Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
git.kernel.org/stable/c/e549cd6da1f21c34ba0f65adeca6a8aa9860b381 - https://git.kernel.org/stable/c/60f4a4bc3329e5cb8c4df0cc961f0d5ffd96e22d - https://git.kernel.org/stable/c/4711b1347cb9f0c3083da6d87c624d75f9bd1d50 - https://git.kernel.org/stable/c/06a3810010b525b9958424e344f0c25b09e128fa - https://git.kernel.org/stable/c/c8c19ebf7c0b202a6a2d37a52ca112432723db5f
CVE ID: CVE-2024-46822 State: PUBLISHED Published: 2024-09-27T12:39:23.345Z Last Updated: 2025-11-03T22:19:12.435Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was online, it was noted that there is need to map back to the cpu and use that to index into a cpumask. As such, a valid ID is needed. If an MPIDR check fails in acpi_map_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL
p_gic_cpu_interface() it is possible for the entry in cpu_madt_gicc[cpu] == NULL. This function would then cause a NULL pointer dereference. Whilst a path to trigger this has not been established, harden this caller against the possibility. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f57769ff6fa7f97f1296965f20e8a2bb3ee9fd0f - https://git.kernel.org/stable/c/4c3b21204abb4fa3ab310fbbb5cf7f0e85f3a1bc - https://git.kernel.org/stable/c/945be49f4e832a9184c313fdf8917475438a795b - https://git.kernel.org/stable/c/40cae0df42e5e7f7a1c0f32deed9c4027c1ba94e - https://git.kernel.org/stable/c/62ca6d3a905b4c40cd942f3cc645a6718f8bc
table/c/40cae0df42e5e7f7a1c0f32deed9c4027c1ba94e - https://git.kernel.org/stable/c/62ca6d3a905b4c40cd942f3cc645a6718f8bc7e7 - https://git.kernel.org/stable/c/bc7fbb37e3d2df59336eadbd6a56be632e3c7df7 - https://git.kernel.org/stable/c/2488444274c70038eb6b686cba5f1ce48ebb9cdd
CVE ID: CVE-2024-46823 State: PUBLISHED Published: 2024-09-27T12:39:23.959Z Last Updated: 2025-11-03T19:31:15.228Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope. However, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register'. It produces the kernel panic with KASAN enabled. Since this variable is used in one place only, remove it and pass the device name into kunit_device_register directly as an ascii string. Additional Analyst Notes: - CISA AD
it and pass the device name into kunit_device_register directly as an ascii string. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cacce7faa7c475cea55e82cc3a27794561fac157 - https://git.kernel.org/stable/c/99ddb9c58511f1b71e23d02a06082bf6d2dd2133 - https://git.kernel.org/stable/c/d1207f07decc66546a7fa463d2f335a856c986ef - https://git.kernel.org/stable/c/92e9bac18124682c4b99ede9ee3bcdd68f121e92
CVE ID: CVE-2024-46824 State: PUBLISHED Published: 2024-09-27T12:39:24.563Z Last Updated: 2025-05-04T09:35:18.492Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommufd: Require drivers to supply the cache_invalidate_user ops If drivers don't do this then iommufd will oops invalidation ioctls with something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000]
= 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101059000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 371 Comm: qemu-system-aar Not tainted 6.8.0-rc7-gde77230ac23a #9 Hardware name: linux,dummy-virt (DT) pstate: 81400809 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=-c) pc : 0x0 lr : iommufd_hwpt_invalidate+0xa4/0x204 sp : ffff800080f3bcc0 x29: ffff800080f3bcf0 x28: ffff0000c369b300 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080
0000000000000000 x24: 0000000000000000 x23: 0000000000000000 x22: 00000000c1e334a0 x21: ffff0000c1e334a0 x20: ffff800080f3bd38 x19: ffff800080f3bd58 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffff8240d6d8 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000001000000002 x7 : 0000fffeac1ec950 x6 : 0000000000000000 x5 : ffff800080f3bd78 x4 : 0000000000000003 x3 : 0000000000000002 x2 : 0000000000000000 x1 : ffff800080f3bcc8 x0 : ffff0000c6034d80 Call trace: 0x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/
x0 iommufd_fops_ioctl+0x154/0x274 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xb4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 All existing drivers implement this op for nesting, this is mostly a bisection aid. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/89827a4de802765b1ebb401fc1e73a90108c7520 - https://git.kernel.org/stable/c/a11dda723c6493bb1853bbc61c093377f96e2d47
CVE ID: CVE-2024-46825 State: PUBLISHED Published: 2024-09-27T12:39:25.218Z Last Updated: 2025-05-04T09:35:19.746Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check The lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() is normally called with input from the firmware, so it should use IWL_FW_CHECK() instead of WARN_ON(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/415f3634d53c7fb4cf07d2f5a0be7f2e15e6da33 - https://git.kernel.org/stable/c/3cca098c91391b3fa48142bfda57048b985c87f6 - https://git.kernel.org/stable/c/9215152677
- https://git.kernel.org/stable/c/3cca098c91391b3fa48142bfda57048b985c87f6 - https://git.kernel.org/stable/c/9215152677d4b321801a92b06f6d5248b2b4465f
CVE ID: CVE-2024-46826 State: PUBLISHED Published: 2024-09-27T12:39:25.860Z Last Updated: 2025-11-03T22:19:13.919Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly one load for consistent value across one exec. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27 - https://git.kernel.org/stable/
References: - https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27 - https://git.kernel.org/stable/c/53f17409abf61f66b6f05aff795e938e5ba811d1 - https://git.kernel.org/stable/c/1cf8cd80903073440b6ea055811d04edd24fe4f7 - https://git.kernel.org/stable/c/2a97388a807b6ab5538aa8f8537b2463c6988bd2
CVE ID: CVE-2024-46827 State: PUBLISHED Published: 2024-09-27T12:39:26.478Z Last Updated: 2025-05-04T09:35:22.652Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix firmware crash due to invalid peer nss Currently, if the access point receives an association request containing an Extended HE Capabilities Information Element with an invalid MCS-NSS, it triggers a firmware crash. This issue arises when EHT-PHY capabilities shows support for a bandwidth and MCS-NSS set for that particular bandwidth is filled by zeros and due to this, driver obtains peer_nss as 0 and sending this value to firmware causes crash. Addre
is filled by zeros and due to this, driver obtains peer_nss as 0 and sending this value to firmware causes crash. Address this issue by implementing a validation step for the peer_nss value before passing it to the firmware. If the value is greater than zero, proceed with forwarding it to the firmware. However, if the value is invalid, reject the association request to prevent potential firmware crashes. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/838c2cfdb6be7d7d8c06c711edf893eb34ca2e7c - https://git.kernel.org/stable/c/25a15f80253a7c8776e4e4880d797d20ec864154 - https
c2cfdb6be7d7d8c06c711edf893eb34ca2e7c - https://git.kernel.org/stable/c/25a15f80253a7c8776e4e4880d797d20ec864154 - https://git.kernel.org/stable/c/db163a463bb93cd3e37e1e7b10b9726fb6f95857
CVE ID: CVE-2024-46828 State: PUBLISHED Published: 2024-09-27T12:39:27.100Z Last Updated: 2025-11-03T22:19:16.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is used as the round-robin weight when iterating through flows. The count of active bulk flows is updated whenever a flow changes state. This has a peculiar interaction with the hash collision handling: when a hash collision occurs (after the set-associative hashing), the state of the
on with the hash collision handling: when a hash collision occurs (after the set-associative hashing), the state of the hash bucket is simply updated to match the new packet that collided, and if host fairness is enabled, that also means assigning new per-host state to the flow. For this reason, the bulk flow counters of the host(s) assigned to the flow are decremented, before new state is assigned (and the counters, which may not belong to the same host anymore, are incremented again). Back when this code was introduced, the host fairness mode was always enabled, so the decrement was unconditional. When the configuration flags were introduced the *increment* was made conditional, but the *d
crement was unconditional. When the configuration flags were introduced the *increment* was made conditional, but the *decrement* was not. Which of course can lead to a spurious decrement (and associated wrap-around to U16_MAX). AFAICT, when host fairness is disabled, the decrement and wrap-around happens as soon as a hash collision occurs (which is not that common in itself, due to the set-associative hashing). However, in most cases this is harmless, as the value is only used when host fairness mode is enabled. So in order to trigger an array overflow, sch_cake has to first be configured with host fairness disabled, and while running in this mode, a hash collision has to occur to cause the
st be configured with host fairness disabled, and while running in this mode, a hash collision has to occur to cause the overflow. Then, the qdisc has to be reconfigured to enable host fairness, which leads to the array out-of-bounds because the wrapped-around value is retained and used as an array index. It seems that syzbot managed to trigger this, which is quite impressive in its own right. This patch fixes the issue by introducing the same conditional check on decrement as is used on increment. The original bug predates the upstreaming of cake, but the commit listed in the Fixes tag touched that code, meaning that this patch won't apply before that. Additional Analyst Notes: - CISA ADP V
the Fixes tag touched that code, meaning that this patch won't apply before that. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4a4eeefa514db570be025ab46d779af180e2c9bb - https://git.kernel.org/stable/c/7725152b54d295b7da5e34c2f419539b30d017bd - https://git.kernel.org/stable/c/cde71a5677971f4f1b69b25e854891dbe78066a4 - https://git.kernel.org/stable/c/549e407569e08459d16122341d332cb508024094 - https://git.kernel.org/stable/c/d4a9039a7b3d8005b90c7b1a55a306444f0e5447 - https://git.kernel.org/stable/c/d7c01c0714c04431b5e18cf17a9ea68a553d1c3c - https://git.kernel.org/stable/c/546ea84d07e3e324644025e2aae2d12ea4c5896e
CVE ID: CVE-2024-46829 State: PUBLISHED Published: 2024-09-27T12:39:27.764Z Last Updated: 2025-11-03T22:19:19.780Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case it emits a warning and goes into an endless scheduling loop with the lock held, which triggers the 'scheduling in atomic' warning. Unlock rt_mutex::wait_lock in the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before
the dead lock case before issuing the warning and dropping into the schedule for ever loop. [ tglx: Moved unlock before the WARN(), removed the pointless comment, massaged changelog, added Fixes tag ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/432efdbe7da5ecfcbc0c2180cfdbab1441752a38 - https://git.kernel.org/stable/c/6a976e9a47e8e5b326de671811561cab12e6fb1f - https://git.kernel.org/stable/c/1401da1486dc1cdbef6025fd74a3977df3a3e5d0 - https://git.kernel.org/stable/c/93f44655472d9cd418293d328f9d141ca234ad83 - https://git.kernel.org/stable/c/a92d81c9efec9280681c27a2c0a963fd0f1338e0 - https://git.kernel.org/stable/c/85
a234ad83 - https://git.kernel.org/stable/c/a92d81c9efec9280681c27a2c0a963fd0f1338e0 - https://git.kernel.org/stable/c/85f03ca98e07cd0786738b56ae73740bce0ac27f - https://git.kernel.org/stable/c/f13b5afc5c4889569d84c3011ce449f61fccfb28 - https://git.kernel.org/stable/c/d33d26036a0274b472299d7dcdaa5fb34329f91b
CVE ID: CVE-2024-46830 State: PUBLISHED Published: 2024-09-27T12:39:28.396Z Last Updated: 2025-11-03T22:19:21.236Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX reads guest memory. Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN via sync_regs(), which already holds SRCU. I.e. trying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU is
rying to precisely use kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause problems. Acquiring SRCU isn't all that expensive, so for simplicity, grab it unconditionally for KVM_SET_VCPU_EVENTS. ============================= WARNING: suspicious RCU usage 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted ----------------------------- include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by repro/1071: #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713
}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm] stack backtrace: CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: <TASK> dump_stack_lvl+0x7f/0x90 lockdep_rcu_suspicious+0x13f/0x1a0 kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm] kvm_vcpu_read_guest+0x3e/0x90 [kvm] nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel] load_vmcs12_host_state+0x432/0xb40 [kvm_intel] vmx_leave_nested+0x30/0x40 [kvm_intel] kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm] kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+
0 [kvm] ? mark_held_locks+0x49/0x70 ? kvm_vcpu_ioctl+0x7d/0x970 [kvm] ? kvm_vcpu_ioctl+0x497/0x970 [kvm] kvm_vcpu_ioctl+0x497/0x970 [kvm] ? lock_acquire+0xba/0x2d0 ? find_held_lock+0x2b/0x80 ? do_user_addr_fault+0x40c/0x6f0 ? lock_release+0xb7/0x270 __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x6c/0x170 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7ff11eb1b539 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fa297c33faefe51e10244e8a378837fca4963228 - https://git.kernel.org/stable/c/939375737b5a0b1bf9b1e75129054e11bc9ca65e - https://git.kernel.org/stable/c/ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9 - https://gi
7b5a0b1bf9b1e75129054e11bc9ca65e - https://git.kernel.org/stable/c/ecdbe8ac86fb5538ccc623a41f88ec96c7168ab9 - https://git.kernel.org/stable/c/4bcdd831d9d01e0fb64faea50732b59b2ee88da1
CVE ID: CVE-2024-46831 State: PUBLISHED Published: 2024-09-27T12:39:29.078Z Last Updated: 2025-05-04T09:35:28.677Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b0804c286ccfcf5f5c004d5bf8a54c0508b5e86b - https://git.kernel.org/stable/c/f7fe95f40c85311c98913fe6ae2c56adb7f767a7 - https://git.kernel.org/stable/c/a3c1e45156ad39f225cd7ddae0f81230a3b1e657
CVE ID: CVE-2024-46832 State: PUBLISHED Published: 2024-09-27T12:39:29.734Z Last Updated: 2025-11-03T22:19:22.692Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warning: [ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Caused by get_c0_compare_int on secondary CPU. We also skipped saving IRQ number to struct clock_event_device *cd as it's never used by clockevent core, as per comments it's only meant for "non CPU local devices". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Containe
s it's only meant for "non CPU local devices". Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d3ff0f98a52f0aafe35aa314d1c442f4318be3db - https://git.kernel.org/stable/c/e6cd871627abbb459d0ff6521d6bb9cf9d9f7522 - https://git.kernel.org/stable/c/b1d2051373bfc65371ce4ac8911ed984d0178c98 - https://git.kernel.org/stable/c/32ee0520159f1e8c2d6597c19690df452c528f30 - https://git.kernel.org/stable/c/189d3ed3b25beee26ffe2abed278208bece13f52 - https://git.kernel.org/stable/c/50f2b98dc83de7809a5c5bf0ccf9af2e75c37c13
CVE ID: CVE-2024-46833 State: PUBLISHED Published: 2024-09-27T12:39:30.401Z Last Updated: 2025-05-04T09:35:31.782Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: void array out of bound when loop tnl_num When query reg inf of SSU, it loops tnl_num times. However, tnl_num comes from hardware and the length of array is a fixed value. To void array out of bound, make sure the loop time is not greater than the length of array Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c33a9806dc806bcb4a31dc71fb06979219181ad4 - https://git.kernel.org/stable/c/86db7bfb06704ef17340eeae71
ernel.org/stable/c/c33a9806dc806bcb4a31dc71fb06979219181ad4 - https://git.kernel.org/stable/c/86db7bfb06704ef17340eeae71c832f21cfce35c
CVE ID: CVE-2024-46834 State: PUBLISHED Published: 2024-09-27T12:39:31.110Z Last Updated: 2025-05-04T09:35:33.320Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ethtool: fail closed if we can't get max channel used in indirection tables Commit 0d1b7d6c9274 ("bnxt: fix crashes when reducing ring count with active RSS contexts") proves that allowing indirection table to contain channels with out of bounds IDs may lead to crashes. Currently the max channel check in the core gets skipped if driver can't fetch the indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do ha
indirection table or when we can't allocate memory. Both of those conditions should be extremely rare but if they do happen we should try to be safe and fail the channel change. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/101737d8b88dbd4be6010bac398fe810f1950036 - https://git.kernel.org/stable/c/2899d58462ba868287d6ff3acad3675e7adf934f
CVE ID: CVE-2024-46835 State: PUBLISHED Published: 2024-09-27T12:39:31.776Z Last Updated: 2025-11-03T22:19:24.142Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix smatch static checker warning adev->gfx.imu.funcs could be NULL Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d40c2c3dd0395fe7fdc19bd96551e87251426d66 - https://git.kernel.org/stable/c/8bc7b3ce33e64c74211ed17aec823fc4e523426a - https://git.kernel.org/stable/c/c2056c7a840f0dbf293bc3b0d91826d001668fb0 - https://git.kernel.org/stable/c/bdbdc7cecd00305dc844a361f9883d3a21022027
CVE ID: CVE-2024-46836 State: PUBLISHED Published: 2024-09-27T12:39:32.432Z Last Updated: 2025-11-03T22:19:25.585Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed_udc: validate endpoint index for ast udc We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array. Found by static analysis. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/31bd4fab49c0adc6228848357c1b1df9395858af - https://git.kernel.org/stable/c/b2a50ffdd1a079869a62198a8d1441355c513c7c - https://git.kernel.org/stab
c1b1df9395858af - https://git.kernel.org/stable/c/b2a50ffdd1a079869a62198a8d1441355c513c7c - https://git.kernel.org/stable/c/6fe9ca2ca389114c8da66e534c18273497843e8a - https://git.kernel.org/stable/c/ee0d382feb44ec0f445e2ad63786cd7f3f6a8199
CVE ID: CVE-2024-46837 State: PUBLISHED Published: 2024-09-27T12:39:33.089Z Last Updated: 2025-05-04T09:35:37.768Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Restrict high priorities on group_create We were allowing any users to create a high priority group without any permission checks. As a result, this was allowing possible denial of service. We now only allow the DRM master or users with the CAP_SYS_NICE capability to set higher priorities than PANTHOR_GROUP_PRIORITY_MEDIUM. As the sole user of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do. Additionally, as those chec
er of that uAPI lives in Mesa and hardcode a value of MEDIUM [1], this should be safe to do. Additionally, as those checks are performed at the ioctl level, panthor_group_create now only check for priority level validity. [1]https://gitlab.freedesktop.org/mesa/mesa/-/blob/f390835074bdf162a63deb0311d1a6de527f9f89/src/gallium/drivers/panfrost/pan_csf.c#L1038 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/33eb0344e186a2bcc257c6c5a6e65c1cb42adb4a - https://git.kernel.org/stable/c/5f7762042f8a5377bd8a32844db353c0311a7369