Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
9170/tx.c:283:2, inlined from 'kref_put' at include/linux/kref.h:65:3, inlined from 'carl9170_tx_put_skb' at drivers/net/wireless/ath/carl9170/tx.c:342:9: include/linux/fortify-string.h:493:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 493 | __write_overflow_field(p_size_field, size); Kees previously tried to avoid this by using memset_after(), but it seems this does not fully address the problem. I noticed that the memset_after() here is done on a different part of the union (status) than the original cast was from (rate_driver_data), which may confuse th
done on a different part of the union (status) than the original cast was from (rate_driver_data), which may confuse the compiler. Unfortunately, the memset_after() trick does not work on driver_rates[] because that is part of an anonymous struct, and I could not get struct_group() to do this either. Using two separate memset() calls on the two members does address the warning though. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b - https://git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4 - https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec8
ble/c/87586467098281f04fa93e59fe3a516b954bddc4 - https://git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83 - https://git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02 - https://git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901
CVE ID: CVE-2024-38617 State: PUBLISHED Published: 2024-06-19T13:56:16.763Z Last Updated: 2025-05-04T09:15:23.602Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: kunit/fortify: Fix mismatched kvalloc()/vfree() usage The kv*() family of tests were accidentally freeing with vfree() instead of kvfree(). Use kvfree() instead. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7880dbf4eafe22a6a41a42e774f1122c814ed02d - https://git.kernel.org/stable/c/42d21c9727028fe7ee392223ba127484b1b8677e - https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937
ble/c/42d21c9727028fe7ee392223ba127484b1b8677e - https://git.kernel.org/stable/c/03758d5a0932016b6d5f5bfbca580177e6bc937a - https://git.kernel.org/stable/c/998b18072ceb0613629c256b409f4d299829c7ec
CVE ID: CVE-2024-38618 State: PUBLISHED Published: 2024-06-19T13:56:17.422Z Last Updated: 2025-11-04T17:21:47.608Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer. This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set.
es a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f - https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 - https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab - https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e - https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b - https:/
a8592b9e258fd80ac6486510ab1dcd7ad6e - https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b - https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 - https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd - https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e
CVE ID: CVE-2024-38619 State: PUBLISHED Published: 2024-06-20T06:47:32.444Z Last Updated: 2025-11-03T21:55:50.508Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media(). Additional Analyst Notes: - CVE Program
nitialization. - Add an error check for the return value of alauda_init_media(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e0aab7b07a9375337847c9d74a5ec044071e01c8 - https://git.kernel.org/stable/c/51fe16c058acb22f847e69bc598066ed0bcd5c15 - https://git.kernel.org/stable/c/f68820f1256b21466ff094dd97f243b7e708f9c1 - https://git.kernel.org/stable/c/3eee13ab67f65606faa66e0c3c729e4f514838fd - https://git.kernel.org/stable/c/e0e2eec76920a133dd49a4fbe4656d83596a1361 - https://git.kernel.org/stable/c/2cc32639ec347e3365075b130f9953ef16cb13f1 - https://git.kernel.org/stable/c/24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4 - http
c32639ec347e3365075b130f9953ef16cb13f1 - https://git.kernel.org/stable/c/24bff7f714bdff97c2a75a0ff6a368cdf8ad5af4 - https://git.kernel.org/stable/c/16637fea001ab3c8df528a8995b3211906165a30
CVE ID: CVE-2024-38620 State: PUBLISHED Published: 2024-06-20T08:03:43.906Z Last Updated: 2025-05-04T09:15:27.796Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Remove HCI_AMP support Since BT_HS has been remove HCI_AMP controllers no longer has any use so remove it along with the capability of creating AMP controllers. Since we no longer need to differentiate between AMP and Primary controllers, as only HCI_PRIMARY is left, this also remove hdev->dev_type altogether. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a0
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156 - https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec - https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03 - https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7
CVE ID: CVE-2024-38621 State: PUBLISHED Published: 2024-06-21T10:18:14.955Z Last Updated: 2025-11-04T17:21:49.029Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have copied thus far. When the condition is reversed that means the result of the subtraction is always negative but since it's unsigned then the result is a very high positive value. That means the overflow check is never true. Additionally, the ->bytesused doesn't actually work for this
sitive value. That means the overflow check is never true. Additionally, the ->bytesused doesn't actually work for this purpose because we're not writing to "buf->mem + buf->bytesused". Instead, the math to calculate the destination where we are writing is a bit involved. You calculate the number of full lines already written, multiply by two, skip a line if necessary so that we start on an odd numbered line, and add the offset into the line. To fix this buffer overflow, just take the actual destination where we are writing, if the offset is already out of bounds print an error and return. Otherwise, write up to buf->length bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP
rror and return. Otherwise, write up to buf->length bytes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f6a392266276730bea893b55d12940e32a25f56a - https://git.kernel.org/stable/c/ecf4ddc3aee8ade504c4d36b7b4053ce6093e200 - https://git.kernel.org/stable/c/a16775828aaed1c54ff4e6fe83e8e4d5c6a50cb7 - https://git.kernel.org/stable/c/7532bcec0797adfa08791301c3bcae14141db3bd - https://git.kernel.org/stable/c/b504518a397059e1d55c521ba0ea2b545a6c4b52 - https://git.kernel.org/stable/c/d410017a7181cb55e4a5c810b32b75e4416c6808 - https://git.kernel.org/stable/c/a08492832cc4cacc24e0612f483c86ca899b9261 - https://git.kernel.org/sta
b32b75e4416c6808 - https://git.kernel.org/stable/c/a08492832cc4cacc24e0612f483c86ca899b9261 - https://git.kernel.org/stable/c/faa4364bef2ec0060de381ff028d1d836600a381
CVE ID: CVE-2024-38622 State: PUBLISHED Published: 2024-06-21T10:18:15.625Z Last Updated: 2025-05-04T09:15:30.370Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, but then callback function is unconditionally called by this pointer. Fix this bug by adding conditional return. Found by Linux Verification Center (linuxtesting.org) with SVACE. Patchwork: https://patchwork.freedesktop.org/patch/588237/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
k.freedesktop.org/patch/588237/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/873f67699114452c2a996c4e10faac8ff860c241 - https://git.kernel.org/stable/c/9078630ed7f8f25d65d11823e7f2b11a8e2f4f0f - https://git.kernel.org/stable/c/530f272053a5e72243a9cb07bb1296af6c346002
CVE ID: CVE-2024-38623 State: PUBLISHED Published: 2024-06-21T10:18:16.291Z Last Updated: 2025-05-04T09:15:31.780Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a2de301d90b782ac5d7a5fe32995caaee9ab3a0f - https://git.kernel.org/stable/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 - https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d
ble/c/3839a9b19a4b70eff6b6ad70446f639f7fd5a3d7 - https://git.kernel.org/stable/c/1fe1c9dc21ee52920629d2d9b9bd84358931a8d1 - https://git.kernel.org/stable/c/cceef44b34819c24bb6ed70dce5b524bd3e368d1 - https://git.kernel.org/stable/c/1997cdc3e727526aa5d84b32f7cbb3f56459b7ef
CVE ID: CVE-2024-38624 State: PUBLISHED Published: 2024-06-21T10:18:16.940Z Last Updated: 2025-05-04T09:15:33.482Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: vbo = 2 * vbo + skip Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2d1ad595d15f36a925480199bf1d9ad72614210b - https://git.kernel.org/stable/c/98db3155b54d3684ef0ab5bfa0b856d13f65843d - https://git.kernel.org/stable/c/109d85a98345ee52d47c650405dc51bdd2bc7d40 - https://git.kernel.org/stable/c/847db4049f6189427d
://git.kernel.org/stable/c/109d85a98345ee52d47c650405dc51bdd2bc7d40 - https://git.kernel.org/stable/c/847db4049f6189427ddaefcfc967d4d235b73c57 - https://git.kernel.org/stable/c/e931f6b630ffb22d66caab202a52aa8cbb10c649
CVE ID: CVE-2024-38625 State: PUBLISHED Published: 2024-06-21T10:18:17.603Z Last Updated: 2025-05-04T09:15:35.053Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6c8054d590668629bb2eb6fb4cbf22455d08ada8 - https://git.kernel.org/stable/c/ff1068929459347f9e47f8d14c409dcf938c2641 - https://git.kernel.org/stable/c/1cd6c96219c429ebcfa8e79a865277376c563803
CVE ID: CVE-2024-38626 State: PUBLISHED Published: 2024-06-21T10:18:18.255Z Last Updated: 2025-05-04T09:15:36.201Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was reported by lee bruce: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 Modules linked in: CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Call Trace: <TASK> fuse_dev_do_read.constprop
IIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Call Trace: <TASK> fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [inline] new_sync_read fs/read_write.c:395 [inline] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...... </TASK> The warning is due to the FUSE_NOTIFY_RESEND notify sent by the write() syscall in the reproducer program and it happens as follows: (1) calls fuse_dev_read() to read
tify sent by the write() syscall in the reproducer program and it happens as follows: (1) calls fuse_dev_read() to read the INIT request The read succeeds. During the read, bit FR_SENT will be set on the request. (2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify The resend notify will resend all processing requests, so the INIT request is moved from processing list to pending list again. (3) calls fuse_dev_read() with an invalid output address fuse_dev_read() will try to copy the same INIT request to the output address, but it will fail due to the invalid address, so the INIT request is ended and triggers the warning in fuse_request_end(). Fix it by clearing FR_SENT when re-addi
ss, so the INIT request is ended and triggers the warning in fuse_request_end(). Fix it by clearing FR_SENT when re-adding requests into pending list. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf - https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd
CVE ID: CVE-2024-38627 State: PUBLISHED Published: 2024-06-21T10:18:18.912Z Last Updated: 2025-11-04T17:21:50.394Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6cc30ef8eb6d8f8d6df43152264bbf8835d99931 - https://git.kernel.org/stable/c/a0450d3f38e7c6c0a7c0afd4182976ee15573695 - https://git.kernel.org/stable/c/713fc00c571
- https://git.kernel.org/stable/c/a0450d3f38e7c6c0a7c0afd4182976ee15573695 - https://git.kernel.org/stable/c/713fc00c571dde4af3db2dbd5d1b0eadc327817b - https://git.kernel.org/stable/c/7419df1acffbcc90037f6b5a2823e81389659b36 - https://git.kernel.org/stable/c/4bfd48bb6e62512b9c392c5002c11e1e3b18d247 - https://git.kernel.org/stable/c/370c480410f60b90ba3e96abe73ead21ec827b20 - https://git.kernel.org/stable/c/d782a2db8f7ac49c33b9ca3e835500a28667d1be - https://git.kernel.org/stable/c/3df463865ba42b8f88a590326f4c9ea17a1ce459
CVE ID: CVE-2024-38628 State: PUBLISHED Published: 2024-06-21T10:18:19.558Z Last Updated: 2025-05-04T09:15:38.836Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/89e66809684485590ea0b32c3178e42cba36ac09 - https://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0 - https://git.kernel.org/stable/c/bea73b58ab67fe5810
://git.kernel.org/stable/c/453d3fa9266e53f85377b911c19b9a4563fa88c0 - https://git.kernel.org/stable/c/bea73b58ab67fe581037ad9cdb93c2557590c068 - https://git.kernel.org/stable/c/1b739388aa3f8dfb63a9fca777e6dfa6912d0464
CVE ID: CVE-2024-38629 State: PUBLISHED Published: 2024-06-21T10:18:20.239Z Last Updated: 2025-05-04T09:15:40.488Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file operations. Therefore, there is no need to destroy an already empty file_ida when the WQ cdev is removed. Worse, ida_free() in cdev release may happen after destruction of file_ida per WQ cdev. This can lead to accessing an id in file_ida after it has been destroyed, resulting in a ker
on of file_ida per WQ cdev. This can lead to accessing an id in file_ida after it has been destroyed, resulting in a kernel panic. Remove ida_destroy(&file_ida) to address these issues. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9eb15f24a0b9b017b39cde8b8c07243676b63687 - https://git.kernel.org/stable/c/15edb906211bf53e7b5574f7326ab734d6bff4f9 - https://git.kernel.org/stable/c/76e43fa6a456787bad31b8d0daeabda27351a480
CVE ID: CVE-2024-38630 State: PUBLISHED Published: 2024-06-21T10:18:20.892Z Last Updated: 2025-05-04T09:15:41.586Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is running, del_timer() could not stop it and will return directly. If the port region is released by release_region() and then the timer handler cpu5wdt_trigger() calls outb() to write into the region that is released, the use-after-free bug will happen. Change del_timer() to timer_sh
lls outb() to write into the region that is released, the use-after-free bug will happen. Change del_timer() to timer_shutdown_sync() in order that the timer handler could be finished before the port region is released. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9b1c063ffc075abf56f63e55d70b9778ff534314 - https://git.kernel.org/stable/c/f19686d616500cd0d47b30cee82392b53f7f784a - https://git.kernel.org/stable/c/573601521277119f2e2ba5f28ae6e87fc594f4d4
CVE ID: CVE-2024-38631 State: PUBLISHED Published: 2024-06-21T10:18:21.553Z Last Updated: 2025-05-04T09:15:42.668Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: adc: PAC1934: fix accessing out of bounds array index Fix accessing out of bounds array index for average current and voltage measurements. The device itself has only 4 channels, but in sysfs there are "fake" channels for the average voltages and currents too. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8dbcb3a8cfdf8ff5afce62dad50790278ff0d3b7 - https://git.kernel.org/stable/c/51fafb3cd7
- https://git.kernel.org/stable/c/8dbcb3a8cfdf8ff5afce62dad50790278ff0d3b7 - https://git.kernel.org/stable/c/51fafb3cd7fcf4f4682693b4d2883e2a5bfffe33
CVE ID: CVE-2024-38632 State: PUBLISHED Published: 2024-06-21T10:18:22.236Z Last Updated: 2025-11-03T21:55:51.981Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a6d810554d7d9d07041f14c5fcd453f3d3fed594 - https://git.kernel.org/stable/c/91ced077db2062604ec270b1046f8337e9090079 - https://git.kernel.org/stable/c/0bd22a4966d55f1d2c127a53300d5c2b50152376 - https://git.kernel.org/stable/c/35fe
090079 - https://git.kernel.org/stable/c/0bd22a4966d55f1d2c127a53300d5c2b50152376 - https://git.kernel.org/stable/c/35fef97c33f3d3ca0455f9a8e2a3f2c1f8cc9140 - https://git.kernel.org/stable/c/82b951e6fbd31d85ae7f4feb5f00ddd4c5d256e2
CVE ID: CVE-2024-38633 State: PUBLISHED Published: 2024-06-21T10:18:22.905Z Last Updated: 2025-11-04T17:21:51.827Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uart_driver_registered on driver removal The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after insmod — rmmod — insmod cycle the kernel oopses: max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_pr
ress: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0 Update the actual state so next time UART driver will be registered again. Hugo also noticed, that the error path in the probe also affected by having the variable set, and not cleared. Instead of clearing it move the assignment after the successfull uart_register_driver() call. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b - https://git.kernel.org/stable/c/9db4222ed8cd3e50b81c8b910ae74c26427a4003 - https://git.kernel.org/stable/c/e8e2a4339decad
ttps://git.kernel.org/stable/c/9db4222ed8cd3e50b81c8b910ae74c26427a4003 - https://git.kernel.org/stable/c/e8e2a4339decad7e59425b594a98613402652d72 - https://git.kernel.org/stable/c/361a92c9038e8c8c3996f8eeaa14522a8ad90752 - https://git.kernel.org/stable/c/b6eb7aff23e05f362e8c9b560f6ac5e727b70e00 - https://git.kernel.org/stable/c/e8a10089eddba40d4b2080c9d3fc2d2b2488f762 - https://git.kernel.org/stable/c/fa84ca78b048dfb00df0ef446f5c35e0a98ca6a0 - https://git.kernel.org/stable/c/712a1fcb38dc7cac6da63ee79a88708fbf9c45ec
CVE ID: CVE-2024-38634 State: PUBLISHED Published: 2024-06-21T10:18:23.573Z Last Updated: 2025-11-04T17:21:53.204Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port->lock when calling uart_handle_cts_change() uart_handle_cts_change() has to be called with port lock taken, Since we run it in a separate work, the lock may not be taken at the time of running. Make sure that it's taken by explicitly doing that. Without it we got a splat: WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0 ... Workqueue: max3100-0 max3100_work [max3100] RIP: 0010:uart_handle_cts_c