Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-36937 State: PUBLISHED Published: 2024-05-30T15:29:26.353Z Last Updated: 2025-05-04T09:12:26.458Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xdp: use flags field to disambiguate broadcast redirect When redirecting a packet using XDP, the bpf_redirect_map() helper will set up the redirect destination information in struct bpf_redirect_info (using the __bpf_xdp_redirect_map() helper function), and the xdp_do_redirect() function will read this information after the XDP program returns and pass the frame on to the right redirect destination. When using the BPF_F_BROADCAST flag to do multicast redirect to a whol
s the frame on to the right redirect destination. When using the BPF_F_BROADCAST flag to do multicast redirect to a whole map, __bpf_xdp_redirect_map() sets the 'map' pointer in struct bpf_redirect_info to point to the destination map to be broadcast. And xdp_do_redirect() reacts to the value of this map pointer to decide whether it's dealing with a broadcast or a single-value redirect. However, if the destination map is being destroyed before xdp_do_redirect() is called, the map pointer will be cleared out (by bpf_clear_redirect_map()) without waiting for any XDP programs to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer
to stop running. This causes xdp_do_redirect() to think that the redirect was to a single target, but the target pointer is also NULL (since broadcast redirects don't have a single target), so this causes a crash when a NULL pointer is passed to dev_map_enqueue(). To fix this, change xdp_do_redirect() to react directly to the presence of the BPF_F_BROADCAST flag in the 'flags' value in struct bpf_redirect_info to disambiguate between a single-target and a broadcast redirect. And only read the 'map' pointer if the broadcast flag is set, aborting if that has been cleared out in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, a
in the meantime. This prevents the crash, while keeping the atomic (cmpxchg-based) clearing of the map pointer itself, and without adding any more checks in the non-broadcast fast path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/12481f30128fbebc2eeb55eb2d56390fdfa30c5e - https://git.kernel.org/stable/c/272bfb019f3cc018f654b992115774e77b4f3ffc - https://git.kernel.org/stable/c/e22e25820fa04ea5eaac4ef7ee200e9923f466a4 - https://git.kernel.org/stable/c/6fd81f9d333e7b3532036577b1beb74ba1323553 - https://git.kernel.org/stable/c/5bcf0dcbf9066348058b88a510c57f70f384c92c
CVE ID: CVE-2024-36938 State: PUBLISHED Published: 2024-05-30T15:29:26.929Z Last Updated: 2025-05-04T09:12:27.522Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260
k_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390
by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [i
k_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockm
ogle Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);". To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE P
sk_psock_data_ready(), which is suggested by John Fastabend. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973 - https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d - https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27 - https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87 - https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80 - https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365
CVE ID: CVE-2024-36939 State: PUBLISHED Published: 2024-05-30T15:29:27.517Z Last Updated: 2025-05-04T09:12:28.626Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs: Handle error of rpc_proc_register() in nfs_net_init(). syzkaller reported a warning [0] triggered while destroying immature netns. rpc_proc_register() was called in init_nfs_fs(), but its error has been ignored since at least the initial commit 1da177e4c3f4 ("Linux-2.6.12-rc2"). Recently, commit d47151b79e32 ("nfs: expose /proc/net/sunrpc/nfs in net namespaces") converted the procfs to per-netns and made the problem more visible. Even when rpc_proc_register() fail
net namespaces") converted the procfs to per-netns and made the problem more visible. Even when rpc_proc_register() fails, nfs_net_init() could succeed, and thus nfs_net_exit() will be called while destroying the netns. Then, remove_proc_entry() will be called for non-existing proc directory and trigger the warning below. Let's handle the error of rpc_proc_register() properly in nfs_net_init(). [0]: name 'nfs' WARNING: CPU: 1 PID: 1710 at fs/proc/generic.c:711 remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Modules linked in: CPU: 1 PID: 1710 Comm: syz-executor.2 Not tainted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce7
inted 6.8.0-12822-gcd51db110a7e #12 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:remove_proc_entry+0x1bb/0x2d0 fs/proc/generic.c:711 Code: 41 5d 41 5e c3 e8 85 09 b5 ff 48 c7 c7 88 58 64 86 e8 09 0e 71 02 e8 74 09 b5 ff 4c 89 e6 48 c7 c7 de 1b 80 84 e8 c5 ad 97 ff <0f> 0b eb b1 e8 5c 09 b5 ff 48 c7 c7 88 58 64 86 e8 e0 0d 71 02 eb RSP: 0018:ffffc9000c6d7ce0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8880422b8b00 RCX: ffffffff8110503c RDX: ffff888030652f00 RSI: ffffffff81105045 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb
000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff81bb62cb R12: ffffffff84807ffc R13: ffff88804ad6fcc0 R14: ffffffff84807ffc R15: ffffffff85741ff8 FS: 00007f30cfba8640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff51afe8000 CR3: 000000005a60a005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> rpc_proc_unregister+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_na
ster+0x64/0x70 net/sunrpc/stats.c:310 nfs_net_exit+0x1c/0x30 fs/nfs/inode.c:2438 ops_exit_list+0x62/0xb0 net/core/net_namespace.c:170 setup_net+0x46c/0x660 net/core/net_namespace.c:372 copy_net_ns+0x244/0x590 net/core/net_namespace.c:505 create_new_namespaces+0x2ed/0x770 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xae/0x160 kernel/nsproxy.c:228 ksys_unshare+0x342/0x760 kernel/fork.c:3322 __do_sys_unshare kernel/fork.c:3393 [inline] __se_sys_unshare kernel/fork.c:3391 [inline] __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3391 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5
ne] do_syscall_64+0x4f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0x7f30d0febe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f30cfba7cc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f30d0febe5d RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006c020600 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530
0000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000000000000000b R14: 00007f30d104c530 R15: 0000000000000000 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b33ca18c3a1190208dfd569c4fa8a2f93084709f - https://git.kernel.org/stable/c/d4891d817350c67392d4731536945f3809a2a0ba - https://git.kernel.org/stable/c/ea6ce93327bd2c8a0c6cf6f2f0e800f3b778f021 - https://git.kernel.org/stable/c/8ae63bd858691bee0e2a92571f2fbb36a4d86d65 - https://git.kernel.org/stable/c/8a1f89c98dcc542dd6d287e573523714702e0f9c - https://git.kernel.org/stable/c/9909dde2e53a19585212c32fe3eda482b5faaaa3 - https://g
98dcc542dd6d287e573523714702e0f9c - https://git.kernel.org/stable/c/9909dde2e53a19585212c32fe3eda482b5faaaa3 - https://git.kernel.org/stable/c/24457f1be29f1e7042e50a7749f5c2dde8c433c8
CVE ID: CVE-2024-36940 State: PUBLISHED Published: 2024-05-30T15:29:28.101Z Last Updated: 2025-05-04T09:12:30.088Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stabl
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d - https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd - https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068 - https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca - https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e - https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c - https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba - https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79
CVE ID: CVE-2024-36941 State: PUBLISHED Published: 2024-05-30T15:29:28.687Z Last Updated: 2025-05-20T14:17:10.233Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/327382dc0f16b268950b96e0052595efd80f7b0a - https://git.kernel.org/stable/c/97792d0611ae2e6fe3ccefb0a94a1d802317c457 - https://git.kernel.org/stable/c/5a730a161ac2290d46d49be76b2b1aee8d2eb307 - https://git.kernel.org/stable/c/ad12c74e953b68ad8
s://git.kernel.org/stable/c/5a730a161ac2290d46d49be76b2b1aee8d2eb307 - https://git.kernel.org/stable/c/ad12c74e953b68ad85c78adc6408ed8435c64af4 - https://git.kernel.org/stable/c/b0db4caa10f2e4e811cf88744fbf0d074b67ec1f - https://git.kernel.org/stable/c/244822c09b4f9aedfb5977f03c0deeb39da8ec7d - https://git.kernel.org/stable/c/f92772a642485394db5c9a17bd0ee73fc6902383 - https://git.kernel.org/stable/c/801ea33ae82d6a9d954074fbcf8ea9d18f1543a7
CVE ID: CVE-2024-36942 State: REJECTED Published: 2024-05-30T15:35:41.532Z Last Updated: 2025-02-27T19:38:30.309Z Description: No description available.
CVE ID: CVE-2024-36943 State: PUBLISHED Published: 2024-05-30T15:35:42.119Z Last Updated: 2025-05-04T09:12:32.403Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: fix loss of young/dirty bits during pagemap scan make_uffd_wp_pte() was previously doing: pte = ptep_get(ptep); ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte); But if another thread accessed or dirtied the pte between the first 2 calls, this could lead to loss of that information. Since ptep_modify_prot_start() gets and clears atomically, the following is the correct pattern and prevents any possible race. A
p_modify_prot_start() gets and clears atomically, the following is the correct pattern and prevents any possible race. Any access after the first call would see an invalid pte and cause a fault: pte = ptep_modify_prot_start(ptep); pte = pte_mkuffd_wp(pte); ptep_modify_prot_commit(ptep, pte); Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/74b3d66f91d9f539f99faad74d796fa9a389a015 - https://git.kernel.org/stable/c/c70dce4982ce1718bf978a35f8e26160b82081f4
CVE ID: CVE-2024-36944 State: PUBLISHED Published: 2024-05-30T15:35:42.708Z Last Updated: 2025-05-04T09:12:33.769Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot up. Unfortunately, the most I ever got out was: [ 93.607888] Testing event system initcall: OK [ 93.667730] Running tests on all trace events: [ 93.669757] Testing all events: OK [ 95.631064] ------------[ cut here ]------------ Timed out after 60 seconds" and further debugging poi
g all events: OK [ 95.631064] ------------[ cut here ]------------ Timed out after 60 seconds" and further debugging points to a possible circular locking dependency between the console_owner locking and the worker pool locking. Reverting the commit allows Steve's VM to boot to completion again. [ This may obviously result in the "[TTM] Buffer eviction failed" messages again, which was the reason for that original revert. But at this point this seems preferable to a non-booting system... ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4a89ac4b0921c4ea21eb1b4cf3a469a91bacfcea - https://git.kernel.org/stable/c/b548c53b
s: - https://git.kernel.org/stable/c/4a89ac4b0921c4ea21eb1b4cf3a469a91bacfcea - https://git.kernel.org/stable/c/b548c53bc3ab83dc6fc86c8e840f013b2032267a - https://git.kernel.org/stable/c/148ed8b4d64f94ab079c8f0d88c3f444db97ba97 - https://git.kernel.org/stable/c/3dfe35d8683daf9ba69278643efbabe40000bbf6 - https://git.kernel.org/stable/c/3628e0383dd349f02f882e612ab6184e4bb3dc10
CVE ID: CVE-2024-36945 State: PUBLISHED Published: 2024-05-30T15:35:43.299Z Last Updated: 2025-05-04T09:12:34.866Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: fix neighbour and rtable leak in smc_ib_find_route() In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable resolved by ip_route_output_flow() are not released or put before return. It may cause the refcount leak, so fix it. Additional Analyst Notes: - ADP Container: - CVE Program Container: References: - https://git.kernel.org/stable/c/d5a466ab6e78d6f2e0f64435f1e17246c8e941ff - https://git.kernel.org/stable/c/5df93c029a907b0ff5a4eeadd77ba06f
org/stable/c/d5a466ab6e78d6f2e0f64435f1e17246c8e941ff - https://git.kernel.org/stable/c/5df93c029a907b0ff5a4eeadd77ba06ff0a277d2 - https://git.kernel.org/stable/c/da91e447d06dc649fcf46e59122e7bf8f0b2e0db - https://git.kernel.org/stable/c/2ddc0dd7fec86ee53b8928a5cca5fbddd4fc7c06
CVE ID: CVE-2024-36946 State: PUBLISHED Published: 2024-05-30T15:35:43.884Z Last Updated: 2025-05-04T09:12:36.121Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ec1f71c05caeba0f814df77e0f511d8b4618623a - https://git.kernel.org/stable/c/dc6beac059f0331de9
://git.kernel.org/stable/c/ec1f71c05caeba0f814df77e0f511d8b4618623a - https://git.kernel.org/stable/c/dc6beac059f0331de97155a89d84058d4a9e49c7 - https://git.kernel.org/stable/c/f085e02f0a32f6dfcfabc6535c9c4a1707cef86b - https://git.kernel.org/stable/c/4ff334cade9dae50e4be387f71e94fae634aa9b4 - https://git.kernel.org/stable/c/728a83160f98ee6b60df0d890141b9b7240182fe - https://git.kernel.org/stable/c/ee9e39a6cb3ca2a3d35b4ae25547ee3526a44d00 - https://git.kernel.org/stable/c/9a77226440008cf04ba68faf641a2d50f4998137 - https://git.kernel.org/stable/c/d8cac8568618dcb8a51af3db1103e8d4cc4aeea7
CVE ID: CVE-2024-36947 State: PUBLISHED Published: 2024-05-30T15:35:44.482Z Last Updated: 2025-05-04T09:12:37.148Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput(). Fucked-up-by: Al Viro <viro@zeniv.linux.org.uk> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org
org.uk> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/24dd9b08df718f20ccf2dd1519909fefd8c233ee - https://git.kernel.org/stable/c/bd8f78c71defbcb7a9ed331e7f287507df972b00 - https://git.kernel.org/stable/c/db71ca93259dd1078bcfea3afafde2143cfc2da7 - https://git.kernel.org/stable/c/02ee394a5d899d9bd2f0759382e9481cab6166f8 - https://git.kernel.org/stable/c/aa23317d0268b309bb3f0801ddd0d61813ff5afb
CVE ID: CVE-2024-36948 State: PUBLISHED Published: 2024-05-30T15:35:45.082Z Last Updated: 2025-05-04T09:12:38.198Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/xe_migrate: Cast to output precision before multiplying operands Addressing potential overflow in result of multiplication of two lower precision (u32) operands before widening it to higher precision (u64). -v2 Fix commit message and description. (Rodrigo) (cherry picked from commit 34820967ae7b45411f8f4f737c2d63b0c608e0d7) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e23a904dfeb5a9e3d4
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e23a904dfeb5a9e3d4ec527a365e962478cccf05 - https://git.kernel.org/stable/c/9cb46b31f3d08ed3fce86349e8c12f96d7c88717
CVE ID: CVE-2024-36949 State: PUBLISHED Published: 2024-05-30T15:35:45.679Z Last Updated: 2025-09-16T08:02:36.406Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one device doing reset in parallel, the first device will call kfd_suspend_all_processes() to evict all processes on all devices, this call takes time to finish. other device will start reset and recover without waiting. if the process has not been evicted before doing recover, it will be restored, then caused page fault. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Prog
oing recover, it will be restored, then caused page fault. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b6f6626528fe724b512c34f3fb5946c36a135f58 - https://git.kernel.org/stable/c/ed28ef3840bbf93a64376ea7814ce39f86352e14 - https://git.kernel.org/stable/c/d06af584be5a769d124b7302b32a033e9559761d
CVE ID: CVE-2024-36950 State: PUBLISHED Published: 2024-05-30T15:35:46.262Z Last Updated: 2025-05-20T14:13:44.582Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff