Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
: trigger kernel panic When we try to repair i_current_depth in readonly filesystem, let's skip dirty inode to avoid panic in later f2fs_evict_inode(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2d2916516577f2239b3377d9e8d12da5e6ccdfcf - https://git.kernel.org/stable/c/54162974aea37a8cae00742470a78c7f6bd6f915 - https://git.kernel.org/stable/c/54bc4e88447e385c4d4ffa85d93e0dce628fcfa6 - https://git.kernel.org/stable/c/ec56571b4b146a1cfbedab49d5fcaf19fe8bf4f1 - https://git.kernel.org/stable/c/9ce8135accf103f7333af472709125878704fdd4 - https://git.kernel.org/stable/c/e62ff092a42f4a1bae3b310cf46673b4f3aac3b5 - https:/
35accf103f7333af472709125878704fdd4 - https://git.kernel.org/stable/c/e62ff092a42f4a1bae3b310cf46673b4f3aac3b5 - https://git.kernel.org/stable/c/2434344559f6743efb3ac15d11af9a0db9543bd3 - https://git.kernel.org/stable/c/192b8fb8d1c8ca3c87366ebbef599fa80bb626b8
CVE ID: CVE-2024-42298 State: PUBLISHED Published: 2024-08-17T09:09:05.866Z Last Updated: 2025-05-04T09:26:14.835Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl_qmc_audio: Check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked. Fix this lack and check the returned value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b4205dfcfe96182118e54343954827eda51b2135 - https://git.kernel.org/stable/c/af466037fa2b263e8ea5c47285513d2487e17d90 - https://git.kernel.org/stable/c/e62599902327d27687693f6e
.kernel.org/stable/c/af466037fa2b263e8ea5c47285513d2487e17d90 - https://git.kernel.org/stable/c/e62599902327d27687693f6e5253a5d56583db58
CVE ID: CVE-2024-42299 State: PUBLISHED Published: 2024-08-17T09:09:06.570Z Last Updated: 2025-11-03T22:03:59.953Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will change in log_replay(), but log->page_{mask,bits} don't change correspondingly. This will cause a panic because "u32 bytes = log->page_size - page_off" will get a negative value in the later read_log_page(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: R
gative value in the later read_log_page(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0484adcb5fbcadd9ba0fd4485c42630f72e97da9 - https://git.kernel.org/stable/c/b90ceffdc975502bc085ce8e79c6adeff05f9521 - https://git.kernel.org/stable/c/2cac0df3324b5e287d8020bc0708f7d2dec88a6f - https://git.kernel.org/stable/c/0a4ae2644e2a3b3b219aad9639fb2b0691d08420 - https://git.kernel.org/stable/c/2fef55d8f78383c8e6d6d4c014b9597375132696
CVE ID: CVE-2024-42300 State: PUBLISHED Published: 2024-08-17T09:09:07.311Z Last Updated: 2025-05-04T09:26:17.567Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: fix race in z_erofs_get_gbuf() In z_erofs_get_gbuf(), the current task may be migrated to another CPU between `z_erofs_gbuf_id()` and `spin_lock(&gbuf->lock)`. Therefore, z_erofs_put_gbuf() will trigger the following issue which was found by stress test: <2>[772156.434168] kernel BUG at fs/erofs/zutil.c:58! .. <4>[772156.435007] <4>[772156.439237] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cl
37] CPU: 0 PID: 3078 Comm: stress Kdump: loaded Tainted: G E 6.10.0-rc7+ #2 <4>[772156.439239] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 1.0.0 01/01/2017 <4>[772156.439241] pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) <4>[772156.439243] pc : z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.439252] lr : z_erofs_lz4_decompress+0x600/0x6a0 [erofs] .. <6>[772156.445958] stress (3127): drop_caches: 1 <4>[772156.446120] Call trace: <4>[772156.446121] z_erofs_put_gbuf+0x64/0x70 [erofs] <4>[772156.446761] z_erofs_lz4_decompress+0x600/0x6a0 [erofs] <4>[772156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772
156.446897] z_erofs_decompress_queue+0x740/0xa10 [erofs] <4>[772156.447036] z_erofs_runqueue+0x428/0x8c0 [erofs] <4>[772156.447160] z_erofs_readahead+0x224/0x390 [erofs] .. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49b22e06a947727a6d1c802d2d9ad92420b90fc5 - https://git.kernel.org/stable/c/7dc5537c3f8be87e005f0844a7626c987914f8fd
CVE ID: CVE-2024-42301 State: PUBLISHED Published: 2024-08-17T09:09:08.057Z Last Updated: 2025-11-03T22:04:02.977Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered during the actual issue: [ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID:
nel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport] [ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm: QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2 [ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp [ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024 [ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace: [ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0 [ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20 [ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid
:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c [ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc [ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38 [ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/166a0bddcc27de41fe13f861c8348e8e53e988c8 - https://git.kernel.org/stable/c/47b3dce100778001cd76f7e9188944b5cb27a76d - https://git.kernel.org/stable/c/a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0 - https://git.kernel.org/stable/c/c719b393374d3763e64900ee19aaed767d5a08d6 - https://git.kernel.org/stable/c/7f4da759092a1a6ce35fb085182
rnel.org/stable/c/c719b393374d3763e64900ee19aaed767d5a08d6 - https://git.kernel.org/stable/c/7f4da759092a1a6ce35fb085182d02de8cc4cc84 - https://git.kernel.org/stable/c/b579ea3516c371ecf59d073772bc45dfd28c8a0e - https://git.kernel.org/stable/c/7789a1d6792af410aa9b39a1eb237ed24fa2170a - https://git.kernel.org/stable/c/ab11dac93d2d568d151b1918d7b84c2d02bacbd5
CVE ID: CVE-2024-42302 State: PUBLISHED Published: 2024-08-17T09:09:08.891Z Last Updated: 2025-11-03T22:04:06.070Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event occurred. To do so, it polls the config space of the first child device on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel
ice on the secondary bus. If that child device is concurrently removed, accesses to its struct pci_dev cause the kernel to oops. That's because pci_bridge_wait_for_secondary_bus() neglects to hold a reference on the child device. Before v6.3, the function was only called on resume from system sleep or on runtime resume. Holding a reference wasn't necessary back then because the pciehp IRQ thread could never run concurrently. (On resume from system sleep, IRQs are not enabled until after the resume_noirq phase. And runtime resume is always awaited before a PCI device is removed.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de
ved.) However starting with v6.3, pci_bridge_wait_for_secondary_bus() is also called on a DPC event. Commit 53b54ad074de ("PCI/DPC: Await readiness of secondary bus after reset"), which introduced that, failed to appreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a reference on the child device because dpc_handler() and pciehp may indeed run concurrently. The commit was backported to v5.10+ stable kernels, so that's the oldest one affected. Add the missing reference acquisition. Abridged stack trace: BUG: unable to handle page fault for address: 00000000091400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge
91400c0 CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0 RIP: pci_bus_read_config_dword+0x17/0x50 pci_dev_wait() pci_bridge_wait_for_secondary_bus() dpc_reset_link() pcie_do_recovery() dpc_handler() Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c52f9e1a9eb40f13993142c331a6cfd334d4b91d - https://git.kernel.org/stable/c/2c111413f38ca5cf87557cab89f6d82b0e3433e7 - https://git.kernel.org/stable/c/f63df70b439bb8331358a306541893bf415bf1da - https://git.kernel.org/stable/c/2cc8973bdc4d6c928ebe38b88090a2cdfe81f42f - https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62 - https://git.kernel.org/stable/c/11a1f4b
42f - https://git.kernel.org/stable/c/b16f3ea1db47a6766a9f1169244cf1fc287a7c62 - https://git.kernel.org/stable/c/11a1f4bc47362700fcbde717292158873fb847ed
CVE ID: CVE-2024-42303 State: PUBLISHED Published: 2024-08-17T09:09:09.884Z Last Updated: 2025-05-04T09:26:21.134Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: imx-pxp: Fix ERR_PTR dereference in pxp_probe() devm_regmap_init_mmio() can fail, add a check and bail out in case of error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/358bc85269d6a359fea597ef9fbb429cd3626e08 - https://git.kernel.org/stable/c/5ab6ac4e9e165b0fe8a326308218337007224f05 - https://git.kernel.org/stable/c/57e9ce68ae98551da9c161aaab12b41fe8601856
CVE ID: CVE-2024-42304 State: PUBLISHED Published: 2024-08-17T09:09:10.545Z Last Updated: 2025-11-03T22:04:09.091Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hol
4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe - https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa - https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136 - https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a - https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac - https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5 - https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1 - https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6
CVE ID: CVE-2024-42305 State: PUBLISHED Published: 2024-08-17T09:09:11.296Z Last Updated: 2025-11-03T22:04:12.008Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: ffffed11022e24fe PGD 23ffee067 P4D 23ffee067 PUD 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/na
e689933 #0 Call Trace: <TASK> make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451 ext4_rename fs/ext4/namei.c:3936 [inline] ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214 [...] ============================================ The immediate cause of this problem is that there is only one valid dentry for the block to be split during do_split, so split==0 results in out of bounds accesses to the map triggering the issue. do_split unsigned split dx_make_map count = 1 split = count/2 = 0; continued = hash2 == map[split - 1].hash; ---> map[4294967295] The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guarantee
-> map[4294967295] The maximum length of a filename is 255 and the minimum block size is 1024, so it is always guaranteed that the number of entries is greater than or equal to 2 when do_split() is called. But syzbot's crafted image has no dot and dotdot in dir, and the dentry distribution in dirblock is as follows: bus dentry1 hole dentry2 free |xx--|xx-------------|...............|xx-------------|...............| 0 12 (8+248)=256 268 256 524 (8+256)=264 788 236 1024 So when renaming dentry1 increases its name_len length by 1, neither hole nor free is sufficient to hold the new dentry, and make_indexed_dir() is called. In make_indexed_dir() it is assumed that the first two entries of the di
e new dentry, and make_indexed_dir() is called. In make_indexed_dir() it is assumed that the first two entries of the dirblock must be dot and dotdot, so bus and dentry1 are left in dx_root because they are treated as dot and dotdot, and only dentry2 is moved to the new leaf block. That's why count is equal to 1. Therefore add the ext4_check_dx_root() helper function to add more sanity checks to dot and dotdot before starting the conversion to avoid the above issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db - https://git.kernel.org/stable/c/19e13b4d7f0303186fcc891aba8d0de7
org/stable/c/b80575ffa98b5bb3a5d4d392bfe4c2e03e9557db - https://git.kernel.org/stable/c/19e13b4d7f0303186fcc891aba8d0de7c8fdbda8 - https://git.kernel.org/stable/c/42d420517072028fb0eb852c358056b7717ba5aa - https://git.kernel.org/stable/c/8afe06ed3be7a874b3cd82ef5f8959aca8d6429a - https://git.kernel.org/stable/c/abb411ac991810c0bcbe51c2e76d2502bf611b5c - https://git.kernel.org/stable/c/9d241b7a39af192d1bb422714a458982c7cc67a2 - https://git.kernel.org/stable/c/cdd345321699042ece4a9d2e70754d2397d378c5 - https://git.kernel.org/stable/c/50ea741def587a64e08879ce6c6a30131f7111e7
CVE ID: CVE-2024-42306 State: PUBLISHED Published: 2024-08-17T09:09:11.938Z Last Updated: 2025-11-03T22:04:14.937Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the next allocation from the same bitmap will notice the bitmap buffer is already loaded and tries to allocate from the bitmap with mixed results (depending on the exact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid
xact nature of the bitmap corruption). Fix the problem by using BH_verified bit to indicate whether the bitmap is valid or not. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cae9e59cc41683408b70b9ab569f8654866ba914 - https://git.kernel.org/stable/c/2199e157a465aaf98294d3932797ecd7fce942d5 - https://git.kernel.org/stable/c/6a43e3c210df6c5f00570f4be49a897677dbcb64 - https://git.kernel.org/stable/c/271cab2ca00652bc984e269cf1208699a1e09cdd - https://git.kernel.org/stable/c/57053b3bcf3403b80db6f65aba284d7dfe7326af - https://git.kernel.org/stable/c/8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65 - https://git.kernel.org/stable/c/
7dfe7326af - https://git.kernel.org/stable/c/8ca170c39eca7cad6e0cfeb24e351d8f8eddcd65 - https://git.kernel.org/stable/c/a90d4471146de21745980cba51ce88e7926bcc4f
CVE ID: CVE-2024-42307 State: PUBLISHED Published: 2024-08-17T09:09:12.613Z Last Updated: 2025-11-03T22:04:16.392Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential null pointer use in destroy_workqueue in init_cifs error path Dan Carpenter reported a Smack static checker warning: fs/smb/client/cifsfs.c:1981 init_cifs() error: we previously assumed 'serverclose_wq' could be null (see line 1895) The patch which introduced the serverclose workqueue used the wrong oredering in error paths in init_cifs() for freeing it on errors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References
_cifs() for freeing it on errors. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6018971710fdc7739f8655c1540832b4bb903671 - https://git.kernel.org/stable/c/160235efb4f9b55212dedff5de0094c606c4b303 - https://git.kernel.org/stable/c/3739d711246d8fbc95ff73dbdace9741cdce4777 - https://git.kernel.org/stable/c/193cc89ea0ca1da311877d2b4bb5e9f03bcc82a2
CVE ID: CVE-2024-42308 State: REJECTED Published: 2024-08-17T09:09:13.467Z Last Updated: 2024-10-09T13:57:37.908Z Description: No description available.
CVE ID: CVE-2024-42309 State: PUBLISHED Published: 2024-08-17T09:09:14.164Z Last Updated: 2025-11-03T22:04:21.161Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/13b5f3ee94bdbdc4b5f40582aab62977905aedee - https://git.kernel.org/stable
: References: - https://git.kernel.org/stable/c/13b5f3ee94bdbdc4b5f40582aab62977905aedee - https://git.kernel.org/stable/c/d6ad202f73f8edba0cbc0065aa57a79ffe8fdcdc - https://git.kernel.org/stable/c/6735d02ead7dd3adf74eb8b70aebd09e0ce78ec9 - https://git.kernel.org/stable/c/7e52c62ff029f95005915c0a11863b5fb5185c8c - https://git.kernel.org/stable/c/f70ffeca546452d1acd3a70ada56ecb2f3e7f811 - https://git.kernel.org/stable/c/46d2ef272957879cbe30a884574320e7f7d78692 - https://git.kernel.org/stable/c/475a5b3b7c8edf6e583a9eb59cf28ea770602e14 - https://git.kernel.org/stable/c/2df7aac81070987b0f052985856aa325a38debf6
CVE ID: CVE-2024-42310 State: PUBLISHED Published: 2024-08-17T09:09:14.820Z Last Updated: 2025-11-03T22:04:24.097Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f392c36cebf4c1d6997a4cc2c0f205254acef42a - https://git.kernel.org/stable/c/a658ae
ces: - https://git.kernel.org/stable/c/f392c36cebf4c1d6997a4cc2c0f205254acef42a - https://git.kernel.org/stable/c/a658ae2173ab74667c009e2550455e6de5b33ddc - https://git.kernel.org/stable/c/b6ac46a00188cde50ffba233e6efb366354a1de5 - https://git.kernel.org/stable/c/08f45102c81ad8bc9f85f7a25e9f64e128edb87d - https://git.kernel.org/stable/c/e74eb5e8089427c8c49e0dd5067e5f39ce3a4d56 - https://git.kernel.org/stable/c/2d209b2f862f6b8bff549ede541590a8d119da23 - https://git.kernel.org/stable/c/977ee4fe895e1729cd36cc26916bbb10084713d6 - https://git.kernel.org/stable/c/cb520c3f366c77e8d69e4e2e2781a8ce48d98e79
CVE ID: CVE-2024-42311 State: PUBLISHED Published: 2024-08-17T09:09:15.793Z Last Updated: 2025-11-03T22:04:27.025Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [i
sdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs
yscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x