Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43823 State: PUBLISHED Published: 2024-08-17T09:21:43.843Z Last Updated: 2025-11-03T22:05:06.437Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() If IORESOURCE_MEM is not provided in Device Tree due to any error, resource_list_first_type() will return NULL and pci_parse_request_of_pci_ranges() will just emit a warning. This will cause a NULL pointer dereference. Fix this bug by adding NULL return check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment:
k. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bbba48ad67c53feea05936ea1e029dcca8057506 - https://git.kernel.org/stable/c/0a6f1b5fe8ef8268aaa069035639968ceeea0a23 - https://git.kernel.org/stable/c/dbcdd1863ba2ec9b76ec131df25d797709e05597 - https://git.kernel.org/stable/c/a231707a91f323af1e5d9f1722055ec2fc1c7775
CVE ID: CVE-2024-43824 State: PUBLISHED Published: 2024-08-17T09:21:44.483Z Last Updated: 2025-05-04T09:27:05.094Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init() Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remo
edundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/af4ad016abb1632ff7ee598a603
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/af4ad016abb1632ff7ee598a6037952b495e5b80 - https://git.kernel.org/stable/c/5a5095a8bd1bd349cce1c879e5e44407a34dda8a
CVE ID: CVE-2024-43825 State: PUBLISHED Published: 2024-08-17T09:21:45.215Z Last Updated: 2025-05-04T09:27:06.519Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iio: Fix the sorting functionality in iio_gts_build_avail_time_table The sorting in iio_gts_build_avail_time_table is not working as intended. It could result in an out-of-bounds access when the time is zero. Here are more details: 1. When the gts->itime_table[i].time_us is zero, e.g., the time sequence is `3, 0, 1`, the inner for-loop will not terminate and do out-of-bound writes. This is because once `times[j] > new`, the value `new` will be added in the current posi
ate and do out-of-bound writes. This is because once `times[j] > new`, the value `new` will be added in the current position and the `times[j]` will be moved to `j+1` position, which makes the if-condition always hold. Meanwhile, idx will be added one, making the loop keep running without termination and out-of-bound write. 2. If none of the gts->itime_table[i].time_us is zero, the elements will just be copied without being sorted as described in the comment "Sort times from all tables to one and remove duplicates". For more details, please refer to https://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/31ff8464ef540785344994986a010031410f9ff3 - https://git.kernel.org/stable/c/b5046de32fd1532c3f67065197fc1da82f0b5193 - https://git.kernel.org/stable/c/5acc3f971a01be48d5ff4252d8f9cdb87998cdfb
CVE ID: CVE-2024-43826 State: PUBLISHED Published: 2024-08-17T09:21:45.988Z Last Updated: 2025-05-04T09:27:07.687Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs: pass explicit offset/count to trace events nfs_folio_length is unsafe to use without having the folio locked and a check for a NULL ->f_mapping that protects against truncations and can lead to kernel crashes. E.g. when running xfstests generic/065 with all nfs trace points enabled. Follow the model of the XFS trace points and pass in an explіcit offset and length. This has the additional benefit that these values can be more accurate as some of the users touch pa
offset and length. This has the additional benefit that these values can be more accurate as some of the users touch partial folio ranges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/387e6e9d110250946df4d4ebef9c2def5c7a4722 - https://git.kernel.org/stable/c/fada32ed6dbc748f447c8d050a961b75d946055a
CVE ID: CVE-2024-43827 State: PUBLISHED Published: 2024-08-17T09:21:46.698Z Last Updated: 2025-05-04T09:27:08.858Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check before access structs In enable_phantom_plane, we should better check null pointer before accessing various structs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/081ff4c0ef1884ae55f7adb8944efd22e22d8724 - https://git.kernel.org/stable/c/c96140000915b610d86f941450e15ca552de154a
CVE ID: CVE-2024-43828 State: PUBLISHED Published: 2024-08-17T09:21:47.429Z Last Updated: 2025-11-03T22:05:09.355Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039.
an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5ed0496e383cb6de120e56991385dce70bbb87c1 - https://git.kernel.org/stable/c/0619f7750f2b178a1309808832ab20d85e0ad121 - https://git.kernel.org/stable/c/181e63cd595c688194e07332f9944b3a63193de2 - https://git.kernel.org/stable/c/c6e67df64783e99a657ef2b8c834ba2bf54c539c - https://git.kernel
94e07332f9944b3a63193de2 - https://git.kernel.org/stable/c/c6e67df64783e99a657ef2b8c834ba2bf54c539c - https://git.kernel.org/stable/c/81f819c537d29932e4b9267f02411cbc8b355178 - https://git.kernel.org/stable/c/907c3fe532253a6ef4eb9c4d67efb71fab58c706
CVE ID: CVE-2024-43829 State: PUBLISHED Published: 2024-08-17T09:21:48.239Z Last Updated: 2025-11-03T22:05:12.439Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Add check for drm_cvt_mode Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/62ef8d7816c8e4a6088275553818b9afc0ffaa03 - https://git.kernel.org/stable/c/4e87f592a46bb804d8f833da6ce702ae4b55053f - https://git.kernel.org/stable/c/3efe34f95b1ac8c138a46b14ce75956db0d6ee7
ble/c/4e87f592a46bb804d8f833da6ce702ae4b55053f - https://git.kernel.org/stable/c/3efe34f95b1ac8c138a46b14ce75956db0d6ee7c - https://git.kernel.org/stable/c/f28b353c0c6c7831a70ccca881bf2db5e6785cdd - https://git.kernel.org/stable/c/4b1f303bdeceac049e56e4b20eb5280bd9e02f4f - https://git.kernel.org/stable/c/d4c57354a06cb4a77998ff8aa40af89eee30e07b - https://git.kernel.org/stable/c/7bd09a2db0f617377027a2bb0b9179e6959edff3
CVE ID: CVE-2024-43830 State: PUBLISHED Published: 2024-08-17T09:21:48.946Z Last Updated: 2025-11-03T22:05:15.405Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate() Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the activate() callback and freed by the deactivate() callback. Calling device_remove_groups() after calling deactivate() leaves a window where the sysfs attributes show/store functions could be called after deactivation and then operate on the just freed trigger-data. Move the device_remo
store functions could be called after deactivation and then operate on the just freed trigger-data. Move the device_remove_groups() call to before deactivate() to close this race window. This also makes the deactivation path properly do things in reverse order of the activation path which calls the activate() callback before calling device_add_groups(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c3b7a650c8717aa89df318364609c86cbc040156 - https://git.kernel.org/stable/c/d1415125b701ef13370e2761f691ec632a5eb93a - https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6 - https://git.kernel.org/stable
1ec632a5eb93a - https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6 - https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d - https://git.kernel.org/stable/c/734ba6437e80dfc780e9ee9d95f912392d12b5ea - https://git.kernel.org/stable/c/cb8aa9d2a4c8a15d6a43ccf901ef3d094aa60374 - https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2 - https://git.kernel.org/stable/c/c0dc9adf9474ecb7106e60e5472577375aedaed3
CVE ID: CVE-2024-43831 State: PUBLISHED Published: 2024-08-17T09:21:49.593Z Last Updated: 2025-11-03T19:30:43.133Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Handle invalid decoder vsi Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi is valid for future use. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dbd3e4adb98e50ede74f00b3fa956fa29ef95e6c - https://git.kernel.org/stable/c/1c109f23b271a02b9bb195c173fab41e3285a8db - https://git.kernel.org/stable/c/cdf05ae76198c513836bde4eb55f099c44773280 - https://g
3b271a02b9bb195c173fab41e3285a8db - https://git.kernel.org/stable/c/cdf05ae76198c513836bde4eb55f099c44773280 - https://git.kernel.org/stable/c/59d438f8e02ca641c58d77e1feffa000ff809e9f
CVE ID: CVE-2024-43832 State: PUBLISHED Published: 2024-08-17T09:21:50.230Z Last Updated: 2025-11-03T22:05:16.929Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1a1eb2f3fc453dcd52726d13e863938561489cb7 - https://git.kernel.org/stable/c/
eferences: - https://git.kernel.org/stable/c/1a1eb2f3fc453dcd52726d13e863938561489cb7 - https://git.kernel.org/stable/c/8736604ef53359a718c246087cd21dcec232d2fb - https://git.kernel.org/stable/c/b21aba72aadd94bdac275deab021fc84d6c72b16 - https://git.kernel.org/stable/c/3f29f6537f54d74e64bac0a390fb2e26da25800d
CVE ID: CVE-2024-43833 State: PUBLISHED Published: 2024-08-17T09:21:50.890Z Last Updated: 2025-11-03T22:05:18.444Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Fix NULL pointer dereference in adding ancillary links In v4l2_async_create_ancillary_links(), ancillary links are created for lens and flash sub-devices. These are sub-device to sub-device links and if the async notifier is related to a V4L2 device, the source sub-device of the ancillary link is NULL, leading to a NULL pointer dereference. Check the notifier's sd field is non-NULL in v4l2_async_create_ancillary_links(). [Sakari Ailus: Reword the sub
ference. Check the notifier's sd field is non-NULL in v4l2_async_create_ancillary_links(). [Sakari Ailus: Reword the subject and commit messages slightly.] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fe0f92fd5320b393e44ca210805e653ea90cc982 - https://git.kernel.org/stable/c/249212ceb4187783af3801c57b92a5a25d410621 - https://git.kernel.org/stable/c/b87e28050d9b0959de24574d587825cfab2f13fb - https://git.kernel.org/stable/c/9b4667ea67854f0b116fe22ad11ef5628c5b5b5f
CVE ID: CVE-2024-43834 State: PUBLISHED Published: 2024-08-17T09:21:51.583Z Last Updated: 2025-11-03T22:05:21.434Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count. When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(
destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(). If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model(). The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool. Now the reference count is 2. To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model(). The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count. If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unr
iver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock(). The page_pool_destroy() internally acquires mutex_lock(). Splat looks like: ============================= [ BUG: Invalid wait context ] 6.10.0-rc6+ #4 Tainted: G W ----------------------------- ethtool/1806 is trying to lock: ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this: context-{5:5} 3 locks held by ethtool/1806: stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS S
tack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockde
+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp
x_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast
0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock(). Using xa without rcu_read_lock() here is safe. xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove(). The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0. The xa is already protected by the reference count mechanism well in the control plane. So removing rcu_read_lock() for page_pool_destroy() is safe. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e8
: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/be9d08ff102df3ac4f66e826ea935cf3af63a4bd - https://git.kernel.org/stable/c/6c390ef198aa69795427a5cb5fd7cb4bc7e6cd7a - https://git.kernel.org/stable/c/3fc1be360b99baeea15cdee3cf94252cd3a72d26 - https://git.kernel.org/stable/c/bf0ce5aa5f2525ed1b921ba36de96e458e77f482 - https://git.kernel.org/stable/c/12144069209eec7f2090ce9afa15acdcc2c2a537 - https://git.kernel.org/stable/c/59a931c5b732ca5fc2ca727f5a72aeabaafa85ec
CVE ID: CVE-2024-43835 State: PUBLISHED Published: 2024-08-17T09:21:52.425Z Last Updated: 2025-11-03T22:05:26.358Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0 __warn+0x12f/0x340 napi_skb_cache_put+0x82/0x4b0 napi_skb_cache_put+0x82/0x4b0 report_bug+0x165/0x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cac
x370 handle_bug+0x3d/0x80 exc_invalid_op+0x1a/0x50 asm_exc_invalid_op+0x1a/0x20 __free_old_xmit+0x1c8/0x510 napi_skb_cache_put+0x82/0x4b0 __free_old_xmit+0x1c8/0x510 __free_old_xmit+0x1c8/0x510 __pfx___free_old_xmit+0x10/0x10 The issue arises because virtio is assuming it's running in NAPI context even when it's not, such as in the netpoll case. To resolve this, modify virtnet_poll_tx() to only set NAPI when budget is available. Same for virtnet_poll_cleantx(), which always assumed that it was in a NAPI context. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa - https://git.kerne
am Container: References: - https://git.kernel.org/stable/c/d3af435e8ace119e58d8e21d3d2d6a4e7c4a4baa - https://git.kernel.org/stable/c/842a97b5e44f0c8a9fc356fe976e0e13ddcf7783 - https://git.kernel.org/stable/c/cc7340f18e45886121c131227985d64ef666012f - https://git.kernel.org/stable/c/6b5325f2457521bbece29499970c0117a648c620 - https://git.kernel.org/stable/c/f5e9a22d19bb98a7e86034db85eb295e94187caa - https://git.kernel.org/stable/c/468a729b78895893d0e580ceea49bed8ada2a2bd - https://git.kernel.org/stable/c/f8321fa75102246d7415a6af441872f6637c93ab
CVE ID: CVE-2024-43836 State: PUBLISHED Published: 2024-08-17T09:21:53.082Z Last Updated: 2025-05-04T09:27:20.276Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ethtool: pse-pd: Fix possible null-deref Fix a possible null dereference when a PSE supports both c33 and PoDL, but only one of the netlink attributes is specified. The c33 or PoDL PSE capabilities are already validated in the ethnl_set_pse_validate() call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e187690b125a297499eadeec53c32c5ed6d7436a - https://git.kernel.org/stable/c/4cddb0f15ea9c62f81b4889ea69a99368cc63a
able/c/e187690b125a297499eadeec53c32c5ed6d7436a - https://git.kernel.org/stable/c/4cddb0f15ea9c62f81b4889ea69a99368cc63a86
CVE ID: CVE-2024-43837 State: PUBLISHED Published: 2024-08-17T09:21:53.763Z Last Updated: 2025-11-03T22:05:28.863Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix null pointer dereference in resolve_prog_type() for BPF_PROG_TYPE_EXT When loading a EXT program without specifying `attr->attach_prog_fd`, the `prog->aux->dst_prog` will be null. At this time, calling resolve_prog_type() anywhere will result in a null pointer dereference. Example stack trace: [ 8.107863] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 8.108262] Mem abort info: [ 8.108384] ESR = 0x0000000096000004 [ 8.108
dereference at virtual address 0000000000000004 [ 8.108262] Mem abort info: [ 8.108384] ESR = 0x0000000096000004 [ 8.108547] EC = 0x25: DABT (current EL), IL = 32 bits [ 8.108722] SET = 0, FnV = 0 [ 8.108827] EA = 0, S1PTW = 0 [ 8.108939] FSC = 0x04: level 0 translation fault [ 8.109102] Data abort info: [ 8.109203] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 8.109399] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 8.109614] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 8.109836] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101354000 [ 8.110011] [0000000000000004] pgd=0000000000000000, p4d=0000000000000000 [ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 8.112783] Module
00000000000, p4d=0000000000000000 [ 8.112624] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 8.112783] Modules linked in: [ 8.113120] CPU: 0 PID: 99 Comm: may_access_dire Not tainted 6.10.0-rc3-next-20240613-dirty #1 [ 8.113230] Hardware name: linux,dummy-virt (DT) [ 8.113390] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.113429] pc : may_access_direct_pkt_data+0x24/0xa0 [ 8.113746] lr : add_subprog_and_kfunc+0x634/0x8e8 [ 8.113798] sp : ffff80008283b9f0 [ 8.113813] x29: ffff80008283b9f0 x28: ffff800082795048 x27: 0000000000000001 [ 8.113881] x26: ffff0000c0bb2600 x25: 0000000000000000 x24: 0000000000000000 [ 8.113897] x23: ffff0000c1134000 x22: 0000000000018