Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
0 ? srso_alias_return_thunk+0x5/0xfbef5 ? handle_mm_fault+0x1f0/0x300 ? srso_alias_return_thunk+0x5/0xfbef5 ? do_user_addr_fault+0x34e/0x640 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f4e5132821d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 db 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffca9c906a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000563ec8a8f130 RCX: 00007f4e5132821d RDX: 0000000000000000 RSI: 00007f4e518fa07d RDI: 000000000000003b RBP: 00007ffca
0000563ec8a8f130 RCX: 00007f4e5132821d RDX: 0000000000000000 RSI: 00007f4e518fa07d RDI: 000000000000003b RBP: 00007ffca9c90760 R08: 00007f4e513f6b20 R09: 00007ffca9c906f0 R10: 0000563ec8a8faa0 R11: 0000000000000246 R12: 00007f4e518fa07d R13: 0000000000020000 R14: 0000563ec8409e90 R15: 0000563ec8a8fa60 </TASK> ---[ end trace ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/66a9937187ac9b5c5ffff07b8b284483e56804d1 - https://git.kernel.org/stable/c/84d2f29152184f0d72ed7c9648c4ee6927df4e59 - https://git.kernel.org/stable/c/a658f011d89dd20cf2c7cb4760ffd79201700b98 - https://git.kernel.org/stable/c/627493443f3a8458cb55c
git.kernel.org/stable/c/a658f011d89dd20cf2c7cb4760ffd79201700b98 - https://git.kernel.org/stable/c/627493443f3a8458cb55cdae1da254a7001123bc - https://git.kernel.org/stable/c/8b799c00cea6fcfe5b501bbaeb228c8821acb753 - https://git.kernel.org/stable/c/78cfd17142ef70599d6409cbd709d94b3da58659
CVE ID: CVE-2024-38541 State: PUBLISHED Published: 2024-06-19T13:35:16.637Z Last Updated: 2025-11-03T19:30:14.802Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: of: module: add buffer overflow check in of_modalias() In of_modalias(), if the buffer happens to be too small even for the 1st snprintf() call, the len parameter will become negative and str parameter (if not NULL initially) will point beyond the buffer's end. Add the buffer overflow check after the 1st snprintf() call and fix such check after the strlen() call (accounting for the terminating NUL char). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
rlen() call (accounting for the terminating NUL char). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/46795440ef2b4ac919d09310a69a404c5bc90a88 - https://git.kernel.org/stable/c/733e62786bdf1b2b9dbb09ba2246313306503414 - https://git.kernel.org/stable/c/c7f24b7d94549ff4623e8f41ea4d9f5319bd8ac8 - https://git.kernel.org/stable/c/5d59fd637a8af42b211a92b2edb2474325b4d488 - https://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6 - https://git.kernel.org/stable/c/ee332023adfd5882808f2dabf037b32d6ce36f9e - https://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a - https://git.kernel.org/stable/
b32d6ce36f9e - https://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a - https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252
CVE ID: CVE-2024-38542 State: PUBLISHED Published: 2024-06-19T13:35:17.310Z Last Updated: 2025-05-04T09:13:37.699Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: boundary check before installing cq callbacks Add a boundary check inside mana_ib_install_cq_cb to prevent index overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f12afddfb142587d786df9e3cc4862190d3e2ec8 - https://git.kernel.org/stable/c/168f6fbde0eabd71d1f4133df7d001a950b96977 - https://git.kernel.org/stable/c/f79edef79b6a2161f4124112f9b0c46891bb0b74
CVE ID: CVE-2024-38543 State: PUBLISHED Published: 2024-06-19T13:35:17.994Z Last Updated: 2025-05-04T09:13:38.958Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure The kcalloc() in dmirror_device_evict_chunk() will return null if the physical memory has run out. As a result, if src_pfns or dst_pfns is dereferenced, the null pointer dereference bug will happen. Moreover, the device is going away. If the kcalloc() fails, the pages mapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in kcalloc(). Finally, as there is no need to have physically contiguous me
d not be evicted. So add a __GFP_NOFAIL flag in kcalloc(). Finally, as there is no need to have physically contiguous memory, Switch kcalloc() to kvcalloc() in order to avoid failing allocations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1a21fdeea502658e315bd939409b755974f4fb64 - https://git.kernel.org/stable/c/65e528a69cb3ed4a286c45b4afba57461c8b5b33 - https://git.kernel.org/stable/c/ce47e8ead9a72834cc68431d53f8092ce69bebb7 - https://git.kernel.org/stable/c/3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc - https://git.kernel.org/stable/c/c2af060d1c18beaec56351cf9c9bcbbc5af341a3
CVE ID: CVE-2024-38544 State: PUBLISHED Published: 2024-06-19T13:35:18.676Z Last Updated: 2025-11-03T20:38:08.626Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been obser
in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale. This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c91fb72a2ca6480d8d77262eef52dc5b178463a3 - https://git.kernel.org/stable/c/de5a059e36657442b5637cc16df5163e435b9cb4 - https://git.kernel.org/stable/c/e0e14dd35d4242340c7346aac60c7ff8fbf87ffc - https://git.kernel.org/stable/c/faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19 - https://git.kernel.org/stable/c/21b4c6d4d8
- https://git.kernel.org/stable/c/faa8d0ecf6c9c7c2ace3ca3e552180ada6f75e19 - https://git.kernel.org/stable/c/21b4c6d4d89030fd4657a8e7c8110fd941049794 - https://git.kernel.org/stable/c/bbad88f111a1829f366c189aa48e7e58e57553fc - https://git.kernel.org/stable/c/30df4bef8b8e183333e9b6e9d4509d552c7da6eb - https://git.kernel.org/stable/c/2b23b6097303ed0ba5f4bc036a1c07b6027af5c6
CVE ID: CVE-2024-38545 State: PUBLISHED Published: 2024-06-19T13:35:19.336Z Last Updated: 2025-05-04T09:13:41.613Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix UAF for cq async event The refcount of CQ is not protected by locks. When CQ asynchronous events and CQ destruction are concurrent, CQ may have been released, which will cause UAF. Use the xa_lock() to protect the CQ refcount. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e - https://git.kernel.org/stable/c/763780ef0336a973e933e40e91933938173
/stable/c/330c825e66ef65278e4ebe57fd49c1d6f3f4e34e - https://git.kernel.org/stable/c/763780ef0336a973e933e40e919339381732dcaf - https://git.kernel.org/stable/c/63da190eeb5c9d849b71f457b15b308c94cbaf08 - https://git.kernel.org/stable/c/39d26cf46306bdc7ae809ecfdbfeff5aa1098911 - https://git.kernel.org/stable/c/37a7559dc1358a8d300437e99ed8ecdab0671507 - https://git.kernel.org/stable/c/a942ec2745ca864cd8512142100e4027dc306a42
CVE ID: CVE-2024-38546 State: PUBLISHED Published: 2024-06-19T13:35:20.024Z Last Updated: 2025-05-04T09:13:43.179Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: vc4: Fix possible null pointer dereference In vc4_hdmi_audio_init() of_get_address() may return NULL which is later dereferenced. Fix this bug by adding NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2d9adecc88ab678785b581ab021f039372c324cb - https://git.kernel.org/stable/c/6cf1874aec42058a5ad621a23b5b2f248def0e96
le/c/2d9adecc88ab678785b581ab021f039372c324cb - https://git.kernel.org/stable/c/6cf1874aec42058a5ad621a23b5b2f248def0e96 - https://git.kernel.org/stable/c/80431ea3634efb47a3004305d76486db9dd8ed49 - https://git.kernel.org/stable/c/42c22b63056cea259d5313bf138a834840af85a5 - https://git.kernel.org/stable/c/2a345fe928c21de6f3c3c7230ff509d715153a31 - https://git.kernel.org/stable/c/bd7827d46d403f8cdb43d16744cb1114e4726b21 - https://git.kernel.org/stable/c/c534b63bede6cb987c2946ed4d0b0013a52c5ba7
CVE ID: CVE-2024-38547 State: PUBLISHED Published: 2024-06-19T13:35:20.689Z Last Updated: 2025-09-29T10:41:21.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries The allocation failure of mycs->yuv_scaler_binary in load_video_binaries() is followed with a dereference of mycs->yuv_scaler_binary after the following call chain: sh_css_pipe_load_binaries() |-> load_video_binaries(mycs->yuv_scaler_binary == NULL) | |-> sh_css_pipe_unload_binaries() |-> unload_video_binaries() In unload_video_binaries(), it calls to ia_css_binary_unload with argument &pipe
_binaries() |-> unload_video_binaries() In unload_video_binaries(), it calls to ia_css_binary_unload with argument &pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer dereference is triggered. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 - https://git.kernel.org/stable/c/4b68b861b514a5c09220d622ac3784c0ebac6c80 - https://git.kernel.org/stable/c/82c2c85aead3ea3cbceef4be077cf459c5df2272 - https://git.kernel.org/stable/c/a1ab99dcc8604afe7e3bccb01b10da03bdd7ea35 - https://git.kernel.org/stable/c/cc
c5df2272 - https://git.kernel.org/stable/c/a1ab99dcc8604afe7e3bccb01b10da03bdd7ea35 - https://git.kernel.org/stable/c/cc20c87b04db86c8e3e810bcdca686b406206069 - https://git.kernel.org/stable/c/69b27ff82f87379afeaaea4b2f339032fdd8486e - https://git.kernel.org/stable/c/6482c433863b257b0b9b687c28ce80b89d5f89f0 - https://git.kernel.org/stable/c/3b621e9e9e148c0928ab109ac3d4b81487469acb
CVE ID: CVE-2024-38548 State: PUBLISHED Published: 2024-06-19T13:35:21.349Z Last Updated: 2025-05-04T09:13:45.775Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference In cdns_mhdp_atomic_enable(), the return value of drm_mode_duplicate() is assigned to mhdp_state->current_mode, and there is a dereference of it in drm_mode_set_name(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Fix this bug add a check of mhdp_state->current_mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.
te->current_mode. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/85d1a27402f81f2e04b0e67d20f749c2a14edbb3 - https://git.kernel.org/stable/c/89788cd9824c28ffcdea40232c458233353d1896 - https://git.kernel.org/stable/c/ca53b7efd4ba6ae92fd2b3085cb099c745e96965 - https://git.kernel.org/stable/c/dcf53e6103b26e7458be71491d0641f49fbd5840 - https://git.kernel.org/stable/c/32fb2ef124c3301656ac6c789a2ef35ef69a66da - https://git.kernel.org/stable/c/47889711da20be9b43e1e136e5cb68df37cbcc79 - https://git.kernel.org/stable/c/935a92a1c400285545198ca2800a4c6c519c650a
CVE ID: CVE-2024-38549 State: PUBLISHED Published: 2024-06-19T13:35:22.042Z Last Updated: 2025-11-04T17:21:22.970Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add 0 size check to mtk_drm_gem_obj Add a check to mtk_drm_gem_init if we attempt to allocate a GEM object of 0 bytes. Currently, no such check exists and the kernel will panic if a userspace application attempts to allocate a 0x0 GBM buffer. Tested by attempting to allocate a 0x0 GBM buffer on an MT8188 and verifying that we now return EINVAL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org
EINVAL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/79078880795478d551a05acc41f957700030d364 - https://git.kernel.org/stable/c/be34a1b351ea7faeb15dde8c44fe89de3980ae67 - https://git.kernel.org/stable/c/d17b75ee9c2e44d3a3682c4ea5ab713ea6073350 - https://git.kernel.org/stable/c/0e3b6f9123726858cac299e1654e3d20424cabe4 - https://git.kernel.org/stable/c/13562c2d48c9ee330de1077d00146742be368f05 - https://git.kernel.org/stable/c/af26ea99019caee1500bf7e60c861136c0bf8594 - https://git.kernel.org/stable/c/9489951e3ae505534c4013db4e76b1b5a3151ac7 - https://git.kernel.org/stable/c/fb4aabdb1b48c25d9e1ee28f89440fd2ce556405 - ht
9489951e3ae505534c4013db4e76b1b5a3151ac7 - https://git.kernel.org/stable/c/fb4aabdb1b48c25d9e1ee28f89440fd2ce556405 - https://git.kernel.org/stable/c/1e4350095e8ab2577ee05f8c3b044e661b5af9a0
CVE ID: CVE-2024-38550 State: PUBLISHED Published: 2024-06-19T13:35:22.716Z Last Updated: 2025-05-04T12:56:42.047Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: kirkwood: Fix potential NULL dereference In kirkwood_dma_hw_params() mv_mbus_dram_info() returns NULL if CONFIG_PLAT_ORION macro is not defined. Fix this bug by adding NULL check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d48d0c5fd733bd6d8d3ddb2ed553777ab4724169 - https://git.kernel.org/stable/c/de9987cec6fde1dd41dfcb97
.kernel.org/stable/c/d48d0c5fd733bd6d8d3ddb2ed553777ab4724169 - https://git.kernel.org/stable/c/de9987cec6fde1dd41dfcb971433e05945852489 - https://git.kernel.org/stable/c/1a7254525ca7a6f3e37d7882d7f7ad97f6235f7c - https://git.kernel.org/stable/c/5bf5154739cd676b6d0958079070557c8d96afb6 - https://git.kernel.org/stable/c/802b49e39da669b54bd9b77dc3c649999a446bf6 - https://git.kernel.org/stable/c/ea60ab95723f5738e7737b56dda95e6feefa5b50
CVE ID: CVE-2024-38551 State: PUBLISHED Published: 2024-06-19T13:35:23.364Z Last Updated: 2025-05-04T09:13:49.352Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Assign dummy when codec not specified for a DAI link MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gi
string comparison. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/87b8dca6e06f9b1681bc52bf7bfa85c663a11158 - https://git.kernel.org/stable/c/cbbcabc7f0979f6542372cf88d7a9da7143a4226 - https://git.kernel.org/stable/c/0c052b1c11d8119f3048b1f7b3c39a90500cacf9 - https://git.kernel.org/stable/c/5f39231888c63f0a7708abc86b51b847476379d8
CVE ID: CVE-2024-38552 State: PUBLISHED Published: 2024-06-19T13:35:24.067Z Last Updated: 2025-11-04T17:21:24.332Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential index out of bounds in color transformation function Fixes index out of bounds issue in the color transformation function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Rep
ion points. If 'i' is out of bounds, an error message is logged and the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:405 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:406 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:407 cm_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Additional Analyst Notes: - CVE Program Cont
_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/604c506ca43fce52bb882cff9c1fdf2ec3b4029c - https://git.kernel.org/stable/c/e280ab978c81443103d7c61bdd1d8d708cf6ed6d - https://git.kernel.org/stable/c/04bc4d1090c343025d69149ca669a27c5b9c34a7 - https://git.kernel.org/stable/c/ced9c4e2289a786b8fa684d8893b7045ea53ef7e - https://git.kernel.org/stable/c/98b8a6bfd30d07a19cfacdf82b50f84bf3360869 - https://git.kernel.org/stable/c/4e8c8b37ee84b3b19c448d2b8e4c916d2f5b9c86 - https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123 - https://g
7ee84b3b19c448d2b8e4c916d2f5b9c86 - https://git.kernel.org/stable/c/123edbae64f4d21984359b99c6e79fcde31c6123 - https://git.kernel.org/stable/c/7226ddf3311c5e5a7726ad7d4e7b079bb3cfbb29 - https://git.kernel.org/stable/c/63ae548f1054a0b71678d0349c7dc9628ddd42ca
CVE ID: CVE-2024-38553 State: PUBLISHED Published: 2024-06-19T13:35:24.743Z Last Updated: 2025-11-03T21:55:47.575Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fec: remove .ndo_poll_controller to avoid deadlocks There is a deadlock issue found in sungem driver, please refer to the commit ac0a230f719b ("eth: sungem: remove .ndo_poll_controller to avoid deadlocks"). The root cause of the issue is that netpoll is in atomic context and disable_irq() is called by .ndo_poll_controller interface of sungem driver, however, disable_irq() might sleep. After analyzing the implementation of fec_poll_controller(), the fec driver shou
er, however, disable_irq() might sleep. After analyzing the implementation of fec_poll_controller(), the fec driver should have the same issue. Due to the fec driver uses NAPI for TX completions, the .ndo_poll_controller is unnecessary to be implemented in the fec driver, so fec_poll_controller() can be safely removed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e2348d8c61d03feece1de4c05f72e6e99f74c650 - https://git.kernel.org/stable/c/d38625f71950e79e254515c5fc585552dad4b33e - https://git.kernel.org/stable/c/accdd6b912c4219b8e056d1f1ad2e85bc66ee243 - https://git.kernel.org/stable/c/87bcbc9b7e0b43a69d44efa5f32f11e3
org/stable/c/accdd6b912c4219b8e056d1f1ad2e85bc66ee243 - https://git.kernel.org/stable/c/87bcbc9b7e0b43a69d44efa5f32f11e32d08fa6f - https://git.kernel.org/stable/c/c2e0c58b25a0a0c37ec643255558c5af4450c9f5
CVE ID: CVE-2024-38554 State: PUBLISHED Published: 2024-06-19T13:35:25.406Z Last Updated: 2025-05-04T12:56:43.328Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issue of net_device There is a reference count leak issue of the object "net_device" in ax25_dev_device_down(). When the ax25 device is shutting down, the ax25_dev_device_down() drops the reference count of net_device one or zero times depending on if we goto unlock_put or not, which will cause memory leak. In order to solve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null. Additional Analyst
olve the above issue, decrease the reference count of net_device after dev->ax25_ptr is set to null. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3ec437f9bbae68e9b38115c4c91de995f73f6bad - https://git.kernel.org/stable/c/965d940fb7414b310a22666503d2af69459c981b - https://git.kernel.org/stable/c/8bad3a20a27be8d935f2aae08d3c6e743754944a - https://git.kernel.org/stable/c/eef95df9b752699bddecefa851f64858247246e9 - https://git.kernel.org/stable/c/36e56b1b002bb26440403053f19f9e1a8bc075b2
CVE ID: CVE-2024-38555 State: PUBLISHED Published: 2024-06-19T13:35:26.059Z Last Updated: 2025-05-04T12:56:44.500Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_sa
-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x
nt_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3 - https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0 - https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396 - https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb - https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7 - https://gi
bc5a9eed250e33f5f5c89a28a6bfabdb - https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7 - https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a - https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40