Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
slab-out-of-bounds in nxp_fspi_exec_op+0x26ec/0x2838 [ 36.940514] Read of size 4 at addr ffff00081037c2a0 by task dd/455 [ 36.946721] [ 36.948235] CPU: 3 UID: 0 PID: 455 Comm: dd Not tainted 6.11.0-rc5-gc7b0e37c8434 #1070 [ 36.956185] Hardware name: Freescale i.MX8QM MEK (DT) [ 36.961260] Call trace: [ 36.963723] dump_backtrace+0x90/0xe8 [ 36.967414] show_stack+0x18/0x24 [ 36.970749] dump_stack_lvl+0x78/0x90 [ 36.974451] print_report+0x114/0x5cc [ 36.978151] kasan_report+0xa4/0xf0 [ 36.981670] __asan_report_load_n_noabort+0x1c/0x28 [ 36.986587] nxp_fspi_exec_op+0x26ec/0x2838 [ 36.990800] spi_mem_exec_op+0x8ec/0xd30 [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0 [ 36.999323] spi_mem_dirmap_
38 [ 36.990800] spi_mem_exec_op+0x8ec/0xd30 [ 36.994762] spi_mem_no_dirmap_read+0x190/0x1e0 [ 36.999323] spi_mem_dirmap_write+0x238/0x32c [ 37.003710] spi_nor_write_data+0x220/0x374 [ 37.007932] spi_nor_write+0x110/0x2e8 [ 37.011711] mtd_write_oob_std+0x154/0x1f0 [ 37.015838] mtd_write_oob+0x104/0x1d0 [ 37.019617] mtd_write+0xb8/0x12c [ 37.022953] mtdchar_write+0x224/0x47c [ 37.026732] vfs_write+0x1e4/0x8c8 [ 37.030163] ksys_write+0xec/0x1d0 [ 37.033586] __arm64_sys_write+0x6c/0x9c [ 37.037539] invoke_syscall+0x6c/0x258 [ 37.041327] el0_svc_common.constprop.0+0x160/0x22c [ 37.046244] do_el0_svc+0x44/0x5c [ 37.049589] el0_svc+0x38/0x78 [ 37.052681] el0t_64_sync_handler+0x13c/0x158 [ 37.057077
37.046244] do_el0_svc+0x44/0x5c [ 37.049589] el0_svc+0x38/0x78 [ 37.052681] el0t_64_sync_handler+0x13c/0x158 [ 37.057077] el0t_64_sync+0x190/0x194 [ 37.060775] [ 37.062274] Allocated by task 455: [ 37.065701] kasan_save_stack+0x2c/0x54 [ 37.069570] kasan_save_track+0x20/0x3c [ 37.073438] kasan_save_alloc_info+0x40/0x54 [ 37.077736] __kasan_kmalloc+0xa0/0xb8 [ 37.081515] __kmalloc_noprof+0x158/0x2f8 [ 37.085563] mtd_kmalloc_up_to+0x120/0x154 [ 37.089690] mtdchar_write+0x130/0x47c [ 37.093469] vfs_write+0x1e4/0x8c8 [ 37.096901] ksys_write+0xec/0x1d0 [ 37.100332] __arm64_sys_write+0x6c/0x9c [ 37.104287] invoke_syscall+0x6c/0x258 [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c [ 37.112972] d
rite+0x6c/0x9c [ 37.104287] invoke_syscall+0x6c/0x258 [ 37.108064] el0_svc_common.constprop.0+0x160/0x22c [ 37.112972] do_el0_svc+0x44/0x5c [ 37.116319] el0_svc+0x38/0x78 [ 37.119401] el0t_64_sync_handler+0x13c/0x158 [ 37.123788] el0t_64_sync+0x190/0x194 [ 37.127474] [ 37.128977] The buggy address belongs to the object at ffff00081037c2a0 [ 37.128977] which belongs to the cache kmalloc-8 of size 8 [ 37.141177] The buggy address is located 0 bytes inside of [ 37.141177] allocated 3-byte region [ffff00081037c2a0, ffff00081037c2a3) [ 37.153465] [ 37.154971] The buggy address belongs to the physical page: [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c [
elongs to the physical page: [ 37.160559] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89037c [ 37.168596] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 37.175149] page_type: 0xfdffffff(slab) [ 37.179021] raw: 0bfffe0000000000 ffff000800002500 dead000000000122 0000000000000000 [ 37.186788] raw: 0000000000000000 0000000080800080 00000001fdffffff 0000000000000000 [ 37.194553] page dumped because: kasan: bad access detected [ 37.200144] [ 37.201647] Memory state around the buggy address: [ 37.206460] ffff00081037c180: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc [ 37.220946]
fc fa fc fc fc fa fc fc fc [ 37.213701] ffff00081037c200: fa fc fc fc 05 fc fc fc 03 fc fc fc 02 fc fc fc [ 37.220946] >ffff00081037c280: 06 fc fc fc 03 fc fc fc fc fc fc fc fc fc fc fc [ 37.228186] ^ [ 37.232473] ffff00081037c300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.239718] ffff00081037c380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 37.246962] ============================================================== ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/aa05db44db5f409f6d91c27b5737efb49fb45d9f - https://git.kernel.org/stable/c/609260542cf86b459c57618b8cdec8020394b7ad - https://
44db5f409f6d91c27b5737efb49fb45d9f - https://git.kernel.org/stable/c/609260542cf86b459c57618b8cdec8020394b7ad - https://git.kernel.org/stable/c/491f9646f7ac31af5fca71be1a3e5eb8aa7663ad - https://git.kernel.org/stable/c/09af8b0ba70072be831f3ec459f4063d570f9e24 - https://git.kernel.org/stable/c/af9ca9ca3e44f48b2a191e100d452fbf850c3d87 - https://git.kernel.org/stable/c/d1a1dfcec77c57b1181da93d11a3db1bc4eefa97 - https://git.kernel.org/stable/c/2a8787c1cdc7be24fdd8953ecd1a8743a1006235
CVE ID: CVE-2024-46854 State: PUBLISHED Published: 2024-09-27T12:42:46.655Z Last Updated: 2025-11-03T22:19:40.314Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: dpaa: Pad packets to ETH_ZLEN When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running $ ping -s 11 destination Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cd5b9d657ecd44ad5f254c3fea3a6ab1cf0e2ef7 - https://git.ker
gram Container: References: - https://git.kernel.org/stable/c/cd5b9d657ecd44ad5f254c3fea3a6ab1cf0e2ef7 - https://git.kernel.org/stable/c/dc43a096cfe65b5c32168313846c5cd135d08f1d - https://git.kernel.org/stable/c/1f31f51bfc8214a6deaac2920e6342cb9d019133 - https://git.kernel.org/stable/c/38f5db5587c0ee53546b28c50ba128253181ac83 - https://git.kernel.org/stable/c/f43190e33224c49e1c7ebbc25923ff400d87ec00 - https://git.kernel.org/stable/c/34fcac26216ce17886af3eb392355b459367af1a - https://git.kernel.org/stable/c/ce8eabc912fe9b9a62be1a5c6af5ad2196e90fc2 - https://git.kernel.org/stable/c/cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0
CVE ID: CVE-2024-46855 State: PUBLISHED Published: 2024-09-27T12:42:47.281Z Last Updated: 2025-11-03T22:19:41.790Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd - https://git.kernel.org/stable/c/6572440f78b724c46070841a68254ebc534cde24 - https://git.kernel.org/stable/c/ddc7c423c4a5386bf865474c694b48178efd311a - https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a
stable/c/ddc7c423c4a5386bf865474c694b48178efd311a - https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896 - https://git.kernel.org/stable/c/83e6fb59040e8964888afcaa5612cc1243736715 - https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11 - https://git.kernel.org/stable/c/8b26ff7af8c32cb4148b3e147c52f9e4c695209c
CVE ID: CVE-2024-46856 State: PUBLISHED Published: 2024-09-27T12:42:47.908Z Last Updated: 2025-05-04T09:36:03.799Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices The probe() function is only used for DP83822 and DP83826 PHY, leaving the private data pointer uninitialized for the DP83825 models which causes a NULL pointer dereference in the recently introduced/changed functions dp8382x_config_init() and dp83822_set_wol(). Add the dp8382x_probe() function, so all PHY models will have a valid private data pointer to fix this issue and also prevent similar issues in
function, so all PHY models will have a valid private data pointer to fix this issue and also prevent similar issues in the future. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/67b61e2f4c9c5df97a9a2ef7a1fe35eae00531f4 - https://git.kernel.org/stable/c/3f62ea572b3e8e3f10c39a9cb4f04ca9ae5f2952
CVE ID: CVE-2024-46857 State: PUBLISHED Published: 2024-09-27T12:42:48.545Z Last Updated: 2025-11-03T22:19:43.251Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix bridge mode operations when there are no VFs Currently, trying to set the bridge mode attribute when numvfs=0 leads to a crash: bridge link set dev eth2 hwmode vepa [ 168.967392] BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] [ 168.969989] RIP: 0010:mlx5_add_flow_rules+0x1f/0x300 [mlx5_core] [...] [ 168.976037] Call Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_esw
l Trace: [ 168.976188] <TASK> [ 168.978620] _mlx5_eswitch_set_vepa_locked+0x113/0x230 [mlx5_core] [ 168.979074] mlx5_eswitch_set_vepa+0x7f/0xa0 [mlx5_core] [ 168.979471] rtnl_bridge_setlink+0xe9/0x1f0 [ 168.979714] rtnetlink_rcv_msg+0x159/0x400 [ 168.980451] netlink_rcv_skb+0x54/0x100 [ 168.980675] netlink_unicast+0x241/0x360 [ 168.980918] netlink_sendmsg+0x1f6/0x430 [ 168.981162] ____sys_sendmsg+0x3bb/0x3f0 [ 168.982155] ___sys_sendmsg+0x88/0xd0 [ 168.985036] __sys_sendmsg+0x59/0xa0 [ 168.985477] do_syscall_64+0x79/0x150 [ 168.987273] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when
7e [ 168.987773] RIP: 0033:0x7f8f7950f917 (esw->fdb_table.legacy.vepa_fdb is null) The bridge mode is only relevant when there are multiple functions per port. Therefore, prevent setting and getting this setting when there are no VFs. Note that after this change, there are no settings to change on the PF interface using `bridge link` when there are no VFs, so the interface no longer appears in the `bridge link` output. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/52c4beb79e095e0631b5cac46ed48a2aefe51985 - https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50 - https://git.kernel.org/stable/c/505ae
51985 - https://git.kernel.org/stable/c/65feee671e37f3b6eda0b6af28f204b5bcf7fa50 - https://git.kernel.org/stable/c/505ae01f75f839b54329164bbfecf24cc1361b31 - https://git.kernel.org/stable/c/b1d305abef4640af1b4f1b4774d513cd81b10cfc
CVE ID: CVE-2024-46858 State: PUBLISHED Published: 2024-09-27T12:42:49.167Z Last Updated: 2025-11-03T22:19:44.734Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb genl_rcv __netif_receive_skb_one_core netlink_rcv_skb NF_HOOK genl_rcv_msg ip_local_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs
l_deliver_finish genl_family_rcv_msg ip_protocol_deliver_rcu genl_family_rcv_msg_doit tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit tcp_v4_do_rcv mptcp_nl_remove_addrs_list tcp_rcv_established mptcp_pm_remove_addrs_and_subflows tcp_data_queue remove_anno_list_by_saddr mptcp_incoming_options mptcp_pm_del_add_timer mptcp_pm_del_add_timer kfree(entry) In remove_anno_list_by_saddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcp_pm_del_add_timer(running on CPU1). Keeping a reference to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move
to add_timer inside the lock, and calling sk_stop_timer_sync() with this reference, instead of "entry->add_timer". Move list_del(&entry->list) to mptcp_pm_del_add_timer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3554482f4691571fc4b5490c17ae26896e62171c - https://git.kernel.org/stable/c/67409b358500c71632116356a0b065f112d7b707 - https://git.kernel.org/stable/c/6452b162549c7f9ef54655d3fb9977b9192e6e5b - https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc - https:/
162549c7f9ef54655d3fb9977b9192e6e5b - https://git.kernel.org/stable/c/12134a652b0a10064844ea235173e70246eba6dc - https://git.kernel.org/stable/c/b4cd80b0338945a94972ac3ed54f8338d2da2076
CVE ID: CVE-2024-46859 State: PUBLISHED Published: 2024-09-27T12:42:49.801Z Last Updated: 2025-11-03T22:19:46.186Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses The panasonic laptop code in various places uses the SINF array with index values of 0 - SINF_CUR_BRIGHT(0x0d) without checking that the SINF array is big enough. Not all panasonic laptops have this many SINF array entries, for example the Toughbook CF-18 model only has 10 SINF array entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which
y entries. So it only supports the AC+DC brightness entries and mute. Check that the SINF array has a minimum size which covers all AC+DC brightness entries and refuse to load if the SINF array is smaller. For higher SINF indexes hide the sysfs attributes when the SINF array does not contain an entry for that attribute, avoiding show()/store() accessing the array out of bounds and add bounds checking to the probe() and resume() code accessing these. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b7c2f692307fe704be87ea80d7328782b33c3cef - https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16 - https:
f692307fe704be87ea80d7328782b33c3cef - https://git.kernel.org/stable/c/9291fadbd2720a869b1d2fcf82305648e2e62a16 - https://git.kernel.org/stable/c/6821a82616f60aa72c5909b3e252ad97fb9f7e2a - https://git.kernel.org/stable/c/b38c19783286a71693c2194ed1b36665168c09c4 - https://git.kernel.org/stable/c/f52e98d16e9bd7dd2b3aef8e38db5cbc9899d6a4
CVE ID: CVE-2024-46860 State: PUBLISHED Published: 2024-09-27T12:42:50.464Z Last Updated: 2025-05-04T09:36:08.792Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change When disabling wifi mt7921_ipv6_addr_change() is called as a notifier. At this point mvif->phy is already NULL so we cannot use it here. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4bfee9346d8c17d928ef6da2b8bffab88fa2a553 - https://git.kernel.org/stable/c/8d92bafd4c67efb692f722d73a07412b5f88c6d6 - https://git.kernel.org/stable/c/479ffee68d59c599f8
://git.kernel.org/stable/c/8d92bafd4c67efb692f722d73a07412b5f88c6d6 - https://git.kernel.org/stable/c/479ffee68d59c599f8aed8fa2dcc8e13e7bd13c3
CVE ID: CVE-2024-46861 State: PUBLISHED Published: 2024-09-27T12:42:51.097Z Last Updated: 2025-05-04T09:36:10.467Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: do not stop RX on failing RX callback RX callbacks can fail for multiple reasons: * Payload too short * Payload formatted incorrecly (e.g. bad NCM framing) * Lack of memory None of these should cause the driver to seize up. Make such failures non-critical and continue processing further incoming URBs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4d1cfa3afb8627435744ecdc6d8b58bc72ee0f4c - https://git.ke
DP Vulnrichment: References: - https://git.kernel.org/stable/c/4d1cfa3afb8627435744ecdc6d8b58bc72ee0f4c - https://git.kernel.org/stable/c/08ca800b0cd56d5e26722f68b18bbbf6840bf44b - https://git.kernel.org/stable/c/74efed51e0a4d62f998f806c307778b47fc73395
CVE ID: CVE-2024-46862 State: PUBLISHED Published: 2024-09-27T12:42:51.738Z Last Updated: 2025-05-04T09:36:12.286Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/01281a9e8275946aa725db0919769b8d35af3a11 - https://git.kernel.org/stable/c/bf6d7a44a144aa9c476dee83c23faf
l.org/stable/c/01281a9e8275946aa725db0919769b8d35af3a11 - https://git.kernel.org/stable/c/bf6d7a44a144aa9c476dee83c23faf3151181bab
CVE ID: CVE-2024-46863 State: PUBLISHED Published: 2024-09-27T12:42:52.373Z Last Updated: 2025-05-04T09:36:13.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8eb57389d8ad91c67bf844f5aae4caef74b9091b - https://git.kernel.org/stable/c/c4246f1fe9f24f8dcd97887ed67d8f
l.org/stable/c/8eb57389d8ad91c67bf844f5aae4caef74b9091b - https://git.kernel.org/stable/c/c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796
CVE ID: CVE-2024-46864 State: PUBLISHED Published: 2024-09-27T12:42:52.994Z Last Updated: 2025-05-04T09:36:14.991Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: fix kexec crash due to VP assist page corruption commit 9636be85cc5b ("x86/hyperv: Fix hyperv_pcpu_input_arg handling when CPUs go online/offline") introduces a new cpuhp state for hyperv initialization. cpuhp_setup_state() returns the state number if state is CPUHP_AP_ONLINE_DYN or CPUHP_BP_PREPARE_DYN and 0 for all other states. For the hyperv case, since a new cpuhp state was introduced it would return 0. However, in hv_machine_shutdown(), the cpuhp_remo
hyperv case, since a new cpuhp state was introduced it would return 0. However, in hv_machine_shutdown(), the cpuhp_remove_state() call is conditioned upon "hyperv_init_cpuhp > 0". This will never be true and so hv_cpu_die() won't be called on all CPUs. This means the VP assist page won't be reset. When the kexec kernel tries to setup the VP assist page again, the hypervisor corrupts the memory region of the old VP assist page causing a panic in case the kexec kernel is using that memory elsewhere. This was originally fixed in commit dfe94d4086e4 ("x86/hyperv: Fix kexec panic/hang issues"). Get rid of hyperv_init_cpuhp entirely since we are no longer using a dynamic cpuhp state and use CPUHP
ic/hang issues"). Get rid of hyperv_init_cpuhp entirely since we are no longer using a dynamic cpuhp state and use CPUHP_AP_HYPERV_ONLINE directly with cpuhp_remove_state(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2ae1beb3ab4f28868cc5d1541d05e1fbee3ad825 - https://git.kernel.org/stable/c/d6f018a3b49d0a94ddbd0e479c2af6b19724e434 - https://git.kernel.org/stable/c/b9af6418279c4cf73ca073f8ea024992b38be8ab
CVE ID: CVE-2024-46865 State: PUBLISHED Published: 2024-09-27T12:42:53.691Z Last Updated: 2025-11-03T22:19:47.627Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/392f6a97fcbecc64f0c00058b2db5bb0e4b8cc3e - https://git.kernel.org/stable/c/16ff0895283058b0f96d4fe277aa25ee096f0ea8 - https://git.kernel.org/stable/c/5d537b8d900514509622ce9233
ernel.org/stable/c/16ff0895283058b0f96d4fe277aa25ee096f0ea8 - https://git.kernel.org/stable/c/5d537b8d900514509622ce92330b70d2e581d409 - https://git.kernel.org/stable/c/7ae890ee19479eeeb87724cca8430b5cb3660c74 - https://git.kernel.org/stable/c/aca06c617c83295f0caa486ad608fbef7bdc11e8 - https://git.kernel.org/stable/c/4c8002277167125078e6b9b90137bdf443ebaa08
CVE ID: CVE-2024-46866 State: PUBLISHED Published: 2024-09-27T12:42:54.381Z Last Updated: 2025-05-04T09:36:17.715Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: add missing bo locking in show_meminfo() bo_meminfo() wants to inspect bo state like tt and the ttm resource, however this state can change at any point leading to stuff like NPD and UAF, if the bo lock is not held. Grab the bo lock when calling bo_meminfo(), ensuring we drop any spinlocks first. In the case of object_idr we now also need to hold a ref. v2 (MattB) - Also add xe_bo_assert_held() (cherry picked from commit 4f63d712fa104c3ebefcb289d1e733e86
ed to hold a ref. v2 (MattB) - Also add xe_bo_assert_held() (cherry picked from commit 4f63d712fa104c3ebefcb289d1e733e86d8698c7) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/abc8feacacf8fae10eecf6fea7865e8c1fee419c - https://git.kernel.org/stable/c/94c4aa266111262c96c98f822d1bccc494786fee
CVE ID: CVE-2024-46867 State: PUBLISHED Published: 2024-09-27T12:42:55.025Z Last Updated: 2025-05-04T09:36:19.172Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/client: fix deadlock in show_meminfo() There is a real deadlock as well as sleeping in atomic() bug in here, if the bo put happens to be the last ref, since bo destruction wants to grab the same spinlock and sleeping locks. Fix that by dropping the ref using xe_bo_put_deferred(), and moving the final commit outside of the lock. Dropping the lock around the put is tricky since the bo can go out of scope and delete itself from the list, making it difficult to navi
k around the put is tricky since the bo can go out of scope and delete itself from the list, making it difficult to navigate to the next list entry. (cherry picked from commit 0083b8e6f11d7662283a267d4ce7c966812ffd8a) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9d3de463e23bfb1ff1567a32b099b1b3e5286a48 - https://git.kernel.org/stable/c/9bd7ff293fc84792514aeafa06c5a17f05cb5f4b
CVE ID: CVE-2024-46868 State: PUBLISHED Published: 2024-09-27T12:42:55.664Z Last Updated: 2025-05-04T09:36:20.407Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire() If the __qcuefi pointer is not set, then in the original code, we would hold onto the lock. That means that if we tried to set it later, then it would cause a deadlock. Drop the lock on the error path. That's what all the callers are expecting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8c6a5a1fc02ad1d62d06897ab330693d4d27cd03 - https://git.kernel.org/stab
nt: References: - https://git.kernel.org/stable/c/8c6a5a1fc02ad1d62d06897ab330693d4d27cd03 - https://git.kernel.org/stable/c/db213b0cfe3268d8b1d382b3bcc999c687a2567f