the request shall be an invalid request and it shall be silently dropped by the responder. The responder then waits for a new request packet. commit 689c5421bfe0 ("RDMA/rxe: Fix incorrect responder length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression is
er length checking") defers responder length check for UD QPs in function `copy_data`. But it introduces a regression issue for UD QPs. When the packet size is too large to fit in the receive buffer. `copy_data` will return error code -EINVAL. Then `send_data_in` will return RESPST_ERR_MALFORMED_WQE. UD QP will transfer into ERROR state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/163868ec1f6c610d16da9e458fe1dd7d5de97341 - https://git.kernel.org/stable/c/943c94f41dfe36536dc9aaa12c9efdf548ceb996 - https://git.kernel.org/stable/c/f67ac0061c7614c1548963d3ef1ee1606efd8636