Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
- https://git.kernel.org/stable/c/3f9f72d843c92fb6f4ff7460d774413cde7f254c - https://git.kernel.org/stable/c/e3aaebcbb7c6b403416f442d1de70d437ce313a7
CVE ID: CVE-2024-49852 State: PUBLISHED Published: 2024-10-21T12:18:45.418Z Last Updated: 2025-11-03T22:22:19.683Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del() The kref_put() function will call nport->release if the refcount drops to zero. The nport->release release function is _efc_nport_free() which frees "nport". But then we dereference "nport" on the next line which is a use after free. Re-order these lines to avoid the use after free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/sta
ee. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/16a570f07d870a285b0c0b0d1ca4dff79e8aa5ff - https://git.kernel.org/stable/c/abc71e89170ed32ecf0a5a29f31aa711e143e941 - https://git.kernel.org/stable/c/baeb8628ab7f4577740f00e439d3fdf7c876b0ff - https://git.kernel.org/stable/c/7c2908985e4ae0ea1b526b3916de9e5351650908 - https://git.kernel.org/stable/c/98752fcd076a8cbc978016eae7125b4971be1eec - https://git.kernel.org/stable/c/2e4b02fad094976763af08fec2c620f4f8edd9ae
CVE ID: CVE-2024-49853 State: PUBLISHED Published: 2024-10-21T12:18:46.093Z Last Updated: 2025-11-03T22:22:21.218Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in OPTEE transport Channels can be shared between protocols, avoid freeing the same channel descriptors twice when unloading the stack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d7f4fc2bc101e666da649605a9ece2bd42529c7a - https://git.kernel.org/stable/c/6699567b0bbb378600a4dc0a1f929439a4e84a2c - https://git.kernel.org/stable/c/dc9543a4f2a5498a4a12d6d242749
el.org/stable/c/6699567b0bbb378600a4dc0a1f929439a4e84a2c - https://git.kernel.org/stable/c/dc9543a4f2a5498a4a12d6d2427492a6f1a28056 - https://git.kernel.org/stable/c/aef6ae124bb3cc12e34430fed91fbb7efd7a444d - https://git.kernel.org/stable/c/e98dba934b2fc587eafb83f47ad64d9053b18ae0
CVE ID: CVE-2024-49854 State: PUBLISHED Published: 2024-10-21T12:18:46.723Z Last Updated: 2025-11-03T22:22:22.684Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for accessing waker_bfqq after splitting After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe. Fix the problem by adding a helper bfq_waker_
the merge chain of bfqq, hence just recored waker_bfqq is still not safe. Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726 - https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd - https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f - https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583 - https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe - https://git.ker
6cd3f60944527c9d8c9f99f1583 - https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe - https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf
CVE ID: CVE-2024-49855 State: PUBLISHED Published: 2024-10-21T12:18:47.391Z Last Updated: 2025-11-03T22:22:24.136Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nbd: fix race between timeout and normal completion If request timetout is handled by nbd_requeue_cmd(), normal completion has to be stopped for avoiding to complete this requeued request, other use-after-free can be triggered. Fix the race by clearing NBD_CMD_INFLIGHT in nbd_requeue_cmd(), meantime make sure that cmd->lock is grabbed for clearing the flag and the requeue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https:/
flag and the requeue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9c25faf72d780a9c71081710cd48759d61ff6e9b - https://git.kernel.org/stable/c/6e73b946a379a1dfbb62626af93843bdfb53753d - https://git.kernel.org/stable/c/5236ada8ebbd9e7461f17477357582f5be4f46f7 - https://git.kernel.org/stable/c/9a74c3e6c0d686c26ba2aab66d15ddb89dc139cc - https://git.kernel.org/stable/c/c9ea57c91f03bcad415e1a20113bdb2077bcf990
CVE ID: CVE-2024-49856 State: PUBLISHED Published: 2024-10-21T12:18:48.123Z Last Updated: 2025-11-03T22:22:25.584Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Fix deadlock in SGX NUMA node search When the current node doesn't have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the
while loop because nid_of_current is not set in sgx_numa_mask. Also worth mentioning is that it's perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality. Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/40fb64257dab507d86b5f1f2a62f3669ef0c91a8 - https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf - htt
0fb64257dab507d86b5f1f2a62f3669ef0c91a8 - https://git.kernel.org/stable/c/20c96d0aaabfe361fc2a11c173968dc67feadbbf - https://git.kernel.org/stable/c/fb2d057539eda67ec7cfc369bf587e6518a9b99d - https://git.kernel.org/stable/c/0f89fb4042c08fd143bfc28af08bf6c8a0197eea - https://git.kernel.org/stable/c/8132510c915815e6b537ab937d94ed66893bc7b8 - https://git.kernel.org/stable/c/9c936844010466535bd46ea4ce4656ef17653644
CVE ID: CVE-2024-49857 State: PUBLISHED Published: 2024-10-21T12:18:48.784Z Last Updated: 2025-05-04T09:39:40.857Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: set the cipher for secured NDP ranging The cipher pointer is not set, but is derefereced trying to set its content, which leads to a NULL pointer dereference. Fix it by pointing to the cipher parameter before dereferencing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b3322a6d6aa9bc17b395c4b38d3b97578887aa8a - https://git.kernel.org/stable/c/a949075d4bbf1ca83ccdeaa6ef4ac2ce7526c5f4
CVE ID: CVE-2024-49858 State: PUBLISHED Published: 2024-10-21T12:27:17.308Z Last Updated: 2025-11-03T22:22:27.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption The TPM event log table is a Linux specific construct, where the data produced by the GetEventLog() boot service is cached in memory, and passed on to the OS using an EFI configuration table. The use of EFI_LOADER_DATA here results in the region being left unreserved in the E820 memory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kex
mory map constructed by the EFI stub, and this is the memory description that is passed on to the incoming kernel by kexec, which is therefore unaware that the region should be reserved. Even though the utility of the TPM2 event log after a kexec is questionable, any corruption might send the parsing code off into the weeds and crash the kernel. So let's use EFI_ACPI_RECLAIM_MEMORY instead, which is always treated as reserved by the E820 conversion logic. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f76b69ab9cf04358266e3cea5748c0c2791fbb08 - https://git.kernel.org/stable/c/11690d7e76842f29b60fbb5b35bc97d206ea0e83 -
c/f76b69ab9cf04358266e3cea5748c0c2791fbb08 - https://git.kernel.org/stable/c/11690d7e76842f29b60fbb5b35bc97d206ea0e83 - https://git.kernel.org/stable/c/5b22c038fb2757c652642933de5664da471f8cb7 - https://git.kernel.org/stable/c/19fd2f2c5fb36b61506d3208474bfd8fdf1cada3 - https://git.kernel.org/stable/c/38d9b07d99b789efb6d8dda21f1aaad636c38993 - https://git.kernel.org/stable/c/2e6871a632a99d9b9e2ce3a7847acabe99e5a26e - https://git.kernel.org/stable/c/77d48d39e99170b528e4f2e9fc5d1d64cdedd386
CVE ID: CVE-2024-49859 State: PUBLISHED Published: 2024-10-21T12:27:17.968Z Last Updated: 2025-11-03T22:22:28.562Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to check atomic_file in f2fs ioctl interfaces Some f2fs ioctl interfaces like f2fs_ioc_set_pin_file(), f2fs_move_file_range(), and f2fs_defragment_range() missed to check atomic_write status, which may cause potential race issue, fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/26b07bd2e1f124b0e430c8d250023f7205c549c3 - https://git.kernel.org/stable/c/7cb51731f24b216b0b87942f519f
nel.org/stable/c/26b07bd2e1f124b0e430c8d250023f7205c549c3 - https://git.kernel.org/stable/c/7cb51731f24b216b0b87942f519f2c67a17107ee - https://git.kernel.org/stable/c/10569b682ebe9c75ef06ddd322ae844e9be6374b - https://git.kernel.org/stable/c/d6f08c88047accc6127dddb6798a3ff11321539d - https://git.kernel.org/stable/c/bfe5c02654261bfb8bd9cb174a67f3279ea99e58
CVE ID: CVE-2024-49860 State: PUBLISHED Published: 2024-10-21T12:27:18.640Z Last Updated: 2025-11-03T22:22:30.053Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid return values of _STR. If something else is returned description_show() will access invalid memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/92fd5209fc014405f63a7db79802ca4b01dc0c05 - https://git.kernel.org/stable/c/2364b6af90c6b6d8a4783e0d3481ca80af699554 - https://git.kernel.org/stable/c/4b081991c4363e072e1748
it.kernel.org/stable/c/2364b6af90c6b6d8a4783e0d3481ca80af699554 - https://git.kernel.org/stable/c/4b081991c4363e072e1748efed0bbec8a77daba5 - https://git.kernel.org/stable/c/0cdfb9178a3bba843c95c2117c82c15f1a64b9ce - https://git.kernel.org/stable/c/5c8d007c14aefc3f2ddf71e4c40713733dc827be - https://git.kernel.org/stable/c/f0921ecd4ddc14646bb5511f49db4d7d3b0829f0 - https://git.kernel.org/stable/c/f51e5a88f2e7224858b261546cf6b3037dfb1323 - https://git.kernel.org/stable/c/f51f711d36e61fbb87c67b524fd200e05172668d - https://git.kernel.org/stable/c/4bb1e7d027413835b086aed35bc3f0713bc0f72b
CVE ID: CVE-2024-49861 State: PUBLISHED Published: 2024-10-21T12:27:19.321Z Last Updated: 2025-11-03T20:41:16.087Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for t
t. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed
t requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via *<ptr> = val. The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/988e55abcf7fdb8f
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/988e55abcf7fdb8fc9a76a7cf3f4e939a4d4fb3a - https://git.kernel.org/stable/c/a2c8dc7e21803257e762b0bf067fd13e9c995da0 - https://git.kernel.org/stable/c/2ed98ee02d1e08afee88f54baec39ea78dc8a23c - https://git.kernel.org/stable/c/1e75d25133158b525e0456876e9bcfd6b2993fd5 - https://git.kernel.org/stable/c/32556ce93bc45c730829083cb60f95a2728ea48b
CVE ID: CVE-2024-49862 State: PUBLISHED Published: 2024-10-21T12:27:19.981Z Last Updated: 2025-05-04T09:39:47.618Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix off by one in get_rpi() The rp->priv->rpi array is either rpi_msr or rpi_tpmi which have NR_RAPL_PRIMITIVES number of elements. Thus the > needs to be >= to prevent an off by one access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/288cbc505e2046638c615c36357cb78bc9fee1e0 - https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6 - https://git.kernel.org/stable/c/6a34f3b0d7f11
https://git.kernel.org/stable/c/851e7f7f14a15f4e47b7d0f70d5c4a2b95b824d6 - https://git.kernel.org/stable/c/6a34f3b0d7f11fb6ed72da315fd2360abd9c0737 - https://git.kernel.org/stable/c/95f6580352a7225e619551febb83595bcb77ab17
CVE ID: CVE-2024-49863 State: PUBLISHED Published: 2024-10-21T18:01:07.166Z Last Updated: 2025-11-03T22:22:31.577Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vhost/scsi: null-ptr-dereference in vhost_scsi_get_req() Since commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") a null pointer dereference bug can be triggered when guest sends an SCSI AN request. In vhost_scsi_ctl_handle_vq(), `vc.target` is assigned with `&v_req.tmf.lun[1]` within a switch-case block and is then passed to vhost_scsi_get_req() which extracts `vc->req` and `tpg`. However, for a `VIRTIO_SCSI_T_AN_*` request, tp
then passed to vhost_scsi_get_req() which extracts `vc->req` and `tpg`. However, for a `VIRTIO_SCSI_T_AN_*` request, tpg is not required, so `vc.target` is set to NULL in this branch. Later, in vhost_scsi_get_req(), `vc->target` is dereferenced without being checked, leading to a null pointer dereference bug. This bug can be triggered from guest. When this bug occurs, the vhost_worker process is killed while holding `vq->mutex` and the corresponding tpg will remain occupied indefinitely. Below is the KASAN report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x00000
address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 840 Comm: poc Not tainted 6.10.0+ #1 Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:vhost_scsi_get_req+0x165/0x3a0 Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 02 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 65 30 4c 89 e2 48 c1 ea 03 <0f> b6 04 02 4c 89 e2 83 e2 07 38 d0 7f 08 84 c0 0f 85 be 01 00 00 RSP: 0018:ffff888017affb50 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffff88801b000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8 RBP
000000 RBX: ffff88801b000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888017affcb8 RBP: ffff888017affb80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888017affc88 R14: ffff888017affd1c R15: ffff888017993000 FS: 000055556e076500(0000) GS:ffff88806b100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200027c0 CR3: 0000000010ed0004 CR4: 0000000000370ef0 Call Trace: <TASK> ? show_regs+0x86/0xa0 ? die_addr+0x4b/0xd0 ? exc_general_protection+0x163/0x260 ? asm_exc_general_protection+0x27/0x30 ? vhost_scsi_get_req+0x165/0x3a0 vhost_scsi_ctl_handle_v
l_protection+0x163/0x260 ? asm_exc_general_protection+0x27/0x30 ? vhost_scsi_get_req+0x165/0x3a0 vhost_scsi_ctl_handle_vq+0x2a4/0xca0 ? __pfx_vhost_scsi_ctl_handle_vq+0x10/0x10 ? __switch_to+0x721/0xeb0 ? __schedule+0xda5/0x5710 ? __kasan_check_write+0x14/0x30 ? _raw_spin_lock+0x82/0xf0 vhost_scsi_ctl_handle_kick+0x52/0x90 vhost_run_work_list+0x134/0x1b0 vhost_task_fn+0x121/0x350 ... </TASK> ---[ end trace 0000000000000000 ]--- Let's add a check in vhost_scsi_get_req. [whitespace fixes] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6592347f06e2b19a624270a85ad4b3ae48c3b241 - https://git.kernel.org/stable/c/46128370a72
- https://git.kernel.org/stable/c/6592347f06e2b19a624270a85ad4b3ae48c3b241 - https://git.kernel.org/stable/c/46128370a72c431df733af5ebb065c4d48c9ad39 - https://git.kernel.org/stable/c/ace9c778a214da9c98d7b69d904d1b0816f4f681 - https://git.kernel.org/stable/c/25613e6d9841a1f9fb985be90df921fa99f800de - https://git.kernel.org/stable/c/00fb5b23e1c9cdbe496f5cd6b40367cb895f6c93 - https://git.kernel.org/stable/c/61517f33e76d2c5247c1e61e668693afe5b67e6f - https://git.kernel.org/stable/c/221af82f606d928ccef19a16d35633c63026f1be
CVE ID: CVE-2024-49864 State: PUBLISHED Published: 2024-10-21T18:01:07.874Z Last Updated: 2025-05-04T09:39:50.456Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix a race between socket set up and I/O thread creation In rxrpc_open_socket(), it sets up the socket and then sets up the I/O thread that will handle it. This is a problem, however, as there's a gap between the two phases in which a packet may come into rxrpc_encap_rcv() from the UDP packet but we oops when trying to wake the not-yet created I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but m
I/O thread. As a quick fix, just make rxrpc_encap_rcv() discard the packet if there's no I/O thread yet. A better, but more intrusive fix would perhaps be to rearrange things such that the socket creation is done by the I/O thread. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cdf4bbbdb956d7426f687f38757ebca2a2759a0f - https://git.kernel.org/stable/c/56e415202b8a17de6496f4023e545fcb66f118ec - https://git.kernel.org/stable/c/c64f5fc95e9612fdf75587c8e21e494e614c18e2 - https://git.kernel.org/stable/c/bc212465326e8587325f520a052346f0b57360e6
CVE ID: CVE-2024-49865 State: PUBLISHED Published: 2024-10-21T18:01:08.620Z Last Updated: 2025-05-04T09:39:52.060Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xa_alloc to prevent UAF Evil user can guess the next id of the vm before the ioctl completes and then call vm destroy ioctl to trigger UAF since create ioctl is still referencing the same vm. Move the xa_alloc all the way to the end to prevent this. v2: - Rebase (cherry picked from commit dcfd3971327f3ee92765154baebbaece833d3ca9) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09cf8901fc0225898311b375cfcc
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/09cf8901fc0225898311b375cfcc67bae37ed5da - https://git.kernel.org/stable/c/74231870cf4976f69e83aa24f48edb16619f652f
CVE ID: CVE-2024-49866 State: PUBLISHED Published: 2024-10-21T18:01:09.284Z Last Updated: 2025-11-03T22:22:33.052Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Fix a race during cpuhp processing There is another found exception that the "timerlat/1" thread was scheduled on CPU0, and lead to timer corruption finally: ``` ODEBUG: init active (active state 0) object: ffff888237c2e108 object type: hrtimer hint: timerlat_irq+0x0/0x220 WARNING: CPU: 0 PID: 426 at lib/debugobjects.c:518 debug_print_object+0x7d/0xb0 Modules linked in: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45 Hardware name:
t_object+0x7d/0xb0 Modules linked in: CPU: 0 UID: 0 PID: 426 Comm: timerlat/1 Not tainted 6.11.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:debug_print_object+0x7d/0xb0 ... Call Trace: <TASK> ? __warn+0x7c/0x110 ? debug_print_object+0x7d/0xb0 ? report_bug+0xf1/0x1d0 ? prb_read_valid+0x17/0x20 ? handle_bug+0x3f/0x70 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? debug_print_object+0x7d/0xb0 ? debug_print_object+0x7d/0xb0 ? __pfx_timerlat_irq+0x10/0x10 __debug_object_init+0x110/0x150 hrtimer_init+0x1d/0x60 timerlat_main+0xab/0x2d0 ? __pfx_timerlat_main+0x10/0x10 kthread+0xb7/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fo
1d/0x60 timerlat_main+0xab/0x2d0 ? __pfx_timerlat_main+0x10/0x10 kthread+0xb7/0xe0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x40 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ``` After tracing the scheduling event, it was discovered that the migration of the "timerlat/1" thread was performed during thread creation. Further analysis confirmed that it is because the CPU online processing for osnoise is implemented through workers, which is asynchronous with the offline processing. When the worker was scheduled to create a thread, the CPU may has already been removed from the cpu_online_mask during the offline process, resulting in the inability to select the right CPU: T1 |
en removed from the cpu_online_mask during the offline process, resulting in the inability to select the right CPU: T1 | T2 [CPUHP_ONLINE] | cpu_device_down() osnoise_hotplug_workfn() | | cpus_write_lock() | takedown_cpu(1) | cpus_write_unlock() [CPUHP_OFFLINE] | cpus_read_lock() | start_kthread(1) | cpus_read_unlock() | To fix this, skip online processing if the CPU is already offline. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/322920b53dc11f9c2b33397eb3ae5bc6a175b60d - https://git.kernel.org/stable/c/ce25f33ba89d6eefef64157655d318444580fa14 - https://git.kernel.org/stable/c/a6e9849063a6c8f4cb2f652a437e44e3ed2435