Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://git.kernel.org/stable/c/1b6de5e6575b56502665c65cf93b0ae6aa0f51ab - https://git.kernel.org/stable/c/9705f447bf9a6cd088300ad2c407b5e1c6591091 - https://git.kernel.org/stable/c/4318608dc28ef184158b4045896740716bea23f0 - https://git.kernel.org/stable/c/7d0567842b78390dd9b60f00f1d8f838d540e325 - https://git.kernel.org/stable/c/f4877225313d474659ee53150ccc3d553a978727 - https://git.kernel.org/stable/c/e09cbe017311508c21e0739e97198a8388b98981 - https://git.kernel.org/stable/c/18685451fc4e546fc0e718580d32df3c0e5c8272
CVE ID: CVE-2024-26922 State: PUBLISHED Published: 2024-04-23T13:05:04.243Z Last Updated: 2025-11-04T17:14:43.597Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d4da6b084f1c5625937d49bb6722c5b4aef11b8d - https://git.kernel.org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9 - https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895
org/stable/c/f68039375d4d6d67303674c0ab2d06b7295c0ec9 - https://git.kernel.org/stable/c/1fd7db5c16028dc07b2ceec190f2e895dddb532d - https://git.kernel.org/stable/c/8b12fc7b032633539acdf7864888b0ebd49e90f2 - https://git.kernel.org/stable/c/212e3baccdb1939606420d88f7f52d346b49a284 - https://git.kernel.org/stable/c/ef13eeca7c79136bc38e21eb67322c1cbd5c40ee - https://git.kernel.org/stable/c/b1f04b9b1c5317f562a455384c5f7473e46bdbaa - https://git.kernel.org/stable/c/6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75
CVE ID: CVE-2024-26923 State: PUBLISHED Published: 2024-04-24T21:49:22.001Z Last Updated: 2025-05-04T08:59:47.874Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a l
then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs ==
2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And
d of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a36ae0ec2353015f0f6762e59f4c2dbc0c906423 - https://git.kernel.org/stable/c/343c5372d5e17b306db5f8f3c895539b06e3177f - https://git.kernel.org/stable/c/2e2a03787f4f0abc0072350654ab0ef3324d9db3 - https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a5
ble/c/2e2a03787f4f0abc0072350654ab0ef3324d9db3 - https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51 - https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c - https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9 - https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009 - https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51
CVE ID: CVE-2024-26924 State: PUBLISHED Published: 2024-04-24T21:49:22.631Z Last Updated: 2025-11-04T17:14:47.716Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: do not free live element Pablo reports a crash with large batches of elements with a back-to-back add/remove pattern. Quoting Pablo: add_elem("00000000") timeout 100 ms ... add_elem("0000000X") timeout 100 ms del_elem("0000000X") <---------------- delete one that was just added ... add_elem("00005000") timeout 100 ms 1) nft_pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance tha
pipapo_remove() removes element 0000000X Then, KASAN shows a splat. Looking at the remove function there is a chance that we will drop a rule that maps to a non-deactivated element. Removal happens in two steps, first we do a lookup for key k and return the to-be-removed element and mark it as inactive in the next generation. Then, in a second step, the element gets removed from the set/map. The _remove function does not work correctly if we have more than one element that share the same key. This can happen if we insert an element into a set when the set already holds an element with same key, but the element mapping to the existing key has timed out or is not active in the next generation.
lement with same key, but the element mapping to the existing key has timed out or is not active in the next generation. In such case its possible that removal will unmap the wrong element. If this happens, we will leak the non-deactivated element, it becomes unreachable. The element that got deactivated (and will be freed later) will remain reachable in the set data structure, this can result in a crash when such an element is retrieved during lookup (stale pointer). Add a check that the fully matching key does in fact map to the element that we have marked as inactive in the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, th
the deactivation step. If not, we need to continue searching. Add a bug/warn trap at the end of the function as well, the remove function must not ever be called with an invisible/unreachable/non-existent element. v2: avoid uneeded temporary variable (Stefano) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3b887a9c11caf8357a821260e095f2a694a34f2 - https://git.kernel.org/stable/c/7a1679e2d9bfa3b5f8755c2c7113e54b7d42bd46 - https://git.kernel.org/stable/c/41d8fdf3afaff312e17466e4ab732937738d5644 - https://git.kernel.org/stable/c/ebf7c9746f073035ee26209e38c3a1170f7b349a - https://git.kernel.org/stable/c/14b001ba221136c15
s://git.kernel.org/stable/c/ebf7c9746f073035ee26209e38c3a1170f7b349a - https://git.kernel.org/stable/c/14b001ba221136c15f894577253e8db535b99487 - https://git.kernel.org/stable/c/3cfc9ec039af60dbd8965ae085b2c2ccdcfbe1cc
CVE ID: CVE-2024-26925 State: PUBLISHED Published: 2024-04-24T21:49:23.251Z Last Updated: 2025-05-04T12:55:12.223Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence. nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the
ases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/61ac7284346c32f9a8c8ceac56102f7914060428 - https://git.kernel.org/stable/c/2cee2ff7f8cce12a63a0a23ffe27f08d99541494 - https://git.kernel.org/stable/c/eb769ff4e281f751adcaf4f4445cbf30817be139 - https://git.kernel.org/stable/c/8d3a58af50e46167b6f1db47adadad03c0045dae - https://git.kernel.org/stable/c/8038ee3c3e5b59bcd78467686db5270c68544e30 - https://git.kernel.org/stable/c/a34ba4bdeec0c3b629160497594908dc8201
stable/c/8038ee3c3e5b59bcd78467686db5270c68544e30 - https://git.kernel.org/stable/c/a34ba4bdeec0c3b629160497594908dc820110f1 - https://git.kernel.org/stable/c/0d459e2ffb541841714839e8228b845458ed3b27
CVE ID: CVE-2024-26926 State: PUBLISHED Published: 2024-04-24T23:23:40.600Z Last Updated: 2025-05-04T12:55:13.342Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: binder: check offset alignment in binder_get_object() Commit 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") introduced changes to how binder objects are copied. In doing so, it unintentionally removed an offset alignment check done through calls to binder_alloc_copy_from_buffer() -> check_buffer(). These calls were replaced in binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later c
binder_get_object() with copy_from_user(), so now an explicit offset alignment check is needed here. This avoids later complications when unwinding the objects gets harder. It is worth noting this check existed prior to commit 7a67a39320df ("binder: add function to copy binder object from buffer"), likely removed due to redundancy at the time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12 - https://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc - https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c - https://git.kernel.org/stable/c/a6d2a8b
9fc - https://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c - https://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76 - https://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc - https://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15 - https://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40
CVE ID: CVE-2024-26927 State: PUBLISHED Published: 2024-04-28T11:27:56.756Z Last Updated: 2025-05-04T08:59:54.041Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d133d67e7e724102d1e53009c4f88afaaf3e167c - https:/
CVE Program Container: References: - https://git.kernel.org/stable/c/d133d67e7e724102d1e53009c4f88afaaf3e167c - https://git.kernel.org/stable/c/ced7df8b3c5c4751244cad79011e86cf1f809153 - https://git.kernel.org/stable/c/044e220667157fb9d59320341badec59cf45ba48 - https://git.kernel.org/stable/c/9eeb8e1231f6450c574c1db979122e171a1813ab - https://git.kernel.org/stable/c/98f681b0f84cfc3a1d83287b77697679e0398306
CVE ID: CVE-2024-26928 State: PUBLISHED Published: 2024-04-28T11:28:01.529Z Last Updated: 2025-11-03T19:29:37.367Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8f8718afd446cd4ea3b62bacc3eec09f8aae85ee - https://git.kernel.org/stable/c/a140224bcf87eb98a87b67ff4c6826c57e47b704 - https://git.kernel.org/stable/c/229042314602db62559ecacba127067c22ee7b88 - https://git.kern
98a87b67ff4c6826c57e47b704 - https://git.kernel.org/stable/c/229042314602db62559ecacba127067c22ee7b88 - https://git.kernel.org/stable/c/a65f2b56334ba4dc30bd5ee9ce5b2691b973344d - https://git.kernel.org/stable/c/3402faf78b2516b0af1259baff50cc8453ef0bd1 - https://git.kernel.org/stable/c/ca545b7f0823f19db0f1148d59bc5e1a56634502
CVE ID: CVE-2024-26929 State: REJECTED Published: 2024-05-01T05:17:06.418Z Last Updated: 2025-01-06T16:24:17.811Z Description: No description available.
CVE ID: CVE-2024-26930 State: PUBLISHED Published: 2024-05-01T05:17:10.685Z Last Updated: 2025-05-04T08:59:56.628Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL to vp_map and kfree take care of NULL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467 - https://git.kernel.org/st
iner: References: - https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467 - https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73 - https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f - https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b
CVE ID: CVE-2024-26931 State: PUBLISHED Published: 2024-05-01T05:17:14.823Z Last Updated: 2025-05-04T08:59:58.177Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] R
ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 00000000
: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:0
0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:
12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx
register_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SG
e pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL. Add a check to make sure commands are flush back on session tear down to prevent the null pointer access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a - https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9 - https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac - https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a - https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211 - https:
f6a8f4234b8ef62862bf7a92f1af5f8cd47a - https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211 - https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d - https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d - https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150 - https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1
CVE ID: CVE-2024-26932 State: PUBLISHED Published: 2024-05-01T05:17:19.129Z Last Updated: 2025-05-04T09:00:01.282Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabilitiy will be kfreed twice, the first time is kfreed by pd_capabilities_release() and the second time is explicitly kfreed by tcpm_port_unregister_pd(). [ 3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc [ 3.995001] Free of addr ffff0008164d3000 by task kworker/
UG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc [ 3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10 [ 4.001206] [ 4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53 [ 4.012402] Hardware name: Freescale i.MX8QXP MEK (DT) [ 4.017569] Workqueue: events_unbound deferred_probe_work_func [ 4.023456] Call trace: [ 4.025920] dump_backtrace+0x94/0xec [ 4.029629] show_stack+0x18/0x24 [ 4.032974] dump_stack_lvl+0x78/0x90 [ 4.036675] print_report+0xfc/0x5c0 [ 4.040289] kasan_report_invalid_free+0xa0/0xc0 [ 4.044937] __kasan_slab_free+0x124/0x154 [ 4.049072] kfree+0xb4/0x1e8 [ 4.052069] tcpm_port_unregister_pd+0x1a4/0x3dc
[ 4.044937] __kasan_slab_free+0x124/0x154 [ 4.049072] kfree+0xb4/0x1e8 [ 4.052069] tcpm_port_unregister_pd+0x1a4/0x3dc [ 4.056725] tcpm_register_port+0x1dd0/0x2558 [ 4.061121] tcpci_register_port+0x420/0x71c [ 4.065430] tcpci_probe+0x118/0x2e0 To fix the issue, this will remove kree() from tcpm_port_unregister_pd(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69 - https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856
CVE ID: CVE-2024-26933 State: PUBLISHED Published: 2024-05-01T05:17:23.289Z Last Updated: 2025-05-04T09:00:05.158Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration: Removing the hub or changing its configuration requires the hub interface to be removed, which requires the port device to be removed, and device_del() waits until all
requires the hub interface to be removed, which requires the port device to be removed, and device_del() waits until all outstanding sysfs attribute callbacks for the ports have returned. The lock can't be released until then. But the disable_show() or disable_store() routine can't return until after it has acquired the lock. The resulting deadlock can be avoided by calling sysfs_break_active_protection(). This will cause the sysfs core not to wait for the attribute's callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire
l, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hub_get(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9dac54f08198147f5ec0ec52fcf1bc8ac899ac05 - https://git.kernel.org/stable/c/f51849833705dea5b4f9b0c8de714dd87bd6c95c - https://git.kernel.org/stable/c/4facc9421117ba9d8148c73771b213887fec77f7 - https://git.kernel.org/stable/c/73d1589b91f2099e5f6534a8497b7c6b527e064e - https://git.kernel.org/stable/c/f4d1960764d8a70318b02f15203a1be2b2554ca1