Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9e3ffb839249eca113062587659224f856fe14e5 - https://git.kernel.org/stable/c/efe8effe138044a4747d1112ebb8c454d1663723 - https://git.kernel.org/stable/c/36486c9e8e01b84faaee47203eac0b7e9cc7fa4a - https://git.kernel.org/stable/c/d11a67634227f9f9da51938af085fb41a733848f
CVE ID: CVE-2024-46771 State: PUBLISHED Published: 2024-09-18T07:12:29.363Z Last Updated: 2025-11-03T22:18:13.468Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcm_connect() below. [0] The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with ifindex == 0. Calling connect() for a BCM socket allocates a proc entry. Then, bcm_sk(sk)->bound is set to 1 to prevent further connect(). However, removing the bound device resets bcm_sk(sk)->bound to 0 in bcm_notify(). The 2nd connect() tries to allocate a proc entry with the same
nd device resets bcm_sk(sk)->bound to 0 in bcm_notify(). The 2nd connect() tries to allocate a proc entry with the same name and sets NULL to bcm_sk(sk)->bcm_proc_read, leaking the original proc entry. Since the proc entry is available only for connect()ed sockets, let's clean up the entry when the bound netdev is unregistered. [0]: proc_dir_entry 'can-bcm/2456' already registered WARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375 Modules linked in: CPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 001
ware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:proc_register+0x645/0x8f0 fs/proc/generic.c:375 Code: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 <0f> 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48 RSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246 RAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX: ff1100011857cd80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0 R10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000 R13: 0000000000000000
00000000f R09: ff1100013e78cac0 R10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec FS: 00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> proc_create_net_single+0x144/0x210 fs/proc/proc_net.c:220 bcm_connect+0x472/0x840 net/can/bcm.c:1673 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x5d2/0x690 net/so
cm_connect+0x472/0x840 net/can/bcm.c:1673 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x5d2/0x690 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x8f/0x100 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7fbd708b0e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 0000000000
0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040 R10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098 R13: 0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000 </TASK> remove_proc_entry: removing non-empty directory 'net/can-bcm', leaking at least '2456' Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c680022c4e28ba18ea500f3e2
CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c680022c4e28ba18ea500f3e29f0428271afa92 - https://git.kernel.org/stable/c/33ed4ba73caae39f34ab874ba79138badc2c65dd - https://git.kernel.org/stable/c/aec92dbebdbec7567d9f56d7c9296a572b8fd849 - https://git.kernel.org/stable/c/10bfacbd5e8d821011d857bee73310457c9c989a - https://git.kernel.org/stable/c/3b39dc2901aa7a679a5ca981a3de9f8d5658afe8 - https://git.kernel.org/stable/c/4377b79323df62eb5d310354f19b4d130ff58d50 - https://git.kernel.org/stable/c/abb0a615569ec008e8a93d9f3ab2d5b418ea94d4 - https://git.kernel.org/stable/c/76fe372ccb81b0c89b6cd2fec26e2f38c958be85
CVE ID: CVE-2024-46772 State: PUBLISHED Published: 2024-09-18T07:12:30.177Z Last Updated: 2025-11-03T19:31:06.838Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check denominator crb_pipes before used [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 2 DIVIDE_BY_ZERO issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/04805efe8623f8721f3c01182ea73d68e88c62d8 - https://git.kernel.org/stable/c/b9264aa24f628eba5779d1c916441e0cedde9b3d - https://git.kernel.org/stable/c/ede06d23392529b039c
//git.kernel.org/stable/c/b9264aa24f628eba5779d1c916441e0cedde9b3d - https://git.kernel.org/stable/c/ede06d23392529b039cf7ac11b5875b047900f1c - https://git.kernel.org/stable/c/ea79068d4073bf303f8203f2625af7d9185a1bc6
CVE ID: CVE-2024-46773 State: PUBLISHED Published: 2024-09-18T07:12:30.997Z Last Updated: 2025-11-03T22:18:14.980Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check denominator pbn_div before used [WHAT & HOW] A denominator cannot be 0, and is checked before used. This fixes 1 DIVIDE_BY_ZERO issue reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/20e7164c52d9bfbb9d9862b833fa989624a61345 - https://git.kernel.org/stable/c/dfafee0a7b51c7c9612edd2d991401294964d02f - https://git.kernel.org/stable/c/11f997143c67680d6e40a1
it.kernel.org/stable/c/dfafee0a7b51c7c9612edd2d991401294964d02f - https://git.kernel.org/stable/c/11f997143c67680d6e40a13363618380cd57a414 - https://git.kernel.org/stable/c/116a678f3a9abc24f5c9d2525b7393d18d9eb58e
CVE ID: CVE-2024-46774 State: PUBLISHED Published: 2024-09-18T07:12:31.782Z Last Updated: 2025-11-03T19:31:08.194Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas() Smatch warns: arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential spectre issue 'args.args' [r] (local cap) The 'nargs' and 'nret' locals come directly from a user-supplied buffer and are used as indexes into a small stack-based array and as inputs to copy_to_user() after they are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative
hey are subject to bounds checks. Use array_index_nospec() after the bounds checks to clamp these values for speculative execution. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d2834ff1d9641a8695a09ea79cd901c7b6d4d05f - https://git.kernel.org/stable/c/a262c2dc833f2fe1bd5c53a4d899e7077d3b1da9 - https://git.kernel.org/stable/c/b137af795399d8b657bad1646c18561530f35ed1 - https://git.kernel.org/stable/c/1f1feff02e9da0dd0cdb195c428c42b5f9b6c771 - https://git.kernel.org/stable/c/68d8156480940b79227d58865ec5d2947b9384a8 - https://git.kernel.org/stable/c/0974d03eb479384466d828d65637814bee6b26d7
CVE ID: CVE-2024-46775 State: PUBLISHED Published: 2024-09-18T07:12:32.506Z Last Updated: 2025-07-11T17:20:29.645Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate function returns [WHAT & HOW] Function return values must be checked before data can be used in subsequent functions. This fixes 4 CHECKED_RETURN issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5639a3048c7079803256374204ad55ec52cd0b49 - https://git.kernel.org/stable/c/673f816b9e1e92d1f70e1bf5f21b531e0ff9ad6c
CVE ID: CVE-2024-46776 State: PUBLISHED Published: 2024-09-18T07:12:33.315Z Last Updated: 2025-07-11T17:20:31.235Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Run DC_LOG_DC after checking link->link_enc [WHAT] The DC_LOG_DC should be run after link->link_enc is checked, not before. This fixes 1 REVERSE_INULL issue reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/874e3bb302f97b94ac548959ec4f925b8e7b45e2 - https://git.kernel.org/stable/c/adc74d25cdbba978afbb57caec23bbcd0329f7b8 - https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd1
l.org/stable/c/adc74d25cdbba978afbb57caec23bbcd0329f7b8 - https://git.kernel.org/stable/c/3a82f62b0d9d7687eac47603bb6cd14a50fa718b
CVE ID: CVE-2024-46777 State: PUBLISHED Published: 2024-09-18T07:12:34.315Z Last Updated: 2025-11-03T22:18:17.885Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udf: Avoid excessive partition lengths Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition length is so large we cannot safely index bits in a block bitmap. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c0c23130d38e8bc28e9ef581443de9b1fc749966 - https://git.kernel.org/stable/c/1497a4484cdb2cf6c3796
git.kernel.org/stable/c/c0c23130d38e8bc28e9ef581443de9b1fc749966 - https://git.kernel.org/stable/c/1497a4484cdb2cf6c37960d788fb6ba67567bdb7 - https://git.kernel.org/stable/c/551966371e17912564bc387fbeb2ac13077c3db1 - https://git.kernel.org/stable/c/2ddf831451357c6da4b64645eb797c93c1c054d1 - https://git.kernel.org/stable/c/0173999123082280cf904bd640015951f194a294 - https://git.kernel.org/stable/c/a56330761950cb83de1dfb348479f20c56c95f90 - https://git.kernel.org/stable/c/925fd8ee80d5348a5e965548e5484d164d19221d - https://git.kernel.org/stable/c/ebbe26fd54a9621994bc16b14f2ba8f84c089693
CVE ID: CVE-2024-46778 State: PUBLISHED Published: 2024-09-18T07:12:35.052Z Last Updated: 2025-05-04T09:34:05.102Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check UnboundedRequestEnabled's value CalculateSwathAndDETConfiguration_params_st's UnboundedRequestEnabled is a pointer (i.e. dml_bool_t *UnboundedRequestEnabled), and thus if (p->UnboundedRequestEnabled) checks its address, not bool value. This fixes 1 REVERSE_INULL issue reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4e2b49a85e7974d21364798c5d4aa8070aa864d9 - https://git.kernel.
lnrichment: References: - https://git.kernel.org/stable/c/4e2b49a85e7974d21364798c5d4aa8070aa864d9 - https://git.kernel.org/stable/c/a7b38c7852093385d0605aa3c8a2efd6edd1edfd
CVE ID: CVE-2024-46779 State: PUBLISHED Published: 2024-09-18T07:12:35.856Z Last Updated: 2025-05-04T09:34:06.367Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Free pvr_vm_gpuva after unlink This caused a measurable memory leak. Although the individual allocations are small, the leaks occurs in a high-usage codepath (remapping or unmapping device memory) so they add up quickly. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1cc695be8920df234f83270d789078cb2d3bc564 - https://git.kernel.org/stable/c/3f6b2f60b4631cd0c368da6a1587ab55a696164d
CVE ID: CVE-2024-46780 State: PUBLISHED Published: 2024-09-18T07:12:36.736Z Last Updated: 2025-11-03T22:18:20.810Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect references to superblock parameters exposed in sysfs The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regularly swapped, replaced during resizing, and even abandoned when degrading to one side due to backing device issues. So, accessing them requires mutual exclusion using the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without
sing the reader/writer semaphore "nilfs->ns_sem". Some sysfs attribute show methods read this superblock buffer without the necessary mutual exclusion, which can cause problems with pointer dereferencing and memory access, so fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b90beafac05931cbfcb6b1bd4f67c1923f47040e - https://git.kernel.org/stable/c/ba97ba173f9625d5f34a986088979eae8b80d38e - https://git.kernel.org/stable/c/157c0d94b4c40887329418c70ef4edd1a8d6b4ed - https://git.kernel.org/stable/c/b14e7260bb691d7f563f61da07d61e3c8b59a614 - https://git.kernel.org/stable/c/19cfeba0e4b8eda51484fcf8cf7d150418e1d880 - h
/b14e7260bb691d7f563f61da07d61e3c8b59a614 - https://git.kernel.org/stable/c/19cfeba0e4b8eda51484fcf8cf7d150418e1d880 - https://git.kernel.org/stable/c/8c6e43b3d5f109cf9c61bc188fcc8175404e924f - https://git.kernel.org/stable/c/962562d4c70c5cdeb4e955d63ff2017c4eca1aad - https://git.kernel.org/stable/c/683408258917541bdb294cd717c210a04381931e
CVE ID: CVE-2024-46781 State: PUBLISHED Published: 2024-09-18T07:12:37.603Z Last Updated: 2025-11-03T22:18:23.818Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recovery was performed using partial logs created by dsync writes, but an error occurred before starting the log writer to create a recovered checkpoint, the inodes whose data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by
e data had been recovered were left in the ns_dirty_files list of the nilfs object and were not freed. Fix this issue by cleaning up inodes that have read the recovery data if the recovery routine fails midway before the log writer starts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/35a9a7a7d94662146396199b0cfd95f9517cdd14 - https://git.kernel.org/stable/c/da02f9eb333333b2e4f25d2a14967cff785ac82e - https://git.kernel.org/stable/c/07e4dc2fe000ab008bcfe90be4324ef56b5b4355 - https://git.kernel.org/stable/c/8e2d1e9d93c4ec51354229361ac3373058529ec4 - https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c80
able/c/8e2d1e9d93c4ec51354229361ac3373058529ec4 - https://git.kernel.org/stable/c/ca92c4bff2833cb30d493b935168d6cccd5c805d - https://git.kernel.org/stable/c/9d8c3a585d564d776ee60d4aabec59b404be7403 - https://git.kernel.org/stable/c/1cf1f7e8cd47244fa947d357ef1f642d91e219a3 - https://git.kernel.org/stable/c/5787fcaab9eb5930f5378d6a1dd03d916d146622
CVE ID: CVE-2024-46782 State: PUBLISHED Published: 2024-09-18T07:12:38.652Z Last Updated: 2025-11-03T22:18:26.768Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks(). It should be done in the reverse way, with a synchronize_rcu(). This is a good match for a pre_exit() method. [1] BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:
fn include/linux/rhashtable.h:159 [inline] BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline] BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline] BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 Read of size 4 at addr ffff888064620008 by task ksoftirqd/0/16 CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.11.0-rc4-syzkaller-00238-g2ad6d23f465a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description
ASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup include/linux/rhashtable.h:604 [inline] rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 nf_hook_entry_hookfn include/linux/netfilter.h:154 [i
:652 [inline] ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5775 process_backlog+0x662/0x15b0 net/core/dev.c:6108 __napi_poll+0xcb/0x490 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6963 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot
c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x64620 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: 0xbfffffff(buddy) raw: 00fff00000000000 ffffea0000959608 ffffea00019d9408 0000000000000000 raw: 0000000000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner
0000000000 0000000000000003 00000000bfffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52dc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 5242, tgid 5242 (syz-executor), ts 73611328570, free_ts 618981657187 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3439 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof incl
0x256/0x6c0 mm/page_alloc.c:4695 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] ___kmalloc_large_node+0x8b/0x1d0 mm/slub.c:4103 __kmalloc_large_node_noprof+0x1a/0x80 mm/slub.c:4130 __do_kmalloc_node mm/slub.c:4146 [inline] __kmalloc_node_noprof+0x2d2/0x440 mm/slub.c:4164 __kvmalloc_node_noprof+0x72/0x190 mm/util.c:650 bucket_table_alloc lib/rhashtable.c:186 [inline] rhashtable_init_noprof+0x534/0xa60 lib/rhashtable.c:1071 ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613 ops_ini ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/43
tional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/43d34110882b97ba1ec66cc8234b18983efb9abf - https://git.kernel.org/stable/c/dcaf4e2216824839d26727a15b638c6a677bd9fc - https://git.kernel.org/stable/c/93ee345ba349922834e6a9d1dadabaedcc12dce6 - https://git.kernel.org/stable/c/bda4d84ac0d5421b346faee720011f58bdb99673 - https://git.kernel.org/stable/c/925c18a7cff93d8a4320d652351294ff7d0ac93c - https://git.kernel.org/stable/c/18a5a16940464b301ea91bf5da3a324aedb347b2 - https://git.kernel.org/stable/c/47abd8adddbc0aecb8f231269ef659148d5dabe4 - https://git.kernel.org/stable/c/031ae72825cef43e4650140b800ad58bf7a6a466
CVE ID: CVE-2024-46783 State: PUBLISHED Published: 2024-09-18T07:12:39.573Z Last Updated: 2025-11-03T22:18:29.717Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES;
msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES; Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here. ------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_
0009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_nosec net/socket.c:728 [inline] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [inline] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 000