Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
scall_64+0x7f/0x180 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7be9f211c574 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007ffd26f2b8c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00005d504415e200 RCX: 00007be9f211c574 RDX: 0000000000001fc1 RSI: 00005d504418bc80 RDI: 0000000000000004 RBP: 0000000000001fc1 R08: 0000000000001fc1 R09: 0000000080000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00005d504418bc80 R13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30 </TASK> Modul
: 0000000000000202 R12: 00005d504418bc80 R13: 0000000000000004 R14: 00007ffd26f2b9b0 R15: 00007ffd26f2ba30 </TASK> Modules linked in: snd_seq_dummy snd_hrtimer qrtr snd_hda_codec_generic snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device i2c_i801 snd_timer i2c_smbus qxl snd soundcore drm_ttm_helper lpc_ich ttm joydev input_leds serio_raw mac_hid binfmt_misc msr parport_pc ppdev lp parport efi_pstore nfnetlink dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas CR2: 0000000000000030 ---[ end trace 000000000
eric usbhid hid ahci libahci psmouse virtio_rng xhci_pci xhci_pci_renesas CR2: 0000000000000030 ---[ end trace 0000000000000000 ]--- RIP: 0010:aafs_create.constprop.0+0x7f/0x130 Code: 4c 63 e0 48 83 c4 18 4c 89 e0 5b 41 5c 41 5d 41 5e 41 5f 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 45 31 d2 c3 cc cc cc cc <4d> 8b 55 30 4d 8d ba a0 00 00 00 4c 89 55 c0 4c 89 ff e8 7a 6a ae RSP: 0018:ffffc9000b2c7c98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000041ed RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000b2c7cd8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - C
0000000000000000 R09: 0000000000000000 R10: 0000 ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8d9da10a392a32368392f7a16775e1f36e2a5346 - https://git.kernel.org/stable/c/730ee2686af0d55372e97a2695005ff142702363 - https://git.kernel.org/stable/c/52338a3aa772762b8392ce7cac106c1099aeab85 - https://git.kernel.org/stable/c/e3c7d23f7a5c0b11ba0093cea32261ab8098b94e - https://git.kernel.org/stable/c/09b2d107fe63e55b6ae643f9f26bf8eb14a261d9 - https://git.kernel.org/stable/c/59f742e55a469ef36c5c1533b6095a103b61eda8 - https://git.kernel.org/stable/c/c49bbe69ee152bd9c1c1f314c0f582e76c578f64 - https://git.kernel.
c5c1533b6095a103b61eda8 - https://git.kernel.org/stable/c/c49bbe69ee152bd9c1c1f314c0f582e76c578f64 - https://git.kernel.org/stable/c/3dd384108d53834002be5630132ad5c3f32166ad
CVE ID: CVE-2024-46722 State: PUBLISHED Published: 2024-09-18T06:32:19.975Z Last Updated: 2025-11-03T22:16:59.987Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mc_data out-of-bounds read warning Clear warning that read mc_data[i-1] may out-of-bounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5fa4df25ecfc7b6c9006f5b871c46cfe25ea8826 - https://git.kernel.org/stable/c/2097edede72ec5bb3869cf0205337d392fb2a553 - https://git.kernel.org/stable/c/310b9d8363b88e818afec97ca7652bd7fe3d0650 - https://git.kernel.org/stable/c/345bd3ad387f9e121aa
//git.kernel.org/stable/c/310b9d8363b88e818afec97ca7652bd7fe3d0650 - https://git.kernel.org/stable/c/345bd3ad387f9e121aaad9c95957b80895e2f2ec - https://git.kernel.org/stable/c/b862a0bc5356197ed159fed7b1c647e77bc9f653 - https://git.kernel.org/stable/c/d0a43bf367ed640e527e8ef3d53aac1e71f80114 - https://git.kernel.org/stable/c/578ae965e8b90cd09edeb0252b50fa0503ea35c5 - https://git.kernel.org/stable/c/51dfc0a4d609fe700750a62f41447f01b8c9ea50
CVE ID: CVE-2024-46723 State: PUBLISHED Published: 2024-09-18T06:32:20.619Z Last Updated: 2025-11-03T22:17:02.976Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode[] may out-of-bounds. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/82ac8f1d02886b5d8aeb9e058989d3bd6fc581e2 - https://git.kernel.org/stable/c/e789e05388854a5436b2b5d8695fdb864c9bcc27 - https://git.kernel.org/stable/c/5f09fa5e0ad45fbca71933a0e024ca52da47d59b - https://git.kernel.org/stable/c/0bef65e069d84d1cd77ce757ae
ernel.org/stable/c/5f09fa5e0ad45fbca71933a0e024ca52da47d59b - https://git.kernel.org/stable/c/0bef65e069d84d1cd77ce757aea0e437b8e2bd33 - https://git.kernel.org/stable/c/8981927ebc6c12fa76b30c4178acb462bab15f54 - https://git.kernel.org/stable/c/f2b7a9f3839e92f43559b2795b34640ca8cf839f - https://git.kernel.org/stable/c/23fefef859c6057e6770584242bdd938254f8ddd - https://git.kernel.org/stable/c/8944acd0f9db33e17f387fdc75d33bb473d7936f
CVE ID: CVE-2024-46724 State: PUBLISHED Published: 2024-09-18T06:32:21.220Z Last Updated: 2025-11-03T22:17:05.906Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Check the fb_channel_number range to avoid the array out-of-bounds read error Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/725b728cc0c8c5fafdfb51cb0937870d33a40fa4 - https://git.kernel.org/stable/c/45f7b02afc464c208e8f56bcbc672ef5c364c815 - https://git.kernel.org/stable/c/32915dc909ff502823babfe07d5416c5b6e8a8b1 - https://git.kernel.
e8f56bcbc672ef5c364c815 - https://git.kernel.org/stable/c/32915dc909ff502823babfe07d5416c5b6e8a8b1 - https://git.kernel.org/stable/c/f9267972490f9fcffe146e79828e97acc0da588c - https://git.kernel.org/stable/c/db7a86676fd624768a5d907faf34ad7bb4ff25f4 - https://git.kernel.org/stable/c/d768394fa99467bcf2703bde74ddc96eeb0b71fa
CVE ID: CVE-2024-46725 State: PUBLISHED Published: 2024-09-18T06:32:22.423Z Last Updated: 2025-11-03T22:17:08.917Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-bounds write warning Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c253b87c7c37ec40a2e0c84e4a6b636ba5cd66b2 - https://git.kernel.org/stable/c/919f9bf9997b8dcdc132485ea96121e7d15555f9 - https://git.kernel.org/stable/c/cf2db220b38301b6486a0f11da24a0f317de558c - https://git.kernel.org/stable/c/a60d1f7ff62e453dd
s://git.kernel.org/stable/c/cf2db220b38301b6486a0f11da24a0f317de558c - https://git.kernel.org/stable/c/a60d1f7ff62e453dde2d3b4907e178954d199844 - https://git.kernel.org/stable/c/130bee397b9cd52006145c87a456fd8719390cb5 - https://git.kernel.org/stable/c/be1684930f5262a622d40ce7a6f1423530d87f89
CVE ID: CVE-2024-46726 State: PUBLISHED Published: 2024-09-18T06:32:23.094Z Last Updated: 2025-11-03T22:17:10.362Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure index calculation will not overflow [WHY & HOW] Make sure vmid0p72_idx, vnom0p8_idx and vmax0p9_idx calculation will never overflow and exceess array size. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/733ae185502d30bbe79575167b6178cfb6c5d6bd - https://git.kernel.org/stable/c/3dc6bb57dab36b38b7374af
t.kernel.org/stable/c/733ae185502d30bbe79575167b6178cfb6c5d6bd - https://git.kernel.org/stable/c/3dc6bb57dab36b38b7374af0ac916174c146b6ed - https://git.kernel.org/stable/c/d705b5869f6b1b46ad5ceb1bd2a08c04f7e5003b - https://git.kernel.org/stable/c/8e2734bf444767fed787305ccdcb36a2be5301a2
CVE ID: CVE-2024-46727 State: PUBLISHED Published: 2024-09-18T06:32:23.680Z Last Updated: 2025-07-11T17:20:21.529Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add otg_master NULL check within resource_log_pipe_topology_update [Why] Coverity reports NULL_RETURN warning. [How] Add otg_master NULL check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/aad4d3d3d3b6a362bf5db11e1f28c4a60620900d - https://git.kernel.org/stable/c/871cd9d881fa791d3f82885000713de07041c0ae
CVE ID: CVE-2024-46728 State: PUBLISHED Published: 2024-09-18T06:32:24.274Z Last Updated: 2025-07-11T17:20:22.939Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index for aux_rd_interval before using aux_rd_interval has size of 7 and should be checked. This fixes 3 OVERRUN and 1 INTEGER_OVERFLOW issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/48e0b68e2360b16edf2a0bae05c0051c00fbb48a - https://git.kernel.org/stable/c/6c588e9350dd7a9fb97a56fe74852c9ecc44450c - https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d30
able/c/6c588e9350dd7a9fb97a56fe74852c9ecc44450c - https://git.kernel.org/stable/c/9ba2ea6337b4f159aecb177555a6a81da92d302e
CVE ID: CVE-2024-46729 State: PUBLISHED Published: 2024-09-18T06:32:24.867Z Last Updated: 2025-07-11T17:20:24.086Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix incorrect size calculation for loop [WHY] fe_clk_en has size of 5 but sizeof(fe_clk_en) has byte size 20 which is lager than the array size. [HOW] Divide byte size 20 by its element size. This fixes 2 OVERRUN issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/712be65b3b372a82bff0865b9c090147764bf1c4 - https://git.kernel.org/stable/c/3941a3aa4b653b69876d894d08f3fff1cc965267
CVE ID: CVE-2024-46730 State: PUBLISHED Published: 2024-09-18T06:32:25.524Z Last Updated: 2025-07-11T17:20:25.202Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Ensure array index tg_inst won't be -1 [WHY & HOW] tg_inst will be a negative if timing_generator_count equals 0, which should be checked before used. This fixes 2 OVERRUN issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a64284b9e1999ad5580debced4bc6d6adb28aad4 - https://git.kernel.org/stable/c/687fe329f18ab0ab0496b20ed2cb003d4879d931
CVE ID: CVE-2024-46731 State: PUBLISHED Published: 2024-09-18T06:32:26.145Z Last Updated: 2025-11-03T22:17:13.287Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix the Out-of-bounds read warning using index i - 1U may beyond element index for mc_data[] when i = 0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/38e32a0d837443c91c4b615a067b976cfb925376 - https://git.kernel.org/stable/c/3317966efcdc5101e93db21514b68917e7eb34ea - https://git.kernel.org/stable/c/20c6373a6be93039f9d66029bb1e21038a060be1 - https://git.kernel.org/stable/c/f1e261ced
a - https://git.kernel.org/stable/c/20c6373a6be93039f9d66029bb1e21038a060be1 - https://git.kernel.org/stable/c/f1e261ced9bcad772a45a2fcdf413c3490e87299 - https://git.kernel.org/stable/c/d83fb9f9f63e9a120bf405b078f829f0b2e58934 - https://git.kernel.org/stable/c/12c6967428a099bbba9dfd247bb4322a984fcc0b
CVE ID: CVE-2024-46732 State: PUBLISHED Published: 2024-09-18T06:32:26.798Z Last Updated: 2025-11-03T22:17:14.763Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign linear_pitch_alignment even for VM [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4bd7710f2fecfc5fb2dda1ca2adc69db8a66b8b6 - https://git.kernel.org/stable/c/d219f902b16d42f0cb8c499ea8f31cf3c0f36349 - https://git.kernel.org/stable/c/d2fe7ac613a1ea8c346c9f5c89dc6ecc27232997
e/c/d219f902b16d42f0cb8c499ea8f31cf3c0f36349 - https://git.kernel.org/stable/c/d2fe7ac613a1ea8c346c9f5c89dc6ecc27232997 - https://git.kernel.org/stable/c/c44b568931d23aed9d37ecbb31fb5fbdd198bf7b - https://git.kernel.org/stable/c/984debc133efa05e62f5aa1a7a1dd8ca0ef041f4
CVE ID: CVE-2024-46733 State: PUBLISHED Published: 2024-09-18T06:32:27.453Z Last Updated: 2025-11-03T19:30:59.772Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix qgroup reserve leaks in cow_file_range In the buffered write path, the dirty page owns the qgroup reserve until it creates an ordered_extent. Therefore, any errors that occur before the ordered_extent is created must free that reservation, or else the space is leaked. The fstest generic/475 exercises various IO error paths, and is able to trigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear d
rigger errors in cow_file_range where we fail to get to allocating the ordered extent. Note that because we *do* clear delalloc, we are likely to remove the inode from the delalloc list, so the inodes/pages to not have invalidate/launder called on them in the commit abort path. This results in failures at the unmount stage of the test that look like: BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-i
as unreleased space, type 0 rsv 28672 ------------[ cut here ]------------ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 00000000000000
000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 Call Trace: <TASK> ? close_ctree+0x222/0x4d0 [btrfs] ? __warn.cold+0x8e/0xea ? close_ctree+0x222/0x4d0 [btrfs] ? report_bug+0xff/0x140 ? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] gene
? handle_bug+0x3b/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? close_ctree+0x222/0x4d0 [btrfs] generic_shutdown_super+0x70/0x160 kill_anon_super+0x11/0x40 btrfs_kill_super+0x11/0x20 [btrfs] deactivate_locked_super+0x2e/0xa0 cleanup_mnt+0xb5/0x150 task_work_run+0x57/0x80 syscall_exit_to_user_mode+0x121/0x130 do_syscall_64+0xab/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f916847a887 ---[ end trace 0000000000000000 ]--- BTRFS error (device dm-8 state EA): qgroup reserved space leaked Cases 2 and 3 in the out_reserve path both pertain to this type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the po
s type of leak and must free the reserved qgroup data. Because it is already an error path, I opted not to handle the possible errors in btrfs_free_qgroup_data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/159f0f61b283ea71e827dd0c18c5dce197de1fa2 - https://git.kernel.org/stable/c/84464db2ec2a55b9313d5f264da196a37ec80994 - https://git.kernel.org/stable/c/e42ef22bc10f0309c0c65d8d6ca8b4127a674b7f - https://git.kernel.org/stable/c/30479f31d44d47ed00ae0c7453d9b253537005b2
CVE ID: CVE-2024-46734 State: PUBLISHED Published: 2024-09-18T07:11:56.361Z Last Updated: 2025-11-03T22:17:16.228Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between direct IO write and fsync when using same fd If we have 2 threads that are using the same file descriptor and one of them is doing direct IO writes while the other is doing fsync, we have a race where we can end up either: 1) Attempt a fsync without holding the inode's lock, triggering an assertion failures when assertions are enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack
enabled; 2) Do an invalid memory access from the fsync task because the file private points to memory allocated on stack by the direct IO task and it may be used by the fsync task after the stack was destroyed. The race happens like this: 1) A user space program opens a file descriptor with O_DIRECT; 2) The program spawns 2 threads using libpthread for example; 3) One of the threads uses the file descriptor to do direct IO writes, while the other calls fsync using the same file descriptor. 4) Call task A the thread doing direct IO writes and task B the thread doing fsyncs; 5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private w
5) Task A does a direct IO write, and at btrfs_direct_write() sets the file's private to an on stack allocated private with the member 'fsync_skip_inode_lock' set to true; 6) Task B enters btrfs_sync_file() and sees that there's a private structure associated to the file which has 'fsync_skip_inode_lock' set to true, so it skips locking the inode's VFS lock; 7) Task A completes the direct IO write, and resets the file's private to NULL since it had no prior private and our private was stack allocated. Then it unlocks the inode's VFS lock; 8) Task B enters btrfs_get_ordered_extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it a
extents_for_logging(), then the assertion that checks the inode's VFS lock is held fails, since task B never locked it and task A has already unlocked it. The stack trace produced is the following: assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ordered-data.c:983! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8 Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e
ni_CFS, BIOS V1.12 07/28/2020 RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs] Code: 50 d6 86 c0 e8 (...) RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246 RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800 RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38 R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800 R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000 FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Tr
: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0 Call Trace: <TASK> ? __die_body.cold+0x14/0x24 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x6a/0x90 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? exc_invalid_op+0x50/0x70 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btr
59b62caee9a] ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a] ? __seccomp_filter+0x31d/0x4f0 __x64_sys_fdatasync+0x4f/0x90 do_syscall_64+0x82/0x160 ? do_futex+0xcb/0x190 ? __x64_sys_futex+0x10e/0x1d0 ? switch_fpu_return+0x4f/0xd0 ? syscall_exit_to_user_mode+0x72/0x220 ? do_syscall_64+0x8e/0x160 ? syscall_exit_to_user_mod ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428c - https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4
org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428c - https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4400292b4 - https://git.kernel.org/stable/c/7b5595f33c3c273613b590892a578d78186bb400 - https://git.kernel.org/stable/c/01681aa609b5f110502f56c4e3b2938efcf4a5bc - https://git.kernel.org/stable/c/cd9253c23aedd61eb5ff11f37a36247cd46faf86
CVE ID: CVE-2024-46735 State: PUBLISHED Published: 2024-09-18T07:11:57.279Z Last Updated: 2025-11-03T22:17:17.698Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ublk_drv: fix NULL pointer dereference in ublk_ctrl_start_recovery() When two UBLK_CMD_START_USER_RECOVERY commands are submitted, the first one sets 'ubq->ubq_daemon' to NULL, and the second one triggers WARN in ublk_queue_reinit() and subsequently a NULL pointer dereference issue. Fix it by adding the check in ublk_ctrl_start_recovery() and return immediately in case of zero 'ub->nr_queues_ready'. BUG: kernel NULL pointer dereference, address: 0000000000000028 RIP: 0
mmediately in case of zero 'ub->nr_queues_ready'. BUG: kernel NULL pointer dereference, address: 0000000000000028 RIP: 0010:ublk_ctrl_start_recovery.constprop.0+0x82/0x180 Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x75/0x170 ? exc_page_fault+0x64/0x140 ? asm_exc_page_fault+0x22/0x30 ? ublk_ctrl_start_recovery.constprop.0+0x82/0x180 ublk_ctrl_uring_cmd+0x4f7/0x6c0 ? pick_next_task_idle+0x26/0x40 io_uring_cmd+0x9a/0x1b0 io_issue_sqe+0x193/0x3f0 io_wq_submit_work+0x9b/0x390 io_worker_handle_work+0x165/0x360 io_wq_worker+0xcb/0x2f0 ? finish_task_switch.isra.0+0x203/0x290 ? finish_task_switch.isra.0+0x203/0x290 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_io_wq_work
/0x290 ? finish_task_switch.isra.0+0x203/0x290 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_io_wq_worker+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ca249435893dda766f3845c15ca77ca5672022d8 - https://git.kernel.org/stable/c/136a29d8112df4ea0a57f9602ddf3579e04089dc - https://git.kernel.org/stable/c/7c890ef60bf417d3fe5c6f7a9f6cef0e1d77f74f - https://git.kernel.org/stable/c/e58f5142f88320a5b1449f96a146f2f24615c5c7