Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t: References: - https://git.kernel.org/stable/c/94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2 - https://git.kernel.org/stable/c/766c2627acb2d9d1722cce2e24837044d52d888a - https://git.kernel.org/stable/c/772f18ded0e240cc1fa2b7020cc640e3e5c32b70 - https://git.kernel.org/stable/c/29d2550d79a8cbd31e0fbaa5c0e2a2efdc444e44 - https://git.kernel.org/stable/c/dc29dd00705a62c77de75b6d752259b869aac49d - https://git.kernel.org/stable/c/ad6759e233db6fcc131055f8e23b4eafbe81053c - https://git.kernel.org/stable/c/4fedae8f9eafa2ac8cdaca58e315f52a7e2a8701 - https://git.kernel.org/stable/c/50e60de381c342008c0956fd762e1c26408f372c
CVE ID: CVE-2024-27031 State: PUBLISHED Published: 2024-05-01T12:53:29.362Z Last Updated: 2025-05-04T09:02:41.271Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt The loop inside nfs_netfs_issue_read() currently does not disable interrupts while iterating through pages in the xarray to submit for NFS read. This is not safe though since after taking xa_lock, another page in the mapping could be processed for writeback inside an interrupt, and deadlock can occur. The fix is simple and clean if we use xa_for_each_range(), which handles the iteration with RCU whi
deadlock can occur. The fix is simple and clean if we use xa_for_each_range(), which handles the iteration with RCU while reducing code complexity. The problem is easily reproduced with the following test: mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1 echo 3 > /proc/sys/vm/drop_caches dd if=/mnt/nfs/file1.bin of=/dev/null umount /mnt/nfs On the console with a lockdep-enabled kernel a message similar to the following will be seen: ================================ WARNING: inconsistent lock state 6.7.0-lockdbg+ #10 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. test5/1708 [HC0[0]:SC0[0]:H
ainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. test5/1708 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888127baa598 (&xa->xa_lock#4){+.?.}-{3:3}, at: nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x144/0x380 _raw_spin_lock_irqsave+0x4e/0xa0 __folio_end_writeback+0x17e/0x5c0 folio_end_writeback+0x93/0x1b0 iomap_finish_ioend+0xeb/0x6a0 blk_update_request+0x204/0x7f0 blk_mq_end_request+0x30/0x1c0 blk_complete_reqs+0x7e/0xa0 __do_softirq+0x113/0x544 __irq_exit_rcu+0xfe/0x120 irq_exit_rcu+0xe/0x20 sysvec_call_function_single+0x6f/0x90 asm_sysvec_call_function_single+0x1a/0x20 pv_native_safe_halt+0xf/0x20 default_idl
sysvec_call_function_single+0x6f/0x90 asm_sysvec_call_function_single+0x1a/0x20 pv_native_safe_halt+0xf/0x20 default_idle+0x9/0x20 default_idle_call+0x67/0xa0 do_idle+0x2b5/0x300 cpu_startup_entry+0x34/0x40 start_secondary+0x19d/0x1c0 secondary_startup_64_no_verify+0x18f/0x19b irq event stamp: 176891 hardirqs last enabled at (176891): [<ffffffffa67a0be4>] _raw_spin_unlock_irqrestore+0x44/0x60 hardirqs last disabled at (176890): [<ffffffffa67a0899>] _raw_spin_lock_irqsave+0x79/0xa0 softirqs last enabled at (176646): [<ffffffffa515d91e>] __irq_exit_rcu+0xfe/0x120 softirqs last disabled at (176633): [<ffffffffa515d91e>] __irq_exit_rcu+0xfe/0x120 other info that might help us debug this: Possibl
t disabled at (176633): [<ffffffffa515d91e>] __irq_exit_rcu+0xfe/0x120 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&xa->xa_lock#4); <Interrupt> lock(&xa->xa_lock#4); *** DEADLOCK *** 2 locks held by test5/1708: #0: ffff888127baa498 (&sb->s_type->i_mutex_key#22){++++}-{4:4}, at: nfs_start_io_read+0x28/0x90 [nfs] #1: ffff888127baa650 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xa4/0x280 stack backtrace: CPU: 6 PID: 1708 Comm: test5 Kdump: loaded Not tainted 6.7.0-lockdbg+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x90 mark_lock+0xb3f/0xd20 __lock_acqu
(Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x90 mark_lock+0xb3f/0xd20 __lock_acquire+0x77b/0x3360 _raw_spin_lock+0x34/0x80 nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] netfs_begin_read+0x77f/0x980 [netfs] nfs_netfs_readahead+0x45/0x60 [nfs] nfs_readahead+0x323/0x5a0 [nfs] read_pages+0xf3/0x5c0 page_cache_ra_unbounded+0x1c8/0x280 filemap_get_pages+0x38c/0xae0 filemap_read+0x206/0x5e0 nfs_file_read+0xb7/0x140 [nfs] vfs_read+0x2a9/0x460 ksys_read+0xb7/0x140 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ad27382f8495f8ef6d2c66c413d756bfd13c0598 - https://git.kernel.org/stable/c/8df1678c021
- https://git.kernel.org/stable/c/ad27382f8495f8ef6d2c66c413d756bfd13c0598 - https://git.kernel.org/stable/c/8df1678c021ffeb20ef8a203bd9413f3ed9b0e9a - https://git.kernel.org/stable/c/8a2e5977cecd3cde6a0e3e86b7b914d00240e5dc - https://git.kernel.org/stable/c/fd5860ab6341506004219b080aea40213b299d2e
CVE ID: CVE-2024-27032 State: PUBLISHED Published: 2024-05-01T12:53:32.812Z Last Updated: 2025-05-04T12:55:26.263Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential panic during recovery During recovery, if FAULT_BLOCK is on, it is possible that f2fs_reserve_new_block() will return -ENOSPC during recovery, then it may trigger panic. Also, if fault injection rate is 1 and only FAULT_BLOCK fault type is on, it may encounter deadloop in loop of block reservation. Let's change as below to fix these issues: - remove bug_on() to avoid panic. - limit the loop count of block reservation to avoid potential dead
fix these issues: - remove bug_on() to avoid panic. - limit the loop count of block reservation to avoid potential deadloop. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fe4de493572a4263554903bf9c3afc5c196e15f0 - https://git.kernel.org/stable/c/8844b2f8a3f0c428b74672f9726f9950b1a7764c - https://git.kernel.org/stable/c/d034810d02a5af8eb74debe29877dcaf5f00fdd1 - https://git.kernel.org/stable/c/f26091a981318b5b7451d61f99bc073a6af8db67 - https://git.kernel.org/stable/c/21ec68234826b1b54ab980a8df6e33c74cfbee58
CVE ID: CVE-2024-27033 State: PUBLISHED Published: 2024-05-01T12:53:36.254Z Last Updated: 2025-05-04T09:02:44.135Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic verify_blkaddr() will trigger panic once we inject fault into f2fs_is_valid_blkaddr(), fix to remove this unnecessary f2fs_bug_on(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0386408036bfc8b50296d9e544ff91c4d52af2db - https://git.kernel.org/stable/c/6633cdc8b2ebefcddcfcdacfd063105e60f39a49 - https://git.kernel.org/stable/c/abe98a0
2db - https://git.kernel.org/stable/c/6633cdc8b2ebefcddcfcdacfd063105e60f39a49 - https://git.kernel.org/stable/c/abe98a05e7162f64759bf9111108ebcb11322dec - https://git.kernel.org/stable/c/b896e302f79678451a94769ddd9e52e954c64fbb
CVE ID: CVE-2024-27034 State: PUBLISHED Published: 2024-05-01T12:53:39.767Z Last Updated: 2025-05-04T09:02:45.409Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise data will be corrupted if partial blocks were persisted before CP & SPOR, due to cluster metadata wasn't updated atomically. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef
Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7d420eaaa18ec8e2bb4eeab8c65c00492ef6f416 - https://git.kernel.org/stable/c/542c8b3c774a480bfd0804291a12f6f2391b0cd1 - https://git.kernel.org/stable/c/75abfd61392b1db391bde6d738a30d685b843286 - https://git.kernel.org/stable/c/2b1b14d9fc94b8feae20808684c8af28ec80f45b - https://git.kernel.org/stable/c/52982edfcefd475cc34af663d5c47c0cddaa5739 - https://git.kernel.org/stable/c/fd244524c2cf07b5f4c3fe8abd6a99225c76544b
CVE ID: CVE-2024-27035 State: PUBLISHED Published: 2024-05-01T12:53:43.155Z Last Updated: 2025-05-04T09:02:46.678Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to guarantee persisting compressed blocks by CP If data block in compressed cluster is not persisted with metadata during checkpoint, after SPOR, the data may be corrupted, let's guarantee to write compressed page by checkpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e54cce8137258a550b49cae45d09e024821fb28d - https://git.kernel.org/stable/c/82704e598d7b33c7e45526e34d3
rnel.org/stable/c/e54cce8137258a550b49cae45d09e024821fb28d - https://git.kernel.org/stable/c/82704e598d7b33c7e45526e34d3c585426319bed - https://git.kernel.org/stable/c/c3311694b9bcced233548574d414c91d39214684 - https://git.kernel.org/stable/c/57e8b17d0522c8f4daf0c4d9969b4d7358033532 - https://git.kernel.org/stable/c/8a430dd49e9cb021372b0ad91e60aeef9c6ced00
CVE ID: CVE-2024-27036 State: PUBLISHED Published: 2024-05-01T12:53:46.721Z Last Updated: 2025-05-04T09:02:48.020Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case where cifs_extend_writeback() hits a point where it is considering an additional folio, but this would overrun the wsize - at which point it drops out of the xarray scanning loop and calls xas_pause(). The problem is that xas_pause() advances the loop counter - thereby skipping that page. What needs to happen is for xas_reset() to be called any time we decide we don't want to process t
y skipping that page. What needs to happen is for xas_reset() to be called any time we decide we don't want to process the page we're looking at, but rather send the request we are building and start a new one. Fix this by copying and adapting the netfslib writepages code as a temporary measure, with cifs writeback intending to be offloaded to netfslib in the near future. This also fixes the issue with the use of filemap_get_folios_tag() causing retry of a bunch of pages which the extender already dealt with. This can be tested by creating, say, a 64K file somewhere not on cifs (otherwise copy-offload may get underfoot), mounting a cifs share with a wsize of 64000, copying the file to it and
cifs (otherwise copy-offload may get underfoot), mounting a cifs share with a wsize of 64000, copying the file to it and then comparing the original file and the copy: dd if=/dev/urandom of=/tmp/64K bs=64k count=1 mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000 cp /tmp/64K /mnt/64K cmp /tmp/64K /mnt/64K Without the fix, the cmp fails at position 64000 (or shortly thereafter). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e45deec35bf7f1f4f992a707b2d04a8c162f2240 - https://git.kernel.org/stable/c/65f2ced695982ccd516196d0a9447d85dbe2eed5 - https://git.kernel.org/stable/c/844b4e132f57f1333dc79feaa035075a09
g/stable/c/65f2ced695982ccd516196d0a9447d85dbe2eed5 - https://git.kernel.org/stable/c/844b4e132f57f1333dc79feaa035075a096762e4 - https://git.kernel.org/stable/c/f3dc1bdb6b0b0693562c7c54a6c28bafa608ba3c
CVE ID: CVE-2024-27037 State: PUBLISHED Published: 2024-05-01T12:53:50.227Z Last Updated: 2025-05-04T09:02:49.444Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: zynq: Prevent null pointer dereference caused by kmalloc failure The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() to write data to the null address, the null pointer dereference bug will happen. This patch uses a stack variable to replace the kmalloc(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/01511ac7be8e45f80e63
es: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/01511ac7be8e45f80e637f6bf61af2d3d2dee9db - https://git.kernel.org/stable/c/8c4889a9ea861d7be37463c10846eb75e1b49c9d - https://git.kernel.org/stable/c/0801c893fd48cdba66a3c8f44c3fe43cc67d3b85 - https://git.kernel.org/stable/c/ca976c6a592f789700200069ef9052493c0b73d8 - https://git.kernel.org/stable/c/58a946ab43501f2eba058d24d96af0ad1122475b - https://git.kernel.org/stable/c/7938e9ce39d6779d2f85d822cc930f73420e54a6
CVE ID: CVE-2024-27038 State: PUBLISHED Published: 2024-05-01T12:53:53.698Z Last Updated: 2025-05-04T09:02:51.146Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provider() __clk_get_hw() __clk_get_hw() can return NULL which is dereferenced by clk_core_get() at hw->core. Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL. Reading the descri
clkdev based clk_lookups") the check IS_ERR_OR_NULL() was performed which would have caught the NULL. Reading the description of this function it talks about returning NULL but that cannot be so at the moment. Update the function to check for hw before dereferencing it and return NULL if hw is NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d7ae7d1265686b55832a445b1db8cdd69738ac07 - https://git.kernel.org/stable/c/239174535dba11f7b83de0eaaa27909024f8c185 - https://git.kernel.org/stable/c/0efb9ef6fb95384ba631d6819e66f10392aabfa2 - https://git.kernel.org/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959 - https://g
6fb95384ba631d6819e66f10392aabfa2 - https://git.kernel.org/stable/c/a8b2b26fdd011ebe36d68a9a321ca45801685959 - https://git.kernel.org/stable/c/a5d9b1aa61b401867b9066d54086b3e4ee91f8ed - https://git.kernel.org/stable/c/c554badcae9c45b737a22d23454170c6020b90e6 - https://git.kernel.org/stable/c/6f073b24a9e2becd25ac4505a9780a87e621bb51 - https://git.kernel.org/stable/c/e97fe4901e0f59a0bfd524578fe3768f8ca42428
CVE ID: CVE-2024-27039 State: PUBLISHED Published: 2024-05-01T12:53:57.126Z Last Updated: 2025-05-04T09:02:52.505Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration. If a clk_register() call fails, 'p_clk' may point to something different from what should be freed. The best we can do, is to avoid this wrong release of memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3f8445f1c746fda180a7f75372ed06b24e9cefe2 - https://git.kernel.org/stable/c/e0b0d1c46a2ce1e46b79d004a7270fdef872e097 - https://git.kernel.org/stable/c/95d1f1228c1bb54803ae57525b76db60e99b37e4 - https://git.kernel.org/stable/c/2cc572e0085ebd4b662b74a0f43222bc00df9a00 - https://git.kernel.org/stable/c/d575765b1b62e8bdb00af11caa1aabeb01763d9f - https://git.kernel.org/stable/c/64c6a38136b74a2f18c42199830975edd9fbc379
CVE ID: CVE-2024-27040 State: PUBLISHED Published: 2024-05-01T12:54:00.645Z Last Updated: 2025-05-04T09:02:53.763Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' In the first if statement, we're checking if 'replay' is NULL. But in the second if statement, we're not checking if 'replay' is NULL again before calling replay->funcs->replay_set_power_opt(). if (replay == NULL && force_static) return false; ... if (link->replay_settings.replay_feature_enabled && replay->funcs->replay_set_power_opt) { replay->funcs->replay_set_power_opt(replay, *power_opts, p
lay_feature_enabled && replay->funcs->replay_set_power_opt) { replay->funcs->replay_set_power_opt(replay, *power_opts, panel_inst); link->replay_settings.replay_power_opt_active = *power_opts; } If 'replay' is NULL, this will cause a null pointer dereference. Fixes the below found by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/link/protocols/link_edp_panel_control.c:895 edp_set_replay_allow_active() error: we previously assumed 'replay' could be null (see line 887) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f610c46771ef1047e46d61807aa7c69cd29e63d8 - https://git.kernel.org/stable/c/e7cadd5d3a8ffe334d0229ba9eda
nel.org/stable/c/f610c46771ef1047e46d61807aa7c69cd29e63d8 - https://git.kernel.org/stable/c/e7cadd5d3a8ffe334d0229ba9eda4290138d56e7 - https://git.kernel.org/stable/c/d0e94f4807ff0df66cf447d6b4bbb8ac830e99c3 - https://git.kernel.org/stable/c/f6aed043ee5d75b3d1bfc452b1a9584b63c8f76b
CVE ID: CVE-2024-27041 State: PUBLISHED Published: 2024-05-01T12:54:04.111Z Last Updated: 2025-05-04T09:02:55.253Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check beforehand to ensure there will not be a possible NULL-ptr-deref there. Also, since commit 1e88eb1b2c25 ("drm/amd/display: Drop CONFIG_DRM_AMD_DC_HDCP") there are two separate checks for NULL in 'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy(). Clean up by comb
e two separate checks for NULL in 'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy(). Clean up by combining them all under one 'if'. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e040f1fbe9abae91b12b074cfc3bbb5367b79811 - https://git.kernel.org/stable/c/ca2eb375db76fd50f31afdd67d6ca4f833254957 - https://git.kernel.org/stable/c/1c62697e4086de988b31124fb8c79c244ea05f2b - https://git.kernel.org/stable/c/2a3cfb9a24a28da9cc13d2c525a76548865e182c
CVE ID: CVE-2024-27042 State: PUBLISHED Published: 2024-05-01T12:54:07.719Z Last Updated: 2025-05-04T09:02:56.648Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' The issue arises when the array 'adev->vcn.vcn_config' is accessed before checking if the index 'adev->vcn.num_vcn_inst' is within the bounds of the array. The fix involves moving the bounds check before the array access. This ensures that 'adev->vcn.num_vcn_inst' is within the bounds of the array before it is used as an index. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_discove
within the bounds of the array before it is used as an index. Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:1289 amdgpu_discovery_reg_base_init() error: testing array offset 'adev->vcn.num_vcn_inst' after use. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8f3e68c6a3fff53c2240762a47a0045d89371775 - https://git.kernel.org/stable/c/b33d4af102b9c1f7a83d3f0ad3cab7d2bab8f058 - https://git.kernel.org/stable/c/8db10cee51e3e11a6658742465edc21986cf1e8d - https://git.kernel.org/stable/c/cdb637d339572398821204a1142d8d615668f1e9
CVE ID: CVE-2024-27043 State: PUBLISHED Published: 2024-05-01T12:54:11.197Z Last Updated: 2025-05-04T09:02:57.936Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dv
e |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d0f5c28333822f9baa5280d813124920720fd856 - https://git.kernel.org/stable/c/f20c3270f3ed5aa6919a87e4de9bf6c05fb57086 - https://git.kernel.org/stable/c/096237039d00c839f3e3a5fe6d001bf0db45b644 - https://git.kernel.org/stable/c/0d3fe80
086 - https://git.kernel.org/stable/c/096237039d00c839f3e3a5fe6d001bf0db45b644 - https://git.kernel.org/stable/c/0d3fe80b6d175c220b3e252efc6c6777e700e98e - https://git.kernel.org/stable/c/437a111f79a2f5b2a5f21e27fdec6f40c8768712 - https://git.kernel.org/stable/c/779e8db7efb22316c8581d6c229636d2f5694a62 - https://git.kernel.org/stable/c/35674111a043b0482a9bc69da8850a83f465b07d - https://git.kernel.org/stable/c/b7586e902128e4fb7bfbb661cb52e4215a65637b - https://git.kernel.org/stable/c/8c64f4cdf4e6cc5682c52523713af8c39c94e6d5
CVE ID: CVE-2024-27044 State: PUBLISHED Published: 2024-05-01T12:54:14.695Z Last Updated: 2025-05-04T09:02:59.495Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn10/dcn10_hwseq.c:1892 dcn10_set_output_transfer_func() warn: variable dereferenced before check 'stream' (see line 1875) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
check 'stream' (see line 1875) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e019d87e02f1e539ae48b99187f253847744ca7a - https://git.kernel.org/stable/c/330caa061af53ea6d287d7c43d0703714e510e08 - https://git.kernel.org/stable/c/6ac7c7a3a9ab57aba0fe78ecb922d2b20e16efeb - https://git.kernel.org/stable/c/29fde8895b2fcc33f44aea28c644ce2d9b62f9e0 - https://git.kernel.org/stable/c/2d9fe7787af01188dc470a649bdbb842d6511fd7 - https://git.kernel.org/stable/c/14613d52bc7fc180df6d2c65ba65fc921fc1dda7 - https://git.kernel.org/stable/c/7874ab3105ca4657102fee1cc14b0af70883c484 - https://git.kernel.org/stable/c/9ccfe80d022df7c595f19
git.kernel.org/stable/c/7874ab3105ca4657102fee1cc14b0af70883c484 - https://git.kernel.org/stable/c/9ccfe80d022df7c595f1925afb31de2232900656