Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
y from a list, while it was already removed by the first call. Fix __dm_internal_resume so that it calls the preresume and resume methods of the table's targets. If a preresume method of some target fails, we are in a tricky situation. We can't return an error because dm_internal_resume isn't supposed to return errors. We can't return success, because then the "resume" and "postsuspend" methods would not be paired correctly. So, we set the DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace tools, but it won't cause a kernel crash. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:56! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 8343 Comm: dmsetup
e ]------------ kernel BUG at lib/list_debug.c:56! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0 <snip> RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282 RAX: 000000000000004e RBX: ffff888143b6eb80 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff819053d0 RDI: 00000000ffffffff RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: 0000000000000058 R10: 0000000000000000 R11: ffffffff81a24080 R12: 0000000000000001 R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0 FS: 00000000f7c0f780(0000) GS:ffff8893f0a
000000000001 R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0 FS: 00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000057fb5000 CR3: 0000000143474000 CR4: 00000000000006b0 Call Trace: <TASK> ? die+0x2d/0x80 ? do_trap+0xeb/0xf0 ? __list_del_entry_valid_or_report+0x77/0xc0 ? do_error_trap+0x60/0x80 ? __list_del_entry_valid_or_report+0x77/0xc0 ? exc_invalid_op+0x49/0x60 ? __list_del_entry_valid_or_report+0x77/0xc0 ? asm_exc_invalid_op+0x16/0x20 ? table_deps+0x1b0/0x1b0 [dm_mod] ? __list_del_entry_valid_or_report+0x77/0xc0 origin_postsuspend+0x1a/0x50 [dm_snapshot] dm_table_postsuspend_targets+0x34/
__list_del_entry_valid_or_report+0x77/0xc0 origin_postsuspend+0x1a/0x50 [dm_snapshot] dm_table_postsuspend_targets+0x34/0x50 [dm_mod] dm_suspend+0xd8/0xf0 [dm_mod] dev_suspend+0x1f2/0x2f0 [dm_mod] ? table_deps+0x1b0/0x1b0 [dm_mod] ctl_ioctl+0x300/0x5f0 [dm_mod] dm_compat_ctl_ioctl+0x7/0x10 [dm_mod] __x64_compat_sys_ioctl+0x104/0x170 do_syscall_64+0x184/0x1b0 entry_SYSCALL_64_after_hwframe+0x46/0x4e RIP: 0033:0xf7e6aead <snip> ---[ end trace 0000000000000000 ]--- Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/69836d9329f0b4c58faaf3d886a7748ddb5bf718 - https://git.kernel.org/stable/c/da7ece2197101b1469853e6b5e915be1e389
stable/c/69836d9329f0b4c58faaf3d886a7748ddb5bf718 - https://git.kernel.org/stable/c/da7ece2197101b1469853e6b5e915be1e3896d52 - https://git.kernel.org/stable/c/f89bd27709376d37ff883067193320c58a8c1d5a - https://git.kernel.org/stable/c/03ad5ad53e51abf3a4c7538c1bc67a5982b41dc5 - https://git.kernel.org/stable/c/ad10289f68f45649816cc68eb93f45fd5ec48a15 - https://git.kernel.org/stable/c/15a3fc5c8774c17589dabfe1d642d40685c985af - https://git.kernel.org/stable/c/ef02d8edf738557af2865c5bfb66a03c4e071be7 - https://git.kernel.org/stable/c/360a7d1be8112654f1fb328ed3862be630bca3f4 - https://git.kernel.org/stable/c/65e8fbde64520001abf1c8d0e573561b4746ef38
CVE ID: CVE-2024-26881 State: PUBLISHED Published: 2024-04-17T10:27:37.744Z Last Updated: 2025-05-04T08:58:45.795Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the access of hdev->ptp->flags will cause a kernel crash: [ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at
inter dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge] [ 5889.279101] sp : ffff800012c3bc50 [ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040 [ 5889.289927] x27: ffff800009116484 x26: 0000000080007500 [ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000 [ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000 [ 5889.309134] x21: 0000000000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 000000000
000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 0000000000000000 x16: 0000000000000000 [ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000 [ 5889.334617] x13: 0000000000000000 x12: 00000000010011df [ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000 [ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d [ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480 [ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000 [ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000 [ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hc
: 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3] [ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3] [ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3] [ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3] [ 5889.411084] napi_poll+0xcc/0x264 [ 5889.415329] net_rx_action+0xd4/0x21c [ 5889.419911] __do_softirq+0x130/0x358 [ 5889.424484] irq_exit+0x134/0x154 [ 5889.428700] __handle_domain_irq+0x88/0xf0 [ 5889.433684] gic_handle_irq+0x78/0x2c0 [ 5889.438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451
438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451714] cpuidle_idle_call+0x174/0x1b0 [ 5889.456692] do_idle+0xc8/0x160 [ 5889.460717] cpu_startup_entry+0x30/0xfc [ 5889.465523] secondary_start_kernel+0x158/0x1ec [ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80) [ 5889.477950] SMP: stopping secondary CPUs [ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95 [ 5890.522951] Starting crashdump kernel... Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265 - https://git.kernel.org/stable/c/b3cf
ences: - https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265 - https://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6 - https://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108 - https://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70 - https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4 - https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3
CVE ID: CVE-2024-26882 State: PUBLISHED Published: 2024-04-17T10:27:38.389Z Last Updated: 2025-05-04T08:58:47.122Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb-
network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. syzbot reported: BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:40
h:275 [inline] IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389 ipgre_rcv net/ipv4/ip_gre.c:411 [inline] gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447 gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __ne
4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 netif_receive_skb_internal net/core/dev.c:5734 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5793 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556 tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [
s_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133 alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204 skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909 tun_build_skb drivers/net/tun.c:1686 [inline] tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826 tun_chr_write_iter+0x3af/0
un_build_skb drivers/net/tun.c:1686 [inline] tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
_after_hwframe+0x63/0x6b Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ec6bb01e02cbd47781dd90775b631a1dc4bd9d2b - https://git.kernel.org/stable/c/77fd5294ea09b21f6772ac954a121b87323cec80 - https://git.kernel.org/stable/c/5c03387021cfa3336b97e0dcba38029917a8af2a - https://git.kernel.org/stable/c/60044ab84836359534bd7153b92e9c1584140e4a - https://git.kernel.org/stable/c/c4c857723b37c20651300b3de4ff25059848b4b0 - https://git.kernel.org/stable/c/f6723d8dbfdc10c784a56748f86a9a3cd410dbd5 - https://git.kernel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1 - https://git.kernel.org/stable/c/b0ec2abf98267f14d03210255158
nel.org/stable/c/ca914f1cdee8a85799942c9b0ce5015bbd6844e1 - https://git.kernel.org/stable/c/b0ec2abf98267f14d032102551581c833b0659d3
CVE ID: CVE-2024-26883 State: PUBLISHED Published: 2024-04-17T10:27:39.036Z Last Updated: 2025-05-04T12:55:01.991Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains
viour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d0e214acc59145ce25113f617311aa79dda39cb3 - https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d - https://git.kern
ce25113f617311aa79dda39cb3 - https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d - https://git.kernel.org/stable/c/15641007df0f0d35fa28742b25c2a7db9dcd6895 - https://git.kernel.org/stable/c/ca1f06e72dec41ae4f76e7b1a8a97265447b46ae - https://git.kernel.org/stable/c/f06899582ccee09bd85d0696290e3eaca9aa042d - https://git.kernel.org/stable/c/7070b274c7866a4c5036f8d54fcaf315c64ac33a - https://git.kernel.org/stable/c/43f798b9036491fb014b55dd61c4c5c3193267d0 - https://git.kernel.org/stable/c/0971126c8164abe2004b8536b49690a0d6005b0a - https://git.kernel.org/stable/c/7a4b21250bf79eef26543d35bd390448646c536b
CVE ID: CVE-2024-26884 State: PUBLISHED Published: 2024-04-17T10:27:39.672Z Last Updated: 2025-05-04T08:58:49.845Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains th
our, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/33ec04cadb77605b71d9298311919303d390c4d5 - https://git.kernel.org/stable/c/92c81fbb3ed2e0dfc33a4183a67135e1ab566ace - https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6 - https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d - https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d
nel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d - https://git.kernel.org/stable/c/a83fdaeaea3677b83a53f72ace2d73a19bcd6d93 - https://git.kernel.org/stable/c/8435f0961bf3dc65e204094349bd9aeaac1f8868 - https://git.kernel.org/stable/c/d817f0d34d927f2deb17dadbfe212c9a6a32ac3e - https://git.kernel.org/stable/c/a6fa75b5096c0f9826a4fabe22d907b0a5bb1016 - https://git.kernel.org/stable/c/6787d916c2cf9850c97a0a3f73e08c43e7d973b1
CVE ID: CVE-2024-26885 State: PUBLISHED Published: 2024-04-17T10:27:40.300Z Last Updated: 2025-05-04T08:58:51.351Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because
ated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end. Syzbot managed to turn this into a crash on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f5e352b9088211fa5e
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f5e352b9088211fa5eb4e1639cd365f4f7d2f65 - https://git.kernel.org/stable/c/4b81a9f92b3676cb74b907a7a209b3d15bd9a7f9 - https://git.kernel.org/stable/c/c826502bed93970f2fd488918a7b8d5f1d30e2e3 - https://git.kernel.org/stable/c/edf7990baa48de5097daa9ac02e06cb4c798a737 - https://git.kernel.org/stable/c/250051acc21f9d4c5c595e4fcb55986ea08c4691 - https://git.kernel.org/stable/c/22079b3a423382335f47d9ed32114e6c9fe88d7c - https://git.kernel.org/stable/c/e89386f62ce9a9ab9a94835a9890883c23d9d52c - https://git.kernel.org/stable/c/281d464a34f540de166cee74b723e97ac2515ec3
CVE ID: CVE-2024-26886 State: PUBLISHED Published: 2024-04-17T10:27:40.941Z Last Updated: 2025-05-04T12:55:03.251Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+
hedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c - https://git.kernel.org/stable/c/817e
ences: - https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c - https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7 - https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 - https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb
CVE ID: CVE-2024-26887 State: PUBLISHED Published: 2024-04-17T10:27:41.557Z Last Updated: 2025-05-04T08:58:53.984Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix memory leak This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone the skb and also make sure btmtk_process_coredump frees the skb passed following the same logic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/620b9e60e4b55fa55540ce852a0f3c9e6091dbbc - https://git.kernel.org/stable/c/b10e6f6b160a60b98fb7476028f5a95405bbd725 - https://git.kernel.org/stable
f3c9e6091dbbc - https://git.kernel.org/stable/c/b10e6f6b160a60b98fb7476028f5a95405bbd725 - https://git.kernel.org/stable/c/b08bd8f02a24e2b82fece5ac51dc1c3d9aa6c404 - https://git.kernel.org/stable/c/79f4127a502c5905f04da1f20a7bbe07103fb77c
CVE ID: CVE-2024-26888 State: PUBLISHED Published: 2024-04-17T10:27:42.193Z Last Updated: 2025-05-04T12:55:04.312Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: Fix memory leak Fix leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/98e9920c75e0790bff947a00d192d24bf1c724e0 - https://git.kernel.org/stable/c/5987b9f7d9314c7411136005b3a52f61a8cc0911 - https://git.kernel.org/stable/c/5cb93417c93716a5404f762f331f5de3653fd952 - https://git.kernel.org/stable/c/a6e06258f4c31eba0fcd50
it.kernel.org/stable/c/5cb93417c93716a5404f762f331f5de3653fd952 - https://git.kernel.org/stable/c/a6e06258f4c31eba0fcd503e19828b5f8fe7b08b
CVE ID: CVE-2024-26889 State: PUBLISHED Published: 2024-04-17T10:27:42.814Z Last Updated: 2025-05-07T19:59:25.169Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its size, so this fixes this problem by switching to use strscpy. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6d5a9d4a7bcbb7534ce45a18a52e7bd23e69d8ac - https://git.kernel.org/stable/c/54a03e4ac1a41edf8a5087
it.kernel.org/stable/c/6d5a9d4a7bcbb7534ce45a18a52e7bd23e69d8ac - https://git.kernel.org/stable/c/54a03e4ac1a41edf8a5087bd59f8241b0de96d3d - https://git.kernel.org/stable/c/d47e6c1932cee02954ea588c9f09fd5ecefeadfc - https://git.kernel.org/stable/c/2e845867b4e279eff0a19ade253390470e07e8a1 - https://git.kernel.org/stable/c/a41c8efe659caed0e21422876bbb6b73c15b5244 - https://git.kernel.org/stable/c/8c28598a2c29201d2ba7fc37539a7d41c264fb10 - https://git.kernel.org/stable/c/2edce8e9a99dd5e4404259d52e754fdc97fb42c2 - https://git.kernel.org/stable/c/81137162bfaa7278785b24c1fd2e9e74f082e8e4
CVE ID: CVE-2024-26890 State: PUBLISHED Published: 2024-04-17T10:27:43.438Z Last Updated: 2025-05-04T08:58:58.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when btrtl is used with hci_h5. This commit adds memory allocation for hci_h5 case. ================================================================== BUG: KASAN: slab-out-of-bound