Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
k(&ctlr->bus_lock_mutex) cqspi_exec_mem_op() pm_runtime_resume_and_get() cqspi_resume() spi_controller_resume() mutex_lock(&ctlr->bus_lock_mutex) ... spi_mem_access_end() mutex_unlock(&ctlr->bus_lock_mutex) ... Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/041562ebc4759c9932b59a06527f8753b86da365 - https://git.kernel.org/stable/c/959043afe53ae80633e810416cee6076da6e91c6
CVE ID: CVE-2024-26807 State: PUBLISHED Published: 2024-04-04T08:20:34.155Z Last Updated: 2025-11-03T19:29:35.945Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, us
ct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st". The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore: struct cqspi_st *cqspi = dev_get_drvdata(dev); is correct, but: struct spi_controller *host = dev_get_drvdata(dev); is not, as it makes "host" point not to a "struct spi_controller" but to the same "struct cqspi_st" structure as above. This obviously leads to bad things (memory corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->r
corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->runtime_resume() hook being called, which in turns calls spi_controller_resume() with the wrong pointer. This has at least been reported [0] to cause a kernel crash, but the exact behavior will depend on the memory contents. [0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/ This issue potentially affects all platforms that are currently using the cadence-quadspi driver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81 - https://git.kernel.or
richment: References: - https://git.kernel.org/stable/c/2c914aac9522f6e93822c18dff233d3e92399c81 - https://git.kernel.org/stable/c/03f1573c9587029730ca68503f5062105b122f61 - https://git.kernel.org/stable/c/34e1d5c4407c78de0e3473e1fbf8fb74dbe66d03 - https://git.kernel.org/stable/c/32ce3bb57b6b402de2aec1012511e7ac4e7449dc
CVE ID: CVE-2024-26808 State: PUBLISHED Published: 2024-04-04T09:50:26.672Z Last Updated: 2025-05-04T08:57:02.292Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f - https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac
able/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f - https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58 - https://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3 - https://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4 - https://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee - https://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913
CVE ID: CVE-2024-26809 State: PUBLISHED Published: 2024-04-04T09:51:51.245Z Last Updated: 2025-05-04T12:54:50.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possible to destroy elements twice. This fix requires: 212ed75dc5fb ("netfilter: nf_tables: integrate pipapo into commit protocol") which came after: 9827a0e6e23b ("netfilter: nft_set_pipapo: release elements in clone from abort path"). Additional Analyst Notes: - CVE Program Container:
filter: nft_set_pipapo: release elements in clone from abort path"). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b36b83297ff4910dfc8705402c8abffd4bbf8144 - https://git.kernel.org/stable/c/362508506bf545e9ce18c72a2c48dcbfb891ab9c - https://git.kernel.org/stable/c/5ad233dc731ab64cdc47b84a5c1f78fff6c024af - https://git.kernel.org/stable/c/ff90050771412b91e928093ccd8736ae680063c2 - https://git.kernel.org/stable/c/821e28d5b506e6a73ccc367ff792bd894050d48b - https://git.kernel.org/stable/c/9384b4d85c46ce839f51af01374062ce6318b2f2 - https://git.kernel.org/stable/c/b0e256f3dd2ba6532f37c5c22e07cb07a36031ee
CVE ID: CVE-2024-26810 State: PUBLISHED Published: 2024-04-05T08:24:41.987Z Last Updated: 2025-05-04T08:57:05.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code. In particular, irq_type is updated holding igate, therefore testing is_intx() requires holding igate. For example clearing DisINTx from config space can otherwise race changes of the interrupt configuration. This aligns interfaces which may trigger t
from config space can otherwise race changes of the interrupt configuration. This aligns interfaces which may trigger the INTx eventfd into two camps, one side serialized by igate and the other only enabled while INTx is configured. A subsequent patch introduces synchronization for the latter flows. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1e71b6449d55179170efc8dee8664510bb813b42 - https://git.kernel.org/stable/c/3dd9be6cb55e0f47544e7cdda486413f7134e3b3 - https://git.kernel.org/stable/c/ec73e079729258a05452356cf6d098bf1504d5a6 - https://git.kernel.org/stable/c/3fe0ac10bd117df847c93408a9d428a453cd60e5 - https://
79729258a05452356cf6d098bf1504d5a6 - https://git.kernel.org/stable/c/3fe0ac10bd117df847c93408a9d428a453cd60e5 - https://git.kernel.org/stable/c/04a4a017b9ffd7b0f427b8c376688d14cb614651 - https://git.kernel.org/stable/c/6fe478d855b20ac1eb5da724afe16af5a2aaaa40 - https://git.kernel.org/stable/c/03505e3344b0576fd619416793a31eae9c5b73bf - https://git.kernel.org/stable/c/810cd4bb53456d0503cc4e7934e063835152c1b7
CVE ID: CVE-2024-26811 State: PUBLISHED Published: 2024-04-08T10:02:18.184Z Last Updated: 2025-11-04T22:06:01.323Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate payload size in ipc response If installing malicious ksmbd-tools, ksmbd.mountd can return invalid ipc response to ksmbd kernel server. ksmbd should validate payload size of ipc response from ksmbd.mountd to avoid memory overrun or slab-out-of-bounds. This patch validate 3 ipc response that has payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75
rogram Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/88b7f1143b15b29cccb8392b4f38e75b7bb3e300 - https://git.kernel.org/stable/c/51a6c2af9d20203ddeeaf73314ba8854b38d01bd - https://git.kernel.org/stable/c/a637fabac554270a851033f5ab402ecb90bc479c - https://git.kernel.org/stable/c/76af689a45aa44714b46d1a7de4ffdf851ded896 - https://git.kernel.org/stable/c/a677ebd8ca2f2632ccdecbad7b87641274e15aac
CVE ID: CVE-2024-26812 State: PUBLISHED Published: 2024-04-05T08:24:42.627Z Last Updated: 2025-05-04T08:57:07.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Create persistent INTx handler A vulnerability exists where the eventfd for INTx signaling can be deconfigured, which unregisters the IRQ handler but still allows eventfds to be signaled with a NULL context through the SET_IRQS ioctl or through unmask irqfd if the device interrupt is pending. Ideally this could be solved with some additional locking; the igate mutex serializes the ioctl and config space accesses, and the interrupt handler is unregistered rela
locking; the igate mutex serializes the ioctl and config space accesses, and the interrupt handler is unregistered relative to the trigger, but the irqfd path runs asynchronous to those. The igate mutex cannot be acquired from the atomic context of the eventfd wake function. Disabling the irqfd relative to the eventfd registration is potentially incompatible with existing userspace. As a result, the solution implemented here moves configuration of the INTx interrupt handler to track the lifetime of the INTx context object and irq_type configuration, rather than registration of a particular trigger eventfd. Synchronization is added between the ioctl path and eventfd_signal() wrapper such tha
n of a particular trigger eventfd. Synchronization is added between the ioctl path and eventfd_signal() wrapper such that the eventfd trigger can be dynamically updated relative to in-flight interrupts or irqfd callbacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b18fa894d615c8527e15d96b76c7448800e13899 - https://git.kernel.org/stable/c/27d40bf72dd9a6600b76ad05859176ea9a1b4897 - https://git.kernel.org/stable/c/4cb0d7532126d23145329826c38054b4e9a05e7c - https://git.kernel.org/stable/c/7d29d4c72c1e196cce6969c98072a272d1a703b3 - https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e - https://git.k
e196cce6969c98072a272d1a703b3 - https://git.kernel.org/stable/c/69276a555c740acfbff13fb5769ee9c92e1c828e - https://git.kernel.org/stable/c/4c089cefe30924fbe20dd1ee92774ea1f5eca834 - https://git.kernel.org/stable/c/0e09cf81959d9f12b75ad5c6dd53d237432ed034 - https://git.kernel.org/stable/c/18c198c96a815c962adc2b9b77909eec0be7df4d
CVE ID: CVE-2024-26813 State: PUBLISHED Published: 2024-04-05T08:24:43.279Z Last Updated: 2025-05-04T08:57:08.928Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/platform: Create persistent IRQ handlers The vfio-platform SET_IRQS ioctl currently allows loopback triggering of an interrupt before a signaling eventfd has been configured by the user, which thereby allows a NULL pointer dereference. Rather than register the IRQ relative to a valid trigger, register all IRQs in a disabled state in the device open path. This allows mask operations on the IRQ to nest within the overall enable state governed by a valid eventfd sign
en path. This allows mask operations on the IRQ to nest within the overall enable state governed by a valid eventfd signal. This decouples @masked, protected by the @locked spinlock from @trigger, protected via the @igate mutex. In doing so, it's guaranteed that changes to @trigger cannot race the IRQ handlers because the IRQ handler is synchronously disabled before modifying the trigger, and loopback triggering of the IRQ via ioctl is safe due to serialization with trigger changes via igate. For compatibility, request_irq() failures are maintained to be local to the SET_IRQS ioctl rather than a fatal error in the open device path. This allows, for example, a userspace driver with polling mo
QS ioctl rather than a fatal error in the open device path. This allows, for example, a userspace driver with polling mode support to continue to work regardless of moving the request_irq() call site. This necessarily blocks all SET_IRQS access to the failed index. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e - https://git.kernel.org/stable/c/09452c8fcbd7817c06e8e3212d99b45917e603a5 - https://git.kernel.org/stable/c/cc5838f19d39a5fef04c468199699d2a4578be3a - https://git.kernel.org/stable/c/7932db06c82c5b2f42a4d1a849d97dba9ce4a362 - https://git.kernel.org/stable/c/62d4e43a569b
https://git.kernel.org/stable/c/7932db06c82c5b2f42a4d1a849d97dba9ce4a362 - https://git.kernel.org/stable/c/62d4e43a569b67929eb3319780be5359694c8086 - https://git.kernel.org/stable/c/d6bedd6acc0bcb1e7e010bc046032e47f08d379f - https://git.kernel.org/stable/c/0f8d8f9c2173a541812dd750529f4a415117eb29 - https://git.kernel.org/stable/c/675daf435e9f8e5a5eab140a9864dfad6668b375
CVE ID: CVE-2024-26814 State: PUBLISHED Published: 2024-04-05T08:24:43.916Z Last Updated: 2025-05-04T08:57:10.359Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/fsl-mc: Block calling interrupt handler without trigger The eventfd_ctx trigger pointer of the vfio_fsl_mc_irq object is initially NULL and may become NULL if the user sets the trigger eventfd to -1. The interrupt handler itself is guaranteed that trigger is always valid between request_irq() and free_irq(), but the loopback testing mechanisms to invoke the handler function need to test the trigger. The triggering and setting ioctl paths both make use of igate and
invoke the handler function need to test the trigger. The triggering and setting ioctl paths both make use of igate and are therefore mutually exclusive. The vfio-fsl-mc driver does not make use of irqfds, nor does it support any sort of masking operations, therefore unlike vfio-pci and vfio-platform, the flow can remain essentially unchanged. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a563fc18583ca4f42e2fdd0c70c7c618288e7ede - https://git.kernel.org/stable/c/250219c6a556f8c69c5910fca05a59037e24147d - https://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417 - https://git.kernel.org/stable/c/ee0bd4
147d - https://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417 - https://git.kernel.org/stable/c/ee0bd4ad780dfbb60355b99f25063357ab488267 - https://git.kernel.org/stable/c/de87511fb0404d23b6da5f4660383b6ed095e28d - https://git.kernel.org/stable/c/6ec0d88166dac43f29e96801c0927d514f17add9 - https://git.kernel.org/stable/c/7447d911af699a15f8d050dfcb7c680a86f87012
CVE ID: CVE-2024-26815 State: PUBLISHED Published: 2024-04-10T11:07:03.182Z Last Updated: 2025-05-04T08:57:11.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check taprio_parse_tc_entry() is not correctly checking TCA_TAPRIO_TC_ENTRY_INDEX attribute: int tc; // Signed value tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]); if (tc >= TC_QOPT_MAX_QUEUE) { NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range"); return -ERANGE; } syzbot reported that it could fed arbitary negative values: UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18 shift exponent -2147418108
ld fed arbitary negative values: UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18 shift exponent -2147418108 is negative CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386 taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline] taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline] taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1
inline] taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline] taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877 taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134 qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355 tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socke
endmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f1b2dea3759 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 00000000
: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340 R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bd2474a45df7c11412c2587de3d4e43760531418 - https://git.kernel.org/stable/c/6915b1b28fe57e92c78e664366dc61c4f15ff03b - https://git.kernel.org/stable/c/860e838fb089d652a446ced52cbdf051285b68e7 - https://git.kernel.org/stable/c/9b720bb1a69a9f12a4a5c86b6f
ernel.org/stable/c/860e838fb089d652a446ced52cbdf051285b68e7 - https://git.kernel.org/stable/c/9b720bb1a69a9f12a4a5c86b6f89386fe05ed0f2 - https://git.kernel.org/stable/c/343041b59b7810f9cdca371f445dd43b35c740b1
CVE ID: CVE-2024-26816 State: PUBLISHED Published: 2024-04-10T13:53:49.492Z Last Updated: 2025-05-04T08:57:13.209Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocations against the .notes section means that the KASLR base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged
base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged tools that are expecting to read /sys/kernel/notes, skip performing relocations in the .notes section. The values readable in .notes are then identical to those found in System.map. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/13edb509abc91c72152a11baaf0e7c060a312e03 - https://git.kernel.org/stable/c/52018aa146e3cf76569a9b1e6e49a2b7c8d4a088 - https://git.kernel.org/stable/c/a4e7ff1a74274e59a2de9bb57236542aa990d20a - https://git.kernel.org/stable/c/c7cff9780297d55d97ad068b68b703cfe53ef9af - https:/
f1a74274e59a2de9bb57236542aa990d20a - https://git.kernel.org/stable/c/c7cff9780297d55d97ad068b68b703cfe53ef9af - https://git.kernel.org/stable/c/47635b112a64b7b208224962471e7e42f110e723 - https://git.kernel.org/stable/c/af2a9f98d884205145fd155304a6955822ccca1c - https://git.kernel.org/stable/c/ae7079238f6faf1b94accfccf334e98b46a0c0aa - https://git.kernel.org/stable/c/5cb59db49c9c0fccfd33b2209af4f7ae3c6ddf40 - https://git.kernel.org/stable/c/aaa8736370db1a78f0e8434344a484f9fd20be3b
CVE ID: CVE-2024-26817 State: PUBLISHED Published: 2024-04-13T11:17:08.764Z Last Updated: 2025-11-04T18:29:59.654Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: amdkfd: use calloc instead of kzalloc to avoid integer overflow This uses calloc instead of doing the multiplication which might overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e6721ea845fcb93a764a92bd40f1afc0d6c69751 - https://git.kernel.org/stable/c/8b0564704255c6b3c6a7188e86939f754e1577c0 - https://git.kernel.org/stable/c/fcbd99b3c73309107e3be71f20dff9414df64f91 - https://git.kernel.
6a7188e86939f754e1577c0 - https://git.kernel.org/stable/c/fcbd99b3c73309107e3be71f20dff9414df64f91 - https://git.kernel.org/stable/c/cbac7de1d9901521e78cdc34e15451df3611f2ad - https://git.kernel.org/stable/c/e6768c6737f4c02cba193a3339f0cc2907f0b86a - https://git.kernel.org/stable/c/315eb3c2df7e4cb18e3eacfa18a53a46f2bf0ef7 - https://git.kernel.org/stable/c/0c33d11153949310d76631d8f4a4736519eacd3a - https://git.kernel.org/stable/c/3b0daecfeac0103aba8b293df07a0cbaf8b43f29
CVE ID: CVE-2024-26818 State: PUBLISHED Published: 2024-04-17T09:43:46.582Z Last Updated: 2025-05-04T08:57:15.861Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tools/rtla: Fix clang warning about mount_point var size clang is reporting this warning: $ make HOSTCC=clang CC=clang LLVM_IAS=1 [...] clang -O -g -DVERSION=\"6.8.0-rc3\" -flto=auto -fexceptions -fstack-protector-strong -fasynchronous-unwind-tables -fstack-clash-protection -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS $(pkg-config --cflags libtracefs) -c -o src/utils.o src/utils.c src/utils.c:548:66: warning: 'fscanf' may overflow; de
S $(pkg-config --cflags libtracefs) -c -o src/utils.o src/utils.c src/utils.c:548:66: warning: 'fscanf' may overflow; destination buffer in argument 3 has size 1024, but the corresponding specifier may require size 1025 [-Wfortify-source] 548 | while (fscanf(fp, "%*s %" STR(MAX_PATH) "s %99s %*s %*d %*d\n", mount_point, type) == 2) { | ^ Increase mount_point variable size to MAX_PATH+1 to avoid the overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8a585914c266dc044f53b5c83c170f79b45fcf9a - https://git.kernel.org/stable/c/6bdd43f62ab3bb5a306af7f0ab857af45777f5a8 - https://git.kernel.org/stable/c/30369084ac6e2747
ps://git.kernel.org/stable/c/6bdd43f62ab3bb5a306af7f0ab857af45777f5a8 - https://git.kernel.org/stable/c/30369084ac6e27479a347899e74f523e6ca29b89
CVE ID: CVE-2024-26819 State: REJECTED Published: 2024-04-17T09:43:47.340Z Last Updated: 2024-04-18T12:38:11.325Z Description: No description available.
CVE ID: CVE-2024-26820 State: PUBLISHED Published: 2024-04-17T09:43:47.966Z Last Updated: 2025-05-04T08:57:17.151Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as the register call is received before netvsc_probe is finished. This is because we register register_netdevice_notifier() very early( even before vmbus_driver_register()). To fix this, we try to register each such matching VF( if it is visible as a netdevice) at the end of netvsc_pro