Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in clk_dvp_probe() due to ->num being assigned after ->hws has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-bcm2711-dvp.c:59:2 index 0 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]') Move the ->num initialization to before the first access of ->hws, which clears up the warning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.
s up the warning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0dc913217fb79096597005bba9ba738e2db5cd02 - https://git.kernel.org/stable/c/a1dd92fca0d6b58b55ed0484f75d4205dbb77010 - https://git.kernel.org/stable/c/9368cdf90f52a68120d039887ccff74ff33b4444
CVE ID: CVE-2024-39463 State: PUBLISHED Published: 2024-06-25T14:25:02.887Z Last Updated: 2025-05-04T09:16:20.926Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262 v9fs_fid_find+0x236/0x280 linux/fs/9p/fid.c:129 v9fs_fid_lookup_with_uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/
uid linux/fs/9p/fid.c:181 v9fs_fid_lookup+0xbf/0xc20 linux/fs/9p/fid.c:314 v9fs_vfs_getattr_dotl+0xf9/0x360 linux/fs/9p/vfs_inode_dotl.c:400 vfs_statx+0xdd/0x4d0 linux/fs/stat.c:248 Freed by: p9_fid_destroy (inlined) p9_client_clunk+0xb0/0xe0 linux/net/9p/client.c:1456 p9_fid_put linux/./include/net/9p/client.h:278 v9fs_dentry_release+0xb5/0x140 linux/fs/9p/vfs_dentry.c:55 v9fs_remove+0x38f/0x620 linux/fs/9p/vfs_inode.c:518 vfs_unlink+0x29a/0x810 linux/fs/namei.c:4335 The problem is that d_fsdata was not accessed under d_lock, because d_release() normally is only called once the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required
e the dentry is otherwise no longer accessible but since we also call it explicitly in v9fs_remove that lock is required: move the hlist out of the dentry under lock then unref its fids once they are no longer accessible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3bb6763a8319170c2d41c4232c8e7e4c37dcacfb - https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456 - https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5 - https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4 - https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409 - https://www.z
b4ad7094d597526d558a49aac92b4 - https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409 - https://www.zerodayinitiative.com/advisories/ZDI-24-1194/
CVE ID: CVE-2024-39464 State: PUBLISHED Published: 2024-06-25T14:25:03.578Z Last Updated: 2025-05-04T09:16:22.241Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix notifier list entry init struct v4l2_async_notifier has several list_head members, but only waiting_list and done_list are initialized. notifier_entry was kept 'zeroed' leading to an uninitialized list_head. This results in a NULL-pointer dereference if csi2_async_register() fails, e.g. node for remote endpoint is disabled, and returns -ENOTCONN. The following calls to v4l2_async_nf_unregister() results in a NULL pointer dereference. Add the miss
returns -ENOTCONN. The following calls to v4l2_async_nf_unregister() results in a NULL pointer dereference. Add the missing list head initializer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a80d1da923f671c1e6a14e8417cd2f117b27a442 - https://git.kernel.org/stable/c/44f6d619c30f0c65fcdd2b6eba70fdb4460d87ad - https://git.kernel.org/stable/c/6d8acd02c4c6a8f917eefac1de2e035521ca119d
CVE ID: CVE-2024-39465 State: PUBLISHED Published: 2024-06-25T14:25:04.237Z Last Updated: 2025-05-04T09:16:23.668Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: mgb4: Fix double debugfs remove Fixes an error where debugfs_remove_recursive() is called first on a parent directory and then again on a child which causes a kernel panic. [hverkuil: added Fixes/Cc tags] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/252204b634efffd8b167d77413c93d0192aaf5f6 - https://git.kernel.org/stable/c/825fc49497957310e421454fe3fb8b8d8d8e2dd2
CVE ID: CVE-2024-39466 State: PUBLISHED Published: 2024-06-25T14:25:04.952Z Last Updated: 2025-05-04T09:16:24.764Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/qcom/lmh: Check for SCM availability at probe Up until now, the necessary scm availability check has not been performed, leading to possible null pointer dereferences (which did happen for me on RB1). Fix that. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2226b145afa5e13cb60dbe77fb20fb0666a1caf3 - https://git.kernel.org/stable/c/560d69c975072974c11434ca6953891e74c1a665 - https:
b145afa5e13cb60dbe77fb20fb0666a1caf3 - https://git.kernel.org/stable/c/560d69c975072974c11434ca6953891e74c1a665 - https://git.kernel.org/stable/c/0a47ba94ec3d8f782b33e3d970cfcb769b962464 - https://git.kernel.org/stable/c/aa1a0807b4a76b44fb6b58a7e9087cd4b18ab41b - https://git.kernel.org/stable/c/d9d3490c48df572edefc0b64655259eefdcbb9be
CVE ID: CVE-2024-39467 State: PUBLISHED Published: 2024-06-25T14:25:05.609Z Last Updated: 2025-07-11T17:19:48.933Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() syzbot reports a kernel bug as below: F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4 ================================================================== BUG: KASAN: slab-out-of-bounds in f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] BUG: KASAN: slab-out-of-bounds in current_nat_addr fs/f2fs/node.h:213 [inline] BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600
at_addr fs/f2fs/node.h:213 [inline] BUG: KASAN: slab-out-of-bounds in f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 Read of size 1 at addr ffff88807a58c76c by task syz-executor280/5076 CPU: 1 PID: 5076 Comm: syz-executor280 Not tainted 6.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] current_nat_addr fs/f2fs/node.h:213 [inline
0x143/0x180 mm/kasan/report.c:601 f2fs_test_bit fs/f2fs/f2fs.h:2933 [inline] current_nat_addr fs/f2fs/node.h:213 [inline] f2fs_get_node_info+0xece/0x1200 fs/f2fs/node.c:600 f2fs_xattr_fiemap fs/f2fs/data.c:1848 [inline] f2fs_fiemap+0x55d/0x1ee0 fs/f2fs/data.c:1925 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1c07/0x2e50 fs/ioctl.c:838 __do_sys_ioctl fs/ioctl.c:902 [inline] __se_sys_ioctl+0x81/0x170 fs/ioctl.c:890 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is we missed to do sanity check on i_xattr_nid during f2fs_iget(), so that in fiemap() path, current_nat_addr() will
se is we missed to do sanity check on i_xattr_nid during f2fs_iget(), so that in fiemap() path, current_nat_addr() will access nat_bitmap w/ offset from invalid i_xattr_nid, result in triggering kasan bug report, fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c559a8d840562fbfce9f318448dda2f7d3e6d8e8 - https://git.kernel.org/stable/c/75c87e2ac6149abf44bdde0dd6d541763ddb0dff - https://git.kernel.org/stable/c/1640dcf383cdba52be8b28d2a1a2aa7ef7a30c98 - https://git.kernel.org/stable/c/8c8aa473fe6eb46a4bf99f3ea2dbe52bf0c1a1f0 - https://git.kernel.org/stable/c/be0155202e431f3007778568a72432c68f8946ba - https://git.ke
b46a4bf99f3ea2dbe52bf0c1a1f0 - https://git.kernel.org/stable/c/be0155202e431f3007778568a72432c68f8946ba - https://git.kernel.org/stable/c/68e3cd4ecb8603936cccdc338929130045df2e57 - https://git.kernel.org/stable/c/20faaf30e55522bba2b56d9c46689233205d7717
CVE ID: CVE-2024-39468 State: PUBLISHED Published: 2024-06-25T14:28:54.897Z Last Updated: 2025-05-21T09:12:44.610Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix deadlock in smb2_find_smb_tcon() Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b055752675cd1d1db4ac9c2750db3dc3e89ea261 - https://git.kernel.org/stable/c/21f5dd36e655d25a7b45b61c1e537198b671f720 - https://git.kernel.org/stable/c/b09b556e48968317887a11243a5331a7bc00ece5 - https://git.kernel.org/st
c1e537198b671f720 - https://git.kernel.org/stable/c/b09b556e48968317887a11243a5331a7bc00ece5 - https://git.kernel.org/stable/c/225de871ddf994f69a57f035709cad9c0ab8615a - https://git.kernel.org/stable/c/8d0f5f1ccf675454a833a573c53830a49b7d1a47 - https://git.kernel.org/stable/c/02c418774f76a0a36a6195c9dbf8971eb4130a15
CVE ID: CVE-2024-39469 State: PUBLISHED Published: 2024-06-25T14:28:55.581Z Last Updated: 2025-11-03T21:56:03.781Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can caus
n, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428 - https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3 - https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465
/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3 - https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1 - https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd - https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82 - https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346 - https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5 - https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c
CVE ID: CVE-2024-39470 State: PUBLISHED Published: 2024-06-25T14:28:56.258Z Last Updated: 2025-05-04T12:57:00.544Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: eventfs: Fix a possible null pointer dereference in eventfs_find_events() In function eventfs_find_events,there is a potential null pointer that may be caused by calling update_events_attr which will perform some operations on the members of the ei struct when ei is NULL. Hence,When ei->is_freed is set,return NULL directly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5ade5fbdbbb1f023bb70730ba
CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5ade5fbdbbb1f023bb70730ba4d74146c8bc7eb9 - https://git.kernel.org/stable/c/7a1b2d138189375ed1dcd7d0851118230221bd1d - https://git.kernel.org/stable/c/d4e9a968738bf66d3bb852dd5588d4c7afd6d7f4
CVE ID: CVE-2024-39471 State: PUBLISHED Published: 2024-06-25T14:28:56.906Z Last Updated: 2025-05-21T09:12:46.024Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5594971e02764aa1c8210ffb838cb4e7897716e8 - https://git.kernel.org/stable/c/8112fa72b7f139052843ff484130d6f97e9f052f - https://git.kernel.org/stable/c/ea906e9ac61e3152be
://git.kernel.org/stable/c/8112fa72b7f139052843ff484130d6f97e9f052f - https://git.kernel.org/stable/c/ea906e9ac61e3152bef63597f2d9f4a812fc346a - https://git.kernel.org/stable/c/011552f29f20842c9a7a21bffe1f6a2d6457ba46 - https://git.kernel.org/stable/c/5b0a3dc3e87821acb80e841b464d335aff242691 - https://git.kernel.org/stable/c/0964c84b93db7fbf74f357c1e20957850e092db3 - https://git.kernel.org/stable/c/8b2faf1a4f3b6c748c0da36cda865a226534d520
CVE ID: CVE-2024-39472 State: PUBLISHED Published: 2024-07-05T06:42:03.495Z Last Updated: 2025-11-03T21:56:05.270Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out o
ffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer. Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cb - https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1f - https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5 - https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9
g/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5 - https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a
CVE ID: CVE-2024-39473 State: PUBLISHED Published: 2024-07-05T06:55:04.363Z Last Updated: 2025-05-04T09:16:33.235Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension If a process module does not have base config extension then the same format applies to all of it's inputs and the process->base_config_ext is NULL, causing NULL dereference when specifically crafted topology and sequences used. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3ae00ee238bce6cfa5ad935c921181
ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3ae00ee238bce6cfa5ad935c921181c14d18fd6 - https://git.kernel.org/stable/c/9e16f17a2a0e97b43538b272e7071537a3e03368 - https://git.kernel.org/stable/c/ffa077b2f6ad124ec3d23fbddc5e4b0ff2647af8
CVE ID: CVE-2024-39474 State: PUBLISHED Published: 2024-07-05T06:55:05.178Z Last Updated: 2025-11-03T21:56:06.743Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows: process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --> oom-killer send SIGKILL to process-a if (
nge(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() --> oom-killer send SIGKILL to process-a if (fatal_signal_pending(current)) break; --> return NULL; To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set. This issue occurred during OPLUS KASAN TEST. Below is part of the log -> oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.25975
Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abo
0146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 --> be->decompressed_pages = kvcalloc(be->nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); kernel panic by NULL pointer dereference. erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unboun
_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91
chment: - CVE Program Container: References: - https://git.kernel.org/stable/c/198a80833e3421d4c9820a4ae907120adf598c91 - https://git.kernel.org/stable/c/c55d3564ad25ce87ab7cc6af251f9574faebd8da - https://git.kernel.org/stable/c/758678b65164b2158fc1de411092191cb3c394d4 - https://git.kernel.org/stable/c/8e0545c83d672750632f46e3f9ad95c48c91a0fc
CVE ID: CVE-2024-39475 State: PUBLISHED Published: 2024-07-05T06:55:05.886Z Last Updated: 2025-05-04T12:57:02.110Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/be75
onal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/be754cbd77eaf2932408a4e18532e4945274a5c7 - https://git.kernel.org/stable/c/86435f39c18967cdd937d7a49ba539cdea7fb547 - https://git.kernel.org/stable/c/32f92b0078ebf79dbe4827288e0acb50d89d3d5b - https://git.kernel.org/stable/c/4b2c67e30b4e1d2ae19dba8b8e8f3b5fd3cf8089 - https://git.kernel.org/stable/c/edaa57480b876e8203b51df7c3d14a51ea6b09e3 - https://git.kernel.org/stable/c/b8385ff814ca4cb7e63789841e6ec2a14c73e1e8 - https://git.kernel.org/stable/c/5f446859bfa46df0ffb34149499f48a2c2d8cd95 - https://git.kernel.org/stable/c/6ad959b6703e2c4c5d7af03b4cfd5ff608036339
CVE ID: CVE-2024-39476 State: PUBLISHED Published: 2024-07-05T06:55:06.559Z Last Updated: 2025-05-04T12:57:03.441Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with small possibility, the root cause is exactly the same as commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"") However, Dan reported another hang after that, and junxiao investigated the problem and found out that this is caused by plugged bio can't issue from raid5d(). Current implementati
nvestigated the problem and found out that this is caused by plugged bio can't issue from raid5d(). Current implementation in raid5d() has a weird dependence: 1) md_check_recovery() from raid5d() must hold 'reconfig_mutex' to clear MD_SB_CHANGE_PENDING; 2) raid5d() handles IO in a deadloop, until all IO are issued; 3) IO from raid5d() must wait for MD_SB_CHANGE_PENDING to be cleared; This behaviour is introduce before v2.6, and for consequence, if other context hold 'reconfig_mutex', and md_check_recovery() can't update super_block, then raid5d() will waste one cpu 100% by the deadloop, until 'reconfig_mutex' is released. Refer to the implementation from raid1 and raid10, fix this problem by
the deadloop, until 'reconfig_mutex' is released. Refer to the implementation from raid1 and raid10, fix this problem by skipping issue IO if MD_SB_CHANGE_PENDING is still set after md_check_recovery(), daemon thread will be woken up when 'reconfig_mutex' is released. Meanwhile, the hang problem will be fixed as well. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b32aa95843cac6b12c2c014d40fca18aef24a347 - https://git.kernel.org/stable/c/634ba3c97ec413cb10681c7b196db43ee461ecf4 - https://git.kernel.org/stable/c/aa64464c8f4d2ab92f6d0b959a1e0767b829d787 - https://git.kernel.org/stable/c/098d54934814dd876963abfe751c3b1cf