Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L2TCM boundary, resulting (at best) in a kernel panic. To fix that, check that the IPI buffer fits, otherwise return a failure and refuse to boot the relevant SCP core (or the SCP at all, if this is single core). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/00548ac6b14428719c970ef90adae2b3b48c0cdf - https://git.kernel.org/stable/c/1d9e2de24533daca36cbf09e8d8596bf72b526b2 - https://git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e - https://git.kernel.org/stable/c/838b49e211d59fa827ff9
git.kernel.org/stable/c/26c6d7dc8c6a9fde9d362ab2eef6390efeff145e - https://git.kernel.org/stable/c/838b49e211d59fa827ff9df062d4020917cffbdf - https://git.kernel.org/stable/c/36c79eb4845551e9f6d28c663b38ce0ab03b84a9 - https://git.kernel.org/stable/c/331f91d86f71d0bb89a44217cc0b2a22810bbd42
CVE ID: CVE-2024-36966 State: PUBLISHED Published: 2024-06-08T12:52:59.148Z Last Updated: 2025-05-04T09:12:59.588Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: reliably distinguish block based and fscache mode When erofs_kill_sb() is called in block dev based mode, s_bdev may not have been initialised yet, and if CONFIG_EROFS_FS_ONDEMAND is enabled, it will be mistaken for fscache mode, and then attempt to free an anon_dev that has never been allocated, triggering the following warning: ============================================ ida_free called for id=0 which is not allocated. WARNING: CPU: 14 PID: 926 at lib/idr.c:5
============================== ida_free called for id=0 which is not allocated. WARNING: CPU: 14 PID: 926 at lib/idr.c:525 ida_free+0x134/0x140 Modules linked in: CPU: 14 PID: 926 Comm: mount Not tainted 6.9.0-rc3-dirty #630 RIP: 0010:ida_free+0x134/0x140 Call Trace: <TASK> erofs_kill_sb+0x81/0x90 deactivate_locked_super+0x35/0x80 get_tree_bdev+0x136/0x1e0 vfs_get_tree+0x2c/0xf0 do_new_mount+0x190/0x2f0 [...] ============================================ Now when erofs_kill_sb() is called, erofs_sb_info must have been initialised, so use sbi->fsid to distinguish between the two modes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.
two modes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f9b877a7ee312ec8ce17598a7ef85cb820d7c371 - https://git.kernel.org/stable/c/dcdd49701e429c55b3644fd70fc58d85745f8cfe - https://git.kernel.org/stable/c/7af2ae1b1531feab5d38ec9c8f472dc6cceb4606
CVE ID: CVE-2024-36967 State: PUBLISHED Published: 2024-06-08T12:52:59.895Z Last Updated: 2025-05-04T09:13:00.837Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix memory leak in tpm2_key_encode() 'scratch' is never freed. Fix this by calling kfree() in the success, and in the error case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1e6914fa8e7798bcf3ce4a5b96ea4ac1d5571cdf - https://git.kernel.org/stable/c/5d91238b590bd883c86ba7707c5c9096469c08b7 - https://git.kernel.org/stable/c/e62835264d0352be6086975f18fdfed2b5520b13 - https://git.k
bd883c86ba7707c5c9096469c08b7 - https://git.kernel.org/stable/c/e62835264d0352be6086975f18fdfed2b5520b13 - https://git.kernel.org/stable/c/189c768932d435045b1fae12bf63e53866f06a28 - https://git.kernel.org/stable/c/cf26a92f560eed5d6ddc3d441cc645950cbabc56 - https://git.kernel.org/stable/c/ffcaa2172cc1a85ddb8b783de96d38ca8855e248
CVE ID: CVE-2024-36968 State: PUBLISHED Published: 2024-06-08T12:53:00.562Z Last Updated: 2025-05-04T09:13:03.181Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range. Move MTU from hci_dev to hci_conn to validate MTU and stop the connection process earlier if MTU is invalid. Also, add a missing validation in read_buffer_size() and make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the b
make it return an error value if the validation fails. Now hci_conn_add() returns ERR_PTR() as it can fail due to the both a kzalloc failure and invalid MTU value. divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 67 Comm: kworker/u5:0 Tainted: G W 6.9.0-rc5+ #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_le_flowctl_init+0x19e/0x3f0 net/bluetooth/l2cap_core.c:547 Code: e8 17 17 0c 00 66 41 89 9f 84 00 00 00 bf 01 00 00 00 41 b8 02 00 00 00 4c 89 fe 4c 89 e2 89 d9 e8 27 17 0c 00 44 89 f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 0001024
f0 31 d2 <66> f7 f3 89 c3 ff c3 4d 8d b7 88 00 00 00 4c 89 f0 48 c1 e8 03 42 RSP: 0018:ffff88810bc0f858 EFLAGS: 00010246 RAX: 00000000000002a0 RBX: 0000000000000000 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: ffff88810bc0f7c0 RDI: ffffc90002dcb66f RBP: ffff88810bc0f880 R08: aa69db2dda70ff01 R09: 0000ffaaaaaaaaaa R10: 0084000000ffaaaa R11: 0000000000000000 R12: ffff88810d65a084 R13: dffffc0000000000 R14: 00000000000002a0 R15: ffff88810d65a000 FS: 0000000000000000(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req ne
: 0000000020000100 CR3: 0000000103268003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> l2cap_le_connect_req net/bluetooth/l2cap_core.c:4902 [inline] l2cap_le_sig_cmd net/bluetooth/l2cap_core.c:5420 [inline] l2cap_le_sig_channel net/bluetooth/l2cap_core.c:5486 [inline] l2cap_recv_frame+0xe59d/0x11710 net/bluetooth/l2cap_core.c:6809 l2cap_recv_acldata+0x544/0x10a0 net/bluetooth/l2cap_core.c:7506 hci_acldata_packet net/bluetooth/hci_core.c:3939 [inline] hci_rx_work+0x5e5/0xb20 net/bluetooth/hci_core.c:4176 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380
eduled_works+0x90f/0x1530 kernel/workqueue.c:3335 worker_thread+0x926/0xe70 kernel/workqueue.c:3416 kthread+0x2e3/0x380 kernel/kthread.c:388 ret_from_fork+0x5c/0x90 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ad3f7986c5a0f82b8b66a0afe1cc1f5421e1d674 - https://git.kernel.org/stable/c/dfece2b4e3759759b2bdfac2cd6d0ee9fbf055f3 - https://git.kernel.org/stable/c/d2b2f7d3936dc5990549bc36ab7ac7ac37f22c30 - https://git.kernel.org/stable/c/4d3dbaa252257d20611c3647290e6171f1bb
stable/c/d2b2f7d3936dc5990549bc36ab7ac7ac37f22c30 - https://git.kernel.org/stable/c/4d3dbaa252257d20611c3647290e6171f1bbd6c8 - https://git.kernel.org/stable/c/a5b862c6a221459d54e494e88965b48dcfa6cc44
CVE ID: CVE-2024-36969 State: PUBLISHED Published: 2024-06-08T12:53:01.353Z Last Updated: 2025-07-11T17:19:47.597Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix division by zero in setup_dsc_config When slice_height is 0, the division by slice_height in the calculation of the number of slices will cause a division by zero driver crash. This leaves the kernel in a state that requires a reboot. This patch adds a check to avoid the division by zero. The stack trace below is for the 6.8.4 Kernel. I reproduced the issue on a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor connected via Thunderbolt
nel. I reproduced the issue on a Z16 Gen 2 Lenovo Thinkpad with a Apple Studio Display monitor connected via Thunderbolt. The amdgpu driver crashed with this exception when I rebooted the system with the monitor connected. kernel: ? die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434 arch/x86/kernel/dumpstack.c:447) kernel: ? do_trap (arch/x86/kernel/traps.c:113 arch/x86/kernel/traps.c:154) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? do_error_trap (./arch/x86/include/asm/traps.h:58 arch/x86/kernel/traps.c:175) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? e
/traps.c:175) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? exc_divide_error (arch/x86/kernel/traps.c:194 (discriminator 2)) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: ? asm_exc_divide_error (./arch/x86/include/asm/idtentry.h:548) kernel: ? setup_dsc_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1053) amdgpu kernel: dc_dsc_compute_config (drivers/gpu/drm/amd/amdgpu/../display/dc/dsc/dc_dsc.c:1109) amdgpu After applying this patch, the driver no longer crashes when the monitor is connected and the system is rebooted. I believe this is the same issue reported f
no longer crashes when the monitor is connected and the system is rebooted. I believe this is the same issue reported for 3113. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a32c8f951c8a456c1c251e1dcdf21787f8066445 - https://git.kernel.org/stable/c/91402e0e5de9124a3108db7a14163fcf9a6d322f - https://git.kernel.org/stable/c/7e4f50dfc98c49b3dc6875a35c3112522fb25639 - https://git.kernel.org/stable/c/f187fcbbb8f8bf10c6687f0beae22509369f7563 - https://git.kernel.org/stable/c/308de6be0c9c7ba36915c0d398e771725c0ea911 - https://git.kernel.org/stable/c/130afc8a886183a94cf6eab7d24f300014ff87ba
CVE ID: CVE-2024-36970 State: PUBLISHED Published: 2024-06-08T13:01:03.077Z Last Updated: 2025-05-04T09:13:05.497Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Use request_module_nowait This appears to work around a deadlock regression that came in with the LED merge in 6.9. The deadlock happens on my system with 24 iwlwifi radios, so maybe it something like all worker threads are busy and some work that needs to complete cannot complete. [also remove unnecessary "load_module" var and now-wrong comment] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.
g comment] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d20013259539e2fde2deeac85354851097afdf9e - https://git.kernel.org/stable/c/3d913719df14c28c4d3819e7e6d150760222bda4
CVE ID: CVE-2024-36971 State: PUBLISHED Published: 2024-06-10T09:03:23.878Z Last Updated: 2025-11-04T17:21:17.010Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negati
wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13 - https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 - https://g
e9f0450a2ec3d62a86d2a0d2fad117f13 - https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72 - https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6 - https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf - https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4 - https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508 - https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc - https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
CVE ID: CVE-2024-36972 State: PUBLISHED Published: 2024-06-10T14:57:42.271Z Last Updated: 2025-05-04T12:56:38.466Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set NULL to it locklessly. However, the peer socket still can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading NULL pointer dereferenc
l can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading NULL pointer dereference. [0] To fix the issue, let's update unix_sk(sk)->oob_skb under the sk_receive_queue's lock and take it everywhere we touch oob_skb. Note that we defer kfree_skb() in manage_oob() to silence lockdep false-positive (See [1]). [0]: BUG: kernel NULL pointer dereference, address: 0000000000000008 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110 Hardware name: QEMU Standard
MPT SMP PTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc5-00191-gd091e579b864 #110 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Workqueue: events delayed_fput RIP: 0010:skb_dequeue (./include/linux/skbuff.h:2386 ./include/linux/skbuff.h:2402 net/core/skbuff.c:3847) Code: 39 e3 74 3e 8b 43 10 48 89 ef 83 e8 01 89 43 10 49 8b 44 24 08 49 c7 44 24 08 00 00 00 00 49 8b 14 24 49 c7 04 24 00 00 00 00 <48> 89 42 08 48 89 10 e8 e7 c5 42 00 4c 89 e0 5b 5d 41 5c c3 cc cc RSP: 0018:ffffc900001bfd48 EFLAGS: 00000002 RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206
00000002 RAX: 0000000000000000 RBX: ffff8880088f5ae8 RCX: 00000000361289f9 RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff8880088f5b00 RBP: ffff8880088f5b00 R08: 0000000000080000 R09: 0000000000000001 R10: 0000000000000003 R11: 0000000000000001 R12: ffff8880056b6a00 R13: ffff8880088f5280 R14: 0000000000000001 R15: ffff8880088f5a80 FS: 0000000000000000(0000) GS:ffff88807dd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 0000000006314000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <TASK> unix_release_sock (net/unix/af_unix.c:654) unix_release (net/unix/af_unix.c:1050) __sock_release (net/socket.c:660) sock_close (net/soc
ck (net/unix/af_unix.c:654) unix_release (net/unix/af_unix.c:1050) __sock_release (net/socket.c:660) sock_close (net/socket.c:1423) __fput (fs/file_table.c:423) delayed_fput (fs/file_table.c:444 (discriminator 3)) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:257) </TASK> Modules linked in: CR2: 0000000000000008 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 - https://git.kernel.org/stable/c/4bf696
ces: - https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 - https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1 - https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636 - https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3 - https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2
CVE ID: CVE-2024-36973 State: PUBLISHED Published: 2024-06-17T17:51:52.112Z Last Updated: 2025-11-03T21:55:29.203Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: fix double free in the error handling of gp_aux_bus_probe() When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function gp_auxiliary_device_release() calls ida_free() and kfree(aux_device_wrapper) to free memory. We should't call them again in the error handling path. Fix this by skipping the redundant cleanup functions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refer
pping the redundant cleanup functions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/34ae447b138680b5ed3660f7d935ff3faf88ba1a - https://git.kernel.org/stable/c/86c9713602f786f441630c4ee02891987f8618b9 - https://git.kernel.org/stable/c/1efe551982297924d05a367aa2b6ec3d275d5742 - https://git.kernel.org/stable/c/086c6cbcc563c81d55257f9b27e14faf1d0963d3
CVE ID: CVE-2024-36974 State: PUBLISHED Published: 2024-06-18T19:15:07.892Z Last Updated: 2025-05-04T09:13:10.176Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP If one TCA_TAPRIO_ATTR_PRIOMAP attribute has been provided, taprio_parse_mqprio_opt() must validate it, or userspace can inject arbitrary data to the kernel, the second time taprio_change() is called. First call (with valid attributes) sets dev->num_tc to a non zero value. Second call (with arbitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen. Additional Analyst No
bitrary mqprio attributes) returns early from taprio_parse_mqprio_opt() and bad things can happen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c6041e7124464ce7e896ee3f912897ce88a0c4ec - https://git.kernel.org/stable/c/6db4af09987cc5d5f0136bd46148b0e0460dae5b - https://git.kernel.org/stable/c/d3dde4c217f0c31ab0621912e682b57e677dd923 - https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c - https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404 - https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 - https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce
el.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2 - https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36
CVE ID: CVE-2024-36975 State: PUBLISHED Published: 2024-06-18T19:20:24.553Z Last Updated: 2025-05-04T09:13:11.226Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1_encode_sequence() fails, WARN is not the correct solution. 1. asn1_encode_sequence() is not an internal function (located in lib/asn1_encode.c). 2. Location is known, which makes the stack trace useless. 3. Results a crash if panic_on_warn is set. It is also noteworthy that the use of WARN is undocumented, and it should be avoided unless there is a carefully considered rationale to use it. Replace WARN with pr_
undocumented, and it should be avoided unless there is a carefully considered rationale to use it. Replace WARN with pr_err, and print the return value instead, which is only useful piece of information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/96f650995c70237b061b497c66755e32908f8972 - https://git.kernel.org/stable/c/681935009fec3fc22af97ee312d4a24ccf3cf087 - https://git.kernel.org/stable/c/1c652e1e10676f942149052d9329b8bf2703529a - https://git.kernel.org/stable/c/d32c6e09f7c4bec3ebc4941323f0aa6366bc1487 - https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea - https://git.kernel.org/stable/c
a6366bc1487 - https://git.kernel.org/stable/c/ff91cc12faf798f573dab2abc976c1d5b1862fea - https://git.kernel.org/stable/c/050bf3c793a07f96bd1e2fd62e1447f731ed733b
CVE ID: CVE-2024-36976 State: PUBLISHED Published: 2024-06-18T19:23:52.226Z Last Updated: 2025-05-04T09:13:12.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "media: v4l2-ctrls: show all owned controls in log_status" This reverts commit 9801b5b28c6929139d6fceeee8d739cc67bb2739. This patch introduced a potential deadlock scenario: [Wed May 8 10:02:06 2024] Possible unsafe locking scenario: [Wed May 8 10:02:06 2024] CPU0 CPU1 [Wed May 8 10:02:06 2024] ---- ---- [Wed May 8 10:02:06 2024] lock(vivid_ctrls:1620:(hdl_vid_cap)->_lock); [Wed May 8 10:02:06 2024] lock(vivid_ctrls:1608:(hdl_user_vid)->_lock); [Wed May 8 10:02:
ls:1620:(hdl_vid_cap)->_lock); [Wed May 8 10:02:06 2024] lock(vivid_ctrls:1608:(hdl_user_vid)->_lock); [Wed May 8 10:02:06 2024] lock(vivid_ctrls:1620:(hdl_vid_cap)->_lock); [Wed May 8 10:02:06 2024] lock(vivid_ctrls:1608:(hdl_user_vid)->_lock); For now just revert. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2e0ce54a9c5c7013b1257be044d99cbe7305e9f1 - https://git.kernel.org/stable/c/eba63df7eb1f95df6bfb67722a35372b6994928d
CVE ID: CVE-2024-36977 State: PUBLISHED Published: 2024-06-18T19:27:58.319Z Last Updated: 2025-05-04T09:13:13.471Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Wait unconditionally after issuing EndXfer command Currently all controller IP/revisions except DWC3_usb3 >= 310a wait 1ms unconditionally for ENDXFER completion when IOC is not set. This is because DWC_usb3 controller revisions >= 3.10a supports GUCTL2[14: Rst_actbitlater] bit which allows polling CMDACT bit to know whether ENDXFER command is completed. Consider a case where an IN request was queued, and parallelly soft_disconnect was called (due to ffs_epf
is completed. Consider a case where an IN request was queued, and parallelly soft_disconnect was called (due to ffs_epfile_release). This eventually calls stop_active_transfer with IOC cleared, hence send_gadget_ep_cmd() skips waiting for CMDACT cleared during EndXfer. For DWC3 controllers with revisions >= 310a, we don't forcefully wait for 1ms either, and we proceed by unmapping the requests. If ENDXFER didn't complete by this time, it leads to SMMU faults since the controller would still be accessing those requests. Fix this by ensuring ENDXFER completion by adding 1ms delay in __dwc3_stop_active_transfer() unconditionally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
delay in __dwc3_stop_active_transfer() unconditionally. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/341eb08dbca9eae05308c442fbfab1813a44c97a - https://git.kernel.org/stable/c/ec96bcf5f96a7a5c556b0e881ac3e5c3924d542c - https://git.kernel.org/stable/c/4a387e032909c6dc2b479452c5bbe9a252057925 - https://git.kernel.org/stable/c/1ba145f05b5c8f0b1a947a0633b5edff5dd1f1c5 - https://git.kernel.org/stable/c/1d26ba0944d398f88aaf997bda3544646cf21945