Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them. irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe f
q_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally. This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization. irq_handler will now leave the event flag set but mask bus reset interr
e they were only unmasked during initialization. irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired. As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed. Additional Analyst Notes: - CISA ADP Vulnrichmen
starting with the second bus reset, after bus_reset_work has executed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b3948c69d60279fce5b2eeda92a07d66296c8130 - https://git.kernel.org/stable/c/31279bbca40d2f40cb3bbb6d538ec9620a645dec - https://git.kernel.org/stable/c/fa273f312334246c909475c5868e6daab889cc8c - https://git.kernel.org/stable/c/4f9cc355c328fc4f41cbd9c4cd58b235184fa420 - https://git.kernel.org/stable/c/6fafe3661712b143d9c69a7322294bd53f559d5d - https://git.kernel.org/stable/c/5982887de60c1b84f9c0ca07c835814d07fd1da0 - https://git.kernel.org/stable/c/8643332aac0576581cfdf01798ea3e4e0d624b61 - https://git.k
c1b84f9c0ca07c835814d07fd1da0 - https://git.kernel.org/stable/c/8643332aac0576581cfdf01798ea3e4e0d624b61 - https://git.kernel.org/stable/c/752e3c53de0fa3b7d817a83050b6699b8e9c6ec9
CVE ID: CVE-2024-36951 State: PUBLISHED Published: 2024-05-30T15:35:46.868Z Last Updated: 2025-09-16T08:02:37.804Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: range check cp bad op exception interrupts Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not receive garbage codes. Update the user api to guard exception code type checking as well. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/41dc6791596656dd41100b85647ed489e1d5c2f2 - https://git.kernel.org/stable/c/
eferences: - https://git.kernel.org/stable/c/41dc6791596656dd41100b85647ed489e1d5c2f2 - https://git.kernel.org/stable/c/b6735bfe941486c5dfc9c3085d2d75d4923f9449 - https://git.kernel.org/stable/c/0cac183b98d8a8c692c98e8dba37df15a9e9210d
CVE ID: CVE-2024-36952 State: PUBLISHED Published: 2024-05-30T15:35:47.477Z Last Updated: 2025-05-04T09:12:42.449Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Move NPIV's transport unregistration to after resource clean up There are cases after NPIV deletion where the fabric switch still believes the NPIV is logged into the fabric. This occurs when a vport is unregistered before the Remove All DA_ID CT and LOGO ELS are sent to the fabric. Currently fc_remove_host(), which calls dev_loss_tmo for all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes cau
all D_IDs including the fabric D_ID, removes the last ndlp reference and frees the ndlp rport object. This sometimes causes the race condition where the final DA_ID and LOGO are skipped from being sent to the fabric switch. Fix by moving the fc_remove_host() and scsi_remove_host() calls after DA_ID and LOGO are sent. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f2c7f029051edc4b394bb48edbe2297575abefe0 - https://git.kernel.org/stable/c/0936809d968ecf81e0726fbd02ff2a5732d960c3 - https://git.kernel.org/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0 - https://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89ee
g/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0 - https://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89eeb46278 - https://git.kernel.org/stable/c/4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c
CVE ID: CVE-2024-36953 State: PUBLISHED Published: 2024-05-30T15:35:48.070Z Last Updated: 2025-05-04T09:12:43.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_parse_attr() is responsible for finding the vCPU that matches the user-provided CPUID, which (of course) may not be valid. If the ID is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled gracefully. Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id() actually returns something and fail the ioctl if not. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
() actually returns something and fail the ioctl if not. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4404465a1bee3607ad90a4c5f9e16dfd75b85728 - https://git.kernel.org/stable/c/17db92da8be5dd3bf63c01f4109fe47db64fc66f - https://git.kernel.org/stable/c/3a5b0378ac6776c7c31b18e0f3c1389bd6005e80 - https://git.kernel.org/stable/c/8d6a1c8e3de36cb0f5e866f1a582b00939e23104 - https://git.kernel.org/stable/c/01981276d64e542c177b243f7c979fee855d5487 - https://git.kernel.org/stable/c/6ddb4f372fc63210034b903d96ebbeb3c7195adb
CVE ID: CVE-2024-36954 State: PUBLISHED Published: 2024-05-30T15:35:48.665Z Last Updated: 2025-05-04T12:56:33.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: fix a possible memleak in tipc_buf_append __skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/01cd1b7b685751ee422d00d050292a3d277652d6 - https://git.kernel.org/stable/c/2f87fd9476cf9725d774e6dcb7d17859c6a6d1ae - https://git.kernel.org/stable/c/adbce6
52d6 - https://git.kernel.org/stable/c/2f87fd9476cf9725d774e6dcb7d17859c6a6d1ae - https://git.kernel.org/stable/c/adbce6d20da6254c86425a8d4359b221b5ccbccd - https://git.kernel.org/stable/c/42c8471b0566c7539e7dd584b4d0ebd3cec8cb2c - https://git.kernel.org/stable/c/d03a82f4f8144befdc10518e732e2a60b34c870e - https://git.kernel.org/stable/c/614c5a5ae45a921595952117b2e2bd4d4bf9b574 - https://git.kernel.org/stable/c/3210d34fda4caff212cb53729e6bd46de604d565 - https://git.kernel.org/stable/c/97bf6f81b29a8efaf5d0983251a7450e5794370d
CVE ID: CVE-2024-36955 State: PUBLISHED Published: 2024-05-30T15:35:49.256Z Last Updated: 2025-05-04T09:12:46.379Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() The documentation for device_get_named_child_node() mentions this important point: " The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer. " Add fwnode_handle_put() to avoid a leaked reference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bd2d9641a39e6b5244230c4b41c4aca83b54b377 - https://
CVE Program Container: References: - https://git.kernel.org/stable/c/bd2d9641a39e6b5244230c4b41c4aca83b54b377 - https://git.kernel.org/stable/c/722d33c442e66e4aabd3e778958d696ff3a2777e - https://git.kernel.org/stable/c/7db626d2730d3d80fd31638169054b1e507f07bf - https://git.kernel.org/stable/c/7ef6ecf98ce309b1f4e5a25cddd5965d01feea07 - https://git.kernel.org/stable/c/c158cf914713efc3bcdc25680c7156c48c12ef6a
CVE ID: CVE-2024-36956 State: PUBLISHED Published: 2024-05-30T15:35:49.854Z Last Updated: 2025-05-04T09:12:47.591Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Free all thermal zone debug memory on zone removal Because thermal_debug_tz_remove() does not free all memory allocated for thermal zone diagnostics, some of that memory becomes unreachable after freeing the thermal zone's struct thermal_debugfs object. Address this by making thermal_debug_tz_remove() free all of the memory in question. Cc :6.8+ <stable@vger.kernel.org> # 6.8+ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container:
n. Cc :6.8+ <stable@vger.kernel.org> # 6.8+ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f51564e4b3992b53df79460ed5781a5330b5b1d5 - https://git.kernel.org/stable/c/72c1afffa4c645fe0e0f1c03e5f34395ed65b5f4
CVE ID: CVE-2024-36957 State: PUBLISHED Published: 2024-05-30T15:35:50.445Z Last Updated: 2025-05-04T12:56:34.681Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bcdac70adceb4437
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bcdac70adceb44373da204c3c297f2a98e13216e - https://git.kernel.org/stable/c/ec697fbd38cbe2eef0948b58673b146caa95402f - https://git.kernel.org/stable/c/8f11fe3ea3fc261640cfc8a5addd838000407c67 - https://git.kernel.org/stable/c/0a0285cee11c7dcc2657bcd456e469958a5009e7 - https://git.kernel.org/stable/c/fc3e0076c1f82fe981d321e3a7bad4cbee542c19 - https://git.kernel.org/stable/c/f299ee709fb45036454ca11e90cb2810fe771878
CVE ID: CVE-2024-36958 State: PUBLISHED Published: 2024-05-30T15:35:51.033Z Last Updated: 2025-05-04T09:12:49.774Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6a7b07689af6e4e023404bf69b1230f43b2a15bc - https://git.kernel.org/stable/c/18180a4550d08be4eb0387fe83f02f703f92d4e7
CVE ID: CVE-2024-36959 State: PUBLISHED Published: 2024-05-30T15:35:51.624Z Last Updated: 2025-05-04T12:56:35.782Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/06780473cb8a858d1d6cab2673e021b072a852d1 - https://git.kernel.org/stable/c/47d253c485491caaf70d8cd8c0248ae
.org/stable/c/06780473cb8a858d1d6cab2673e021b072a852d1 - https://git.kernel.org/stable/c/47d253c485491caaf70d8cd8c0248ae26e42581f - https://git.kernel.org/stable/c/35ab679e8bb5a81a4f922d3efbd43e32bce69274 - https://git.kernel.org/stable/c/76aa2440deb9a35507590f2c981a69a57ecd305d - https://git.kernel.org/stable/c/518d5ddafeb084d6d9b1773ed85164300037d0e6 - https://git.kernel.org/stable/c/026e24cf31733dbd97f41cc9bc5273ace428eeec - https://git.kernel.org/stable/c/c7e02ccc9fdc496fe51e440e3e66ac36509ca049 - https://git.kernel.org/stable/c/a0cedbcc8852d6c77b00634b81e41f17f29d9404
CVE ID: CVE-2024-36960 State: PUBLISHED Published: 2024-06-03T07:49:58.951Z Last Updated: 2025-05-04T09:12:52.237Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
esuling in oob reads. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59f - https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9 - https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36 - https://git.kernel.org/stable/c/b7bab33c4623c66e3398d5253870d4e88c52dfc0 - https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1b - https://git.kernel.org/stable/c/7b5fd3af4a250dd0a2a558e07b43478748eb5d22 - https://git.kernel.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77 - https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6c
.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77 - https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c
CVE ID: CVE-2024-36961 State: PUBLISHED Published: 2024-06-03T07:49:59.621Z Last Updated: 2025-05-04T09:12:53.485Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Fix two locking issues with thermal zone debug With the current thermal zone locking arrangement in the debugfs code, user space can open the "mitigations" file for a thermal zone before the zone's debugfs pointer is set which will result in a NULL pointer dereference in tze_seq_start(). Moreover, thermal_debug_tz_remove() is not called under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct t
ed under the thermal zone lock, so it can run in parallel with the other functions accessing the thermal zone's struct thermal_debugfs object. Then, it may clear tz->debugfs after one of those functions has checked it and the struct thermal_debugfs object may be freed prematurely. To address the first problem, pass a pointer to the thermal zone's struct thermal_debugfs object to debugfs_create_file() in thermal_debug_tz_add() and make tze_seq_start(), tze_seq_next(), tze_seq_stop(), and tze_seq_show() retrieve it from s->private instead of a pointer to the thermal zone object. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_i
ct. This will ensure that tz_debugfs will be valid across the "mitigations" file accesses until thermal_debugfs_remove_id() called by thermal_debug_tz_remove() removes that file. To address the second problem, use tz->lock in thermal_debug_tz_remove() around the tz->debugfs value check (in case the same thermal zone is removed at the same time in two different threads) and its reset to NULL. Cc :6.8+ <stable@vger.kernel.org> # 6.8+ Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6c57bdd0505422d5ccd2df541d993aec978c842e - https://git.kernel.org/stable/c/c7f7c37271787a7f77d7eedc132b0b419a76b4c8
CVE ID: CVE-2024-36962 State: PUBLISHED Published: 2024-06-03T07:50:00.425Z Last Updated: 2025-05-04T09:12:54.685Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs Currently the driver uses local_bh_disable()/local_bh_enable() in its IRQ handler to avoid triggering net_rx_action() softirq on exit from netif_rx(). The net_rx_action() could trigger this driver .start_xmit callback, which is protected by the same lock as the IRQ handler, so calling the .start_xmit from netif_rx() from the IRQ handler critical section protected by the lock could lead to an attempt
ng the .start_xmit from netif_rx() from the IRQ handler critical section protected by the lock could lead to an attempt to claim the already claimed lock, and a hang. The local_bh_disable()/local_bh_enable() approach works only in case the IRQ handler is protected by a spinlock, but does not work if the IRQ handler is protected by mutex, i.e. this works for KS8851 with Parallel bus interface, but not for KS8851 with SPI bus interface. Remove the BH manipulation and instead of calling netif_rx() inside the IRQ handler code protected by the lock, queue all the received SKBs in the IRQ handler into a queue first, and once the IRQ handler exits the critical section protected by the lock, dequeue
n the IRQ handler into a queue first, and once the IRQ handler exits the critical section protected by the lock, dequeue all the queued SKBs and push them all into netif_rx(). At this point, it is safe to trigger the net_rx_action() softirq, since the netif_rx() call is outside of the lock that protects the IRQ handler. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8a3ff43dcbab7c96f9e8cf2bd1049ab8d6e59545 - https://git.kernel.org/stable/c/ae87f661f3c1a3134a7ed86ab69bf9f12af88993 - https://git.kernel.org/stable/c/7e2901a2a9195da76111f351584bf77552a038f0 - https://git.kernel.org/stable/c/e0863634bf9f7cf36291ebb5bfa2d16
.org/stable/c/7e2901a2a9195da76111f351584bf77552a038f0 - https://git.kernel.org/stable/c/e0863634bf9f7cf36291ebb5bfa2d16632f79c49
CVE ID: CVE-2024-36963 State: PUBLISHED Published: 2024-06-03T07:50:01.125Z Last Updated: 2025-05-20T14:07:59.778Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracefs: Reset permissions on remount if permissions are options There's an inconsistency with the way permissions are handled in tracefs. Because the permissions are generated when accessed, they default to the root inode's permission if they were never set by the user. If the user sets the permissions, then a flag is set and the permissions are saved via the inode (for tracefs files) or an internal attribute field (for eventfs). But if a remount happens that specify
d via the inode (for tracefs files) or an internal attribute field (for eventfs). But if a remount happens that specify the permissions, all the files that were not changed by the user gets updated, but the ones that were are not. If the user were to remount the file system with a given permission, then all files and directories within that file system should be updated. This can cause security issues if a file's permission was updated but the admin forgot about it. They could incorrectly think that remounting with permissions set would update all files, but miss some. For example: # cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 root root 0 May 1 21:25 buffer_s
example: # cd /sys/kernel/tracing # chgrp 1002 current_tracer # ls -l [..] -rw-r----- 1 root root 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root root 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root root 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root root 0 May 1 21:25 dynamic_events -r--r----- 1 root root 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root root 0 May 1 21:25 enabled_functions Where current_tracer now has group "lkp". # mount -o remount,gid=1001 . # ls -l -rw-r----- 1 root tracing 0 May 1 21:25 buffer_size_kb -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root tracing 0 May 1 21:25 bu
buffer_size_kb -rw-r----- 1 root tracing 0 May 1 21:25 buffer_subbuf_size_kb -r--r----- 1 root tracing 0 May 1 21:25 buffer_total_size_kb -rw-r----- 1 root lkp 0 May 1 21:25 current_tracer -rw-r----- 1 root tracing 0 May 1 21:25 dynamic_events -r--r----- 1 root tracing 0 May 1 21:25 dyn_ftrace_total_info -r--r----- 1 root tracing 0 May 1 21:25 enabled_functions Everything changed but the "current_tracer". Add a new link list that keeps track of all the tracefs_inodes which has the permission flags that tell if the file/dir should use the root inode's permission or not. Then on remount, clear all the flags so that the default behavior of using the root inode's permission is done for all file
n on remount, clear all the flags so that the default behavior of using the root inode's permission is done for all files and directories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f91fc82794d4a6e41cdcd02d00baa377d94ca78 - https://git.kernel.org/stable/c/414fb08628143203d29ccd0264b5a83fb9523c03 - https://git.kernel.org/stable/c/baa23a8d4360d981a49913841a726edede5cdd54
CVE ID: CVE-2024-36964 State: PUBLISHED Published: 2024-06-03T07:50:01.987Z Last Updated: 2025-05-04T09:12:57.344Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/9p: only translate RWX permissions for plain 9P2000 Garbage in plain 9P2000's perm bits is allowed through, which causes it to be able to set (among others) the suid bit. This was presumably not the intent since the unix extended bits are handled explicitly and conditionally on .u. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d - https://git.kernel.org
ntainer: References: - https://git.kernel.org/stable/c/e90bc596a74bb905e0a45bf346038c3f9d1e868d - https://git.kernel.org/stable/c/df1962a199783ecd66734d563caf0fedecf08f96 - https://git.kernel.org/stable/c/5a605930e19f451294bd838754f7d66c976a8a2c - https://git.kernel.org/stable/c/ad4f65328661392de74e3608bb736fedf3b67e32 - https://git.kernel.org/stable/c/ca9b5c81f0c918c63d73d962ed8a8e231f840bc8 - https://git.kernel.org/stable/c/e55c601af3b1223a84f9f27f9cdbd2af5e203bf3 - https://git.kernel.org/stable/c/157d468e34fdd3cb1ddc07c2be32fb3b02826b02 - https://git.kernel.org/stable/c/cd25e15e57e68a6b18dc9323047fe9c68b99290b
CVE ID: CVE-2024-36965 State: PUBLISHED Published: 2024-06-08T12:52:58.404Z Last Updated: 2025-05-04T09:12:58.457Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: remoteproc: mediatek: Make sure IPI buffer fits in L2TCM The IPI buffer location is read from the firmware that we load to the System Companion Processor, and it's not granted that both the SRAM (L2TCM) size that is defined in the devicetree node is large enough for that, and while this is especially true for multi-core SCP, it's still useful to check on single-core variants as well. Failing to perform this check may make this driver perform R/W operations out of the L