Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
5 ---truncated--- Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b5807a08954fdf914ef80b49aaa6cda965ecc95c - https://git.kernel.org/stable/c/13c3a54f48a612a117dfd82a9dd91732261e869d - https://git.kernel.org/stable/c/76581147b05c2adb6b47bbc697521725f10224e4 - https://git.kernel.org/stable/c/ff0346a74627a5f607a33a3852586f8c7f678329 - https://git.kernel.org/stable/c/b9e52a96ec92245bf15dabba1d3d862d7a03efb8 - https://git.kernel.org/stable/c/76649ccf97e2cd72b62e34ed2fba6e0f89497eab - https://git.kernel.org/stable/c/e2e97435783979124ba92d6870415c57ecfef6a5
CVE ID: CVE-2024-56595 State: PUBLISHED Published: 2024-12-27T14:51:02.371Z Last Updated: 2025-11-03T20:50:23.828Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b15000bcbecf27e0f7c0f149a409e5b865e28ca2 - https://git.kernel.org/stable/c/368a533152220b0a6f1142327d96c6b6361f3002 - https://git.kernel.org/stable/c/a3d
5e28ca2 - https://git.kernel.org/stable/c/368a533152220b0a6f1142327d96c6b6361f3002 - https://git.kernel.org/stable/c/a3d408870bc19b794646871bc4c3a5daa66f91c5 - https://git.kernel.org/stable/c/491487eeddccc4bb49f2e59d8c8f35bec89c15ca - https://git.kernel.org/stable/c/3b5d21b56c3774bc84eab0a93aaac22a4475e2c4 - https://git.kernel.org/stable/c/8a4311bbde702362fe7412045d06ab6767235dac - https://git.kernel.org/stable/c/a174706ba4dad895c40b1d2277bade16dfacdcd9
CVE ID: CVE-2024-56596 State: PUBLISHED Published: 2024-12-27T14:51:03.282Z Last Updated: 2025-11-03T20:50:27.430Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in jfs_readdir The stbl might contain some invalid values. Added a check to return error code in that case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b62f41aeec9d250144c53875b507c1d45ae8c8fc - https://git.kernel.org/stable/c/97e693593162eef6851d232f0c8148169ed46a5c - https://git.kernel.org/stable/c/9efe72eefd4c4a7ce63b3e4d667d766d2b360cb4 - https://git.ker
ef6851d232f0c8148169ed46a5c - https://git.kernel.org/stable/c/9efe72eefd4c4a7ce63b3e4d667d766d2b360cb4 - https://git.kernel.org/stable/c/ff9fc48fab0e1ea0d423c23c99b91bba178f0b05 - https://git.kernel.org/stable/c/e7d376f94f72b020f84e77278b150ec1cc27502c - https://git.kernel.org/stable/c/8ff7579554571d92e3deab168f5a7d7b146ed368 - https://git.kernel.org/stable/c/839f102efb168f02dfdd46717b7c6dddb26b015e
CVE ID: CVE-2024-56597 State: PUBLISHED Published: 2024-12-27T14:51:04.184Z Last Updated: 2025-11-03T20:50:30.604Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/bbb24ce7f06ef9b7c05beb9340787cbe9fd3d08e - https://git.kernel.org/stable/c/df7c76636952670b31bd6c12b3aed3c502122273 - https://git.kernel.org/stable/c/6676034aa753aa448beb30dbd75630927ba7cd96 - http
7c76636952670b31bd6c12b3aed3c502122273 - https://git.kernel.org/stable/c/6676034aa753aa448beb30dbd75630927ba7cd96 - https://git.kernel.org/stable/c/51a203470f502a64a3da8dcea51c4748e8267a6c - https://git.kernel.org/stable/c/c56245baf3fd1f79145dd7408e3ead034b74255c - https://git.kernel.org/stable/c/52756a57e978e2706543a254f88f266cc6702f36 - https://git.kernel.org/stable/c/a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d
CVE ID: CVE-2024-56598 State: PUBLISHED Published: 2024-12-27T14:51:04.988Z Last Updated: 2025-11-03T20:50:33.896Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/25f1e673ef61d6bf9a6022e27936785896d74948 - https://git.kernel.org/stable/c/8c97a4d5463a1c972ef576ac499ea9b05f956097 - https://git.kernel.org/stable/c/823d573f5450
https://git.kernel.org/stable/c/8c97a4d5463a1c972ef576ac499ea9b05f956097 - https://git.kernel.org/stable/c/823d573f5450ca6be80b36f54d1902ac7cd23fb9 - https://git.kernel.org/stable/c/2eea5fda5556ef03defebf07b0a12fcd2c5210f4 - https://git.kernel.org/stable/c/fd993b2180b4c373af8b99aa28d4dcda5c2a8f10 - https://git.kernel.org/stable/c/22dcbf7661c6ffc3247978c254dc40b833a0d429 - https://git.kernel.org/stable/c/ca84a2c9be482836b86d780244f0357e5a778c46
CVE ID: CVE-2024-56599 State: PUBLISHED Published: 2024-12-27T14:51:05.866Z Last Updated: 2025-11-03T20:50:35.314Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: avoid NULL pointer error during sdio remove When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen: Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will c
r_internal+0x188/0x25c device_driver_detach+0x20/0x2c This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON. After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen. Call trace: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath1
ce: ath10k_sdio_remove ->ath10k_core_unregister …… ->ath10k_core_stop ->ath10k_hif_stop ->ath10k_sdio_irq_disable ->ath10k_hif_power_down ->del_timer_sync(&ar_sdio->sleep_timer) ->ath10k_core_destroy ->ath10k_mac_destroy ->ieee80211_free_hw ->wiphy_free …… ->wiphy_dev_release ->destroy_workqueue Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe(). No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_hand
yed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is: Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down(). ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore. Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/27d5d217ae7ffb99dd623375a17a7d3418d9c755 - https://git.kerne
am Container: References: - https://git.kernel.org/stable/c/27d5d217ae7ffb99dd623375a17a7d3418d9c755 - https://git.kernel.org/stable/c/27fda36eedad9e4ec795dc481f307901d1885112 - https://git.kernel.org/stable/c/6e5dbd1c04abf2c19b2282915e6fa48b6ccc6921 - https://git.kernel.org/stable/c/b35de9e01fc79c7baac666fb2dcb4ba7698a1d97 - https://git.kernel.org/stable/c/543c0924d446b21f35701ca084d7feca09511220 - https://git.kernel.org/stable/c/95c38953cb1ecf40399a676a1f85dfe2b5780a9a
CVE ID: CVE-2024-56600 State: PUBLISHED Published: 2024-12-27T14:51:06.610Z Last Updated: 2025-11-03T20:50:38.144Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f2709d1271cfdf55c670a
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f2709d1271cfdf55c670ab5c5982139ab627ddc7 - https://git.kernel.org/stable/c/35360255ca30776dee34d9fa764cffa24d0a5f65 - https://git.kernel.org/stable/c/276a473c956fb55a6f3affa9ff232e10fffa7b43 - https://git.kernel.org/stable/c/79e16a0d339532ea832d85798eb036fc4f9e0cea - https://git.kernel.org/stable/c/706b07b7b37f886423846cb38919132090bc40da - https://git.kernel.org/stable/c/f44fceb71d72d29fb00e0ac84cdf9c081b03cd06 - https://git.kernel.org/stable/c/9df99c395d0f55fb444ef39f4d6f194ca437d884
CVE ID: CVE-2024-56601 State: PUBLISHED Published: 2024-12-27T14:51:07.358Z Last Updated: 2025-11-03T20:50:40.940Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f8a3f255f7509a20
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f8a3f255f7509a209292871715cda03779640c8d - https://git.kernel.org/stable/c/2bc34d8c8898ae9fddf4612501aabb22d76c2b2c - https://git.kernel.org/stable/c/3e8258070b0f2aba66b3ef18883de229674fb288 - https://git.kernel.org/stable/c/b4513cfd3a10c03c660d5d3d26c2e322efbfdd9b - https://git.kernel.org/stable/c/25447c6aaa7235f155292b0c58a067347e8ae891 - https://git.kernel.org/stable/c/691d6d816f93b2a1008c14178399061466e674ef - https://git.kernel.org/stable/c/9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff
CVE ID: CVE-2024-56602 State: PUBLISHED Published: 2024-12-27T14:51:08.174Z Last Updated: 2025-11-03T20:50:43.809Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Clear the sk pointer in the sock object on error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.ker
ject on error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9 - https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f - https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8 - https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754 - https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65 - https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb - https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d
CVE ID: CVE-2024-56603 State: PUBLISHED Published: 2024-12-27T14:51:08.923Z Last Updated: 2025-11-03T20:50:46.640Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425c - https://git.kernel.org/s
ainer: References: - https://git.kernel.org/stable/c/884ae8bcee749be43a071d6ed2d89058dbd2425c - https://git.kernel.org/stable/c/ce39b5576785bb3e66591145aad03d66bc3e778d - https://git.kernel.org/stable/c/1fe625f12d090d69f3f084990c7e4c1ff94bfe5f - https://git.kernel.org/stable/c/5947c9ac08f0771ea8ed64186b0d52e9029cb6c0 - https://git.kernel.org/stable/c/db207d19adbac96058685f6257720906ad41d215 - https://git.kernel.org/stable/c/8df832e6b945e1ba61467d7f1c9305e314ae92fe - https://git.kernel.org/stable/c/811a7ca7320c062e15d0f5b171fe6ad8592d1434
CVE ID: CVE-2024-56604 State: PUBLISHED Published: 2024-12-27T14:51:09.618Z Last Updated: 2025-11-03T20:50:48.128Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free. Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/st
c(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ac3eaac4cf142a15fe67be747a682b1416efeb6e - https://git.kernel.org/stable/c/6021ccc2471b7b95e29b7cfc7938e042bf56e281 - https://git.kernel.org/stable/c/32df687e129ef0f9afcbcc914f7c32deb28fd481 - https://git.kernel.org/stable/c/3945c799f12b8d1f49a3b48369ca494d981ac465
CVE ID: CVE-2024-56605 State: PUBLISHED Published: 2024-12-27T14:51:10.344Z Last Updated: 2025-11-03T20:50:51.126Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f6ad641646b67f29c7578dcd
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f6ad641646b67f29c7578dcd6c25813c7dcbf51e - https://git.kernel.org/stable/c/daa13175a6dea312a76099066cb4cbd4fc959a84 - https://git.kernel.org/stable/c/a8677028dd5123e5e525b8195483994d87123de4 - https://git.kernel.org/stable/c/bb2f2342a6ddf7c04f9aefbbfe86104cd138e629 - https://git.kernel.org/stable/c/8ad09ddc63ace3950ac43db6fbfe25b40f589dd6 - https://git.kernel.org/stable/c/61686abc2f3c2c67822aa23ce6f160467ec83d35 - https://git.kernel.org/stable/c/7c4f78cdb8e7501e9f92d291a7d956591bf73be9
CVE ID: CVE-2024-56606 State: PUBLISHED Published: 2024-12-27T14:51:11.327Z Last Updated: 2025-11-03T20:50:53.934Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/71b22837a5e55ac2
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f - https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7 - https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21 - https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414 - https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0 - https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829 - https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b
CVE ID: CVE-2024-56607 State: PUBLISHED Published: 2024-12-27T14:51:12.143Z Last Updated: 2025-05-04T09:59:37.858Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() When I try to manually set bitrates: iw wlan0 set bitrates legacy-2.4 1 I get sleeping from invalid context error, see below. Fix that by switching to use recently introduced ieee80211_iterate_stations_mtx(). Do note that WCN6855 firmware is still crashing, I'm not sure if that firmware even supports bitrate WMI commands and should we consider disabling ath12k_mac_op_set_bitrate_mask() for WCN6855? But
e even supports bitrate WMI commands and should we consider disabling ath12k_mac_op_set_bitrate_mask() for WCN6855? But that's for another patch. BUG: sleeping function called from invalid context at drivers/net/wireless/ath/ath12k/wmi.c:420 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 2236, name: iw preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 3 locks held by iw/2236: #0: ffffffffabc6f1d8 (cb_lock){++++}-{3:3}, at: genl_rcv+0x14/0x40 #1: ffff888138410810 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0x54d/0x800 [cfg80211] #2: ffffffffab2cfaa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_stations_atomic+0x2f/0x200 [mac80211] CPU: 3 UID: 0 PID: 2236 Comm
a0 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_stations_atomic+0x2f/0x200 [mac80211] CPU: 3 UID: 0 PID: 2236 Comm: iw Not tainted 6.11.0-rc7-wt-ath+ #1772 Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 Call Trace: <TASK> dump_stack_lvl+0xa4/0xe0 dump_stack+0x10/0x20 __might_resched+0x363/0x5a0 ? __alloc_skb+0x165/0x340 __might_sleep+0xad/0x160 ath12k_wmi_cmd_send+0xb1/0x3d0 [ath12k] ? ath12k_wmi_init_wcn7850+0xa40/0xa40 [ath12k] ? __netdev_alloc_skb+0x45/0x7b0 ? __asan_memset+0x39/0x40 ? ath12k_wmi_alloc_skb+0xf0/0x150 [ath12k] ? reacquire_held_locks+0x4d0/0x4d0 ath12k_wmi_set_peer_param+0x340/0x5b0 [ath12k] ath12k_mac_disa
kb+0xf0/0x150 [ath12k] ? reacquire_held_locks+0x4d0/0x4d0 ath12k_wmi_set_peer_param+0x340/0x5b0 [ath12k] ath12k_mac_disable_peer_fixed_rate+0xa3/0x110 [ath12k] ? ath12k_mac_vdev_stop+0x4f0/0x4f0 [ath12k] ieee80211_iterate_stations_atomic+0xd4/0x200 [mac80211] ath12k_mac_op_set_bitrate_mask+0x5d2/0x1080 [ath12k] ? ath12k_mac_vif_chan+0x320/0x320 [ath12k] drv_set_bitrate_mask+0x267/0x470 [mac80211] ieee80211_set_bitrate_mask+0x4cc/0x8a0 [mac80211] ? __this_cpu_preempt_check+0x13/0x20 nl80211_set_tx_bitrate_mask+0x2bc/0x530 [cfg80211] ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211] ? trace_contention_end+0xef/0x140 ? rtnl_unlock+0x9/0x10 ? nl80211_pre_doit+0x557/0x800 [cfg80211] genl_f
320 [cfg80211] ? trace_contention_end+0xef/0x140 ? rtnl_unlock+0x9/0x10 ? nl80211_pre_doit+0x557/0x800 [cfg80211] genl_family_rcv_msg_doit+0x1f0/0x2e0 ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 ? ns_capable+0x57/0xd0 genl_family_rcv_msg+0x34c/0x600 ? genl_family_rcv_msg_dumpit+0x310/0x310 ? __lock_acquire+0xc62/0x1de0 ? he_set_mcs_mask.isra.0+0x8d0/0x8d0 [cfg80211] ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211] ? cfg80211_external_auth_request+0x690/0x690 [cfg80211] genl_rcv_msg+0xa0/0x130 netlink_rcv_skb+0x14c/0x400 ? genl_family_rcv_msg+0x600/0x600 ? netlink_ack+0xd70/0xd70 ? rwsem_optimistic_spin+0x4f0/0x4f0 ? genl_rcv+0x14/0x40 ? down_read_killable+0x580/0x580 ? netli
etlink_ack+0xd70/0xd70 ? rwsem_optimistic_spin+0x4f0/0x4f0 ? genl_rcv+0x14/0x40 ? down_read_killable+0x580/0x580 ? netlink_deliver_tap+0x13e/0x350 ? __this_cpu_preempt_check+0x13/0x20 genl_rcv+0x23/0x40 netlink_unicast+0x45e/0x790 ? netlink_attachskb+0x7f0/0x7f0 netlink_sendmsg+0x7eb/0xdb0 ? netlink_unicast+0x790/0x790 ? __this_cpu_preempt_check+0x13/0x20 ? selinux_socket_sendmsg+0x31/0x40 ? netlink_unicast+0x790/0x790 __sock_sendmsg+0xc9/0x160 ____sys_sendmsg+0x620/0x990 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x410/0x410 ? __kasan_check_read+0x11/0x20 ? mark_lock+0xe6/0x1470 ___sys_sendmsg+0xe9/0x170 ? copy_msghdr_from_user+0x120/0x120 ? __lock_acquire+0xc62/0x1de0 ? do_fault_around+0x2
0x1470 ___sys_sendmsg+0xe9/0x170 ? copy_msghdr_from_user+0x120/0x120 ? __lock_acquire+0xc62/0x1de0 ? do_fault_around+0x2c6/0x4e0 ? do_user_addr_fault+0x8c1/0xde0 ? reacquire_held_locks+0x220/0x4d0 ? do_user_addr_fault+0x8c1/0xde0 ? __kasan_check_read+0x11/0x20 ? __fdget+0x4e/0x1d0 ? sockfd_lookup_light+0x1a/0x170 __sys_sendmsg+0xd2/0x180 ? __sys_sendmsg_sock+0x20/0x20 ? reacquire_held_locks+0x4d0/0x4d0 ? debug_smp_processor_id+0x17/0x20 __x64_sys_sendmsg+0x72/0xb0 ? lockdep_hardirqs_on+0x7d/0x100 x64_sys_call+0x894/0x9f0 do_syscall_64+0x64/0x130 entry_SYSCALL_64_after_ ---truncated--- References: - https://git.kernel.org/stable/c/3ed6b2daa4e9029987885f86835ffbc003d11c01 - https://git.kernel.
runcated--- References: - https://git.kernel.org/stable/c/3ed6b2daa4e9029987885f86835ffbc003d11c01 - https://git.kernel.org/stable/c/2093f062b26805789b73f2af214691475d9baa29 - https://git.kernel.org/stable/c/8fac3266c68a8e647240b8ac8d0b82f1821edf85
CVE ID: CVE-2024-56608 State: PUBLISHED Published: 2024-12-27T14:51:13.210Z Last Updated: 2025-11-03T20:50:55.342Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the
re accessing it. This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior. References: [ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly