Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50050 State: PUBLISHED Published: 2024-10-23T13:35:17.320Z Last Updated: 2024-10-24T18:26:22.699Z Vendors: Meta Platforms, Inc Products: Llama Stack Problem Types: Deserialization of Untrusted Data (CWE-502) Description: Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.facebook.com/security/advisories/cve-2024-50050
CVE ID: CVE-2024-50051 State: PUBLISHED Published: 2025-01-11T12:25:20.277Z Last Updated: 2025-11-03T20:43:19.203Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work will be used. The sequence of operations that may lead to a UAF bug. Fix it by ensuring that the work is canceled before proceeding with the cleanup in mpc52xx_spi_remove. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.
pi_remove. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1 - https://git.kernel.org/stable/c/e0c6ce8424095c2da32a063d3fc027494c689817 - https://git.kernel.org/stable/c/cd5106c77d6d6828aa82449f01f4eb436d602a21 - https://git.kernel.org/stable/c/373d55a47dc662e5e30d12ad5d334312f757c1f1 - https://git.kernel.org/stable/c/f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59 - https://git.kernel.org/stable/c/90b72189de2cddacb26250579da0510b29a8b82b - https://git.kernel.org/stable/c/984836621aad98802d92c4a3047114cf518074c8
CVE ID: CVE-2024-50052 State: PUBLISHED Published: 2024-10-29T08:10:17.129Z Last Updated: 2024-10-29T12:52:31.657Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-862 Description: Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-50053 State: PUBLISHED Published: 2025-03-21T06:01:39.945Z Last Updated: 2025-05-05T13:24:19.125Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N) Vendors: ManageEngine Products: ServiceDesk Plus, ServiceDesk Plus MSP, SupportCentre Plus Problem Types: CWE-79 Description: Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.manageengine.com/products/service-desk/CVE-2024-50053.html
CVE ID: CVE-2024-50054 State: PUBLISHED Published: 2024-11-22T22:22:08.207Z Last Updated: 2024-11-26T16:59:05.931Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: mySCADA Products: myPRO Manager, myPRO Runtime Problem Types: CWE-35 Description: The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-07
CVE ID: CVE-2024-50055 State: PUBLISHED Published: 2024-10-21T19:39:46.476Z Last Updated: 2025-11-03T20:43:22.001Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/87bc3cb23c56de2c5e14a58d87cf953e7a2508f8 - https://git.kernel.org/stable/c/5be4bc1c73ca389a96d418a52054d897c6fe6d21 - https://gi
3c56de2c5e14a58d87cf953e7a2508f8 - https://git.kernel.org/stable/c/5be4bc1c73ca389a96d418a52054d897c6fe6d21 - https://git.kernel.org/stable/c/4797953712214ea57a437443bb0ad6d1e0646d70 - https://git.kernel.org/stable/c/fc1f391a71a3ee88291e205cffd673fe24d99266 - https://git.kernel.org/stable/c/d885c464c25018b81a6b58f5d548fc2e3ef87dd1 - https://git.kernel.org/stable/c/9ce15f68abedfae7ae0a35e95895aeddfd0f0c6a - https://git.kernel.org/stable/c/bfa54a793ba77ef696755b66f3ac4ed00c7d1248
CVE ID: CVE-2024-50056 State: PUBLISHED Published: 2024-10-21T19:39:47.131Z Last Updated: 2025-11-03T19:31:37.303Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix ERR_PTR dereference in uvc_v4l2.c Fix potential dereferencing of ERR_PTR() in find_format_by_pix() and uvc_v4l2_enum_format(). Fix the following smatch errors: drivers/usb/gadget/function/uvc_v4l2.c:124 find_format_by_pix() error: 'fmtdesc' dereferencing possible ERR_PTR() drivers/usb/gadget/function/uvc_v4l2.c:392 uvc_v4l2_enum_format() error: 'fmtdesc' dereferencing possible ERR_PTR() Also, fix similar issue in uvc_v4l2_try_format() for potentia
format() error: 'fmtdesc' dereferencing possible ERR_PTR() Also, fix similar issue in uvc_v4l2_try_format() for potential dereferencing of ERR_PTR(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/03fa71e97e9bb116993ec1d51b8a6fe776db0984 - https://git.kernel.org/stable/c/72a68d2bede3284b95ee93a5ab3a81758bba95b0 - https://git.kernel.org/stable/c/cedeb36c3ff4acd0f3d09918dfd8ed1df05efdd6 - https://git.kernel.org/stable/c/a7bb96b18864225a694e3887ac2733159489e4b0
CVE ID: CVE-2024-50057 State: PUBLISHED Published: 2024-10-21T19:39:47.768Z Last Updated: 2025-07-28T11:16:43.751Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: Free IRQ only if it was requested before In polling mode, if no IRQ was requested there is no need to free it. Call devm_free_irq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal: WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devm_free_irq+0x80/0x8c ... ... Call trace: devm_free_irq+0x80/0x8c tps6598x_remove+0x28/0x88 [tps6598x] i2c_device_remove+0x2c/0x9c device_remove+0x4c/0x80 device_release_driver_in
0/0x8c tps6598x_remove+0x28/0x88 [tps6598x] i2c_device_remove+0x2c/0x9c device_remove+0x4c/0x80 device_release_driver_internal+0x1cc/0x228 driver_detach+0x50/0x98 bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 i2c_del_driver+0x54/0x64 tps6598x_i2c_driver_exit+0x18/0xc3c [tps6598x] __arm64_sys_delete_module+0x184/0x264 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0xc8/0xe8 do_el0_svc+0x20/0x2c el0_svc+0x28/0x98 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b72bf5cade51ba4055c8a8998d275e72e6b521ce - https://git.kernel.org/stable/c/4d4b23c119542fbaed2a16794d3801cb4806ea0
ble/c/b72bf5cade51ba4055c8a8998d275e72e6b521ce - https://git.kernel.org/stable/c/4d4b23c119542fbaed2a16794d3801cb4806ea02 - https://git.kernel.org/stable/c/db63d9868f7f310de44ba7bea584e2454f8b4ed0
CVE ID: CVE-2024-50058 State: PUBLISHED Published: 2024-10-21T19:39:48.420Z Last Updated: 2025-11-03T22:24:57.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: protect uart_port_dtr_rts() in uart_shutdown() too Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part 3) added few uport == NULL checks. It added one to uart_shutdown(), so the commit assumes, uport can be NULL in there. But right after that protection, there is an unprotected "uart_port_dtr_rts(uport, false);" call. That is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports. Or it cannot b
is invoked only if HUPCL is set, so I assume that is the reason why we do not see lots of these reports. Or it cannot be NULL at this point at all for some reason :P. Until the above is investigated, stay on the safe side and move this dereference to the if too. I got this inconsistency from Coverity under CID 1585130. Thanks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2fe399bb8efd0d325ab1138cf8e3ecf23a39e96d - https://git.kernel.org/stable/c/399927f0f875b93f3d5a0336d382ba48b8671eb2 - https://git.kernel.org/stable/c/d7b5876a6e74cdf8468a478be6b23f2f5464ac7a - https://git.kernel.org/stable/c/e418d91195d29d5f9c9685f
t.kernel.org/stable/c/d7b5876a6e74cdf8468a478be6b23f2f5464ac7a - https://git.kernel.org/stable/c/e418d91195d29d5f9c9685ff309b92b04b41dc40 - https://git.kernel.org/stable/c/76ed24a34223bb2c6b6162e1d8389ec4e602a290 - https://git.kernel.org/stable/c/602babaa84d627923713acaf5f7e9a4369e77473
CVE ID: CVE-2024-50059 State: PUBLISHED Published: 2024-10-21T19:39:49.079Z Last Updated: 2025-11-03T22:24:58.655Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition In the switchtec_ntb_add function, it can call switchtec_ntb_init_sndev function, then &sndev->check_link_status_work is bound with check_link_status_work. switchtec_ntb_link_notification may be called to start the work. If we remove the module which will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above
will call switchtec_ntb_remove to make cleanup, it will free sndev through kfree(sndev), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | check_link_status_work switchtec_ntb_remove | kfree(sndev); | | if (sndev->link_force_down) | // use sndev Fix it by ensuring that the work is canceled before proceeding with the cleanup in switchtec_ntb_remove. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5126d8f5567f49b52e21fca320eaa97977055099 - https://git.kernel.org/stable/c/b650189687822b705711f0567a65a164a314d8df - https://git.kernel.org/stable/c/9
977055099 - https://git.kernel.org/stable/c/b650189687822b705711f0567a65a164a314d8df - https://git.kernel.org/stable/c/92728fceefdaa2a0a3aae675f86193b006eeaa43 - https://git.kernel.org/stable/c/3ae45be8492460a35b5aebf6acac1f1d32708946 - https://git.kernel.org/stable/c/fa840ba4bd9f3bad7f104e5b32028ee73af8b3dd - https://git.kernel.org/stable/c/177925d9c8715a897bb79eca62628862213ba956 - https://git.kernel.org/stable/c/e51aded92d42784313ba16c12f4f88cc4f973bbb
CVE ID: CVE-2024-50060 State: PUBLISHED Published: 2024-10-21T19:39:49.737Z Last Updated: 2025-11-03T22:25:00.157Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: check if we need to reschedule during overflow flush In terms of normal application usage, this list will always be empty. And if an application does overflow a bit, it'll have a few entries. However, nothing obviously prevents syzbot from running a test case that generates a ton of overflow entries, and then flushing them can take quite a while. Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to mai
hile. Check for needing to reschedule while flushing, and drop our locks and do so if necessary. There's no state to maintain here as overflows always prune from head-of-list, hence it's fine to drop and reacquire the locks at the end of the loop. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a2493904e95ce94bbec819d8f7f03b99976eb25c - https://git.kernel.org/stable/c/f4ce3b5d26ce149e77e6b8e8f2058aa80e5b034e - https://git.kernel.org/stable/c/c2eadeafce2d385b3f6d26a7f31fee5aba2bbbb0 - https://git.kernel.org/stable/c/eac2ca2d682f94f46b1973bdf5e77d85d77b8e53
CVE ID: CVE-2024-50061 State: PUBLISHED Published: 2024-10-21T19:39:50.415Z Last Updated: 2025-11-03T19:31:38.673Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition In the cdns_i3c_master_probe function, &master->hj_work is bound with cdns_i3c_master_hj. And cdns_i3c_master_interrupt can call cnds_i3c_master_demux_ibis function to start the work. If we remove the module which will call cdns_i3c_master_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequ
e cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | cdns_i3c_master_hj cdns_i3c_master_remove | i3c_master_unregister(&master->base) | device_unregister(&master->dev) | device_release | //free master->base | | i3c_master_do_daa(&master->base) | //use master->base Fix it by ensuring that the work is canceled before proceeding with the cleanup in cdns_i3c_master_remove. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2a21bad9964c91b34d65ba269914233720c0b1ce - https://git.kernel.org/
tainer: References: - https://git.kernel.org/stable/c/2a21bad9964c91b34d65ba269914233720c0b1ce - https://git.kernel.org/stable/c/ea0256e393e0072e8c80fd941547807f0c28108b - https://git.kernel.org/stable/c/687016d6a1efbfacdd2af913e2108de6b75a28d5 - https://git.kernel.org/stable/c/609366e7a06d035990df78f1562291c3bf0d4a12
CVE ID: CVE-2024-50062 State: PUBLISHED Published: 2024-10-21T19:39:51.078Z Last Updated: 2025-11-03T22:25:02.147Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Avoid null pointer deref during path establishment For RTRS path establishment, RTRS client initiates and completes con_num of connections. After establishing all its connections, the information is exchanged between the client and server through the info_req message. During this exchange, it is essential that all connections have been established, and the state of the RTRS srv path is CONNECTED. So add these sanity checks, to make sure we detect and abo
established, and the state of the RTRS srv path is CONNECTED. So add these sanity checks, to make sure we detect and abort process in error scenarios to avoid null pointer deref. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/394b2f4d5e014820455af3eb5859eb328eaafcfd - https://git.kernel.org/stable/c/b5d4076664465487a9a3d226756995b12fb73d71 - https://git.kernel.org/stable/c/ccb8e44ae3e2391235f80ffc6be59bec6b889ead - https://git.kernel.org/stable/c/b720792d7e8515bc695752e0ed5884e2ea34d12a - https://git.kernel.org/stable/c/d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb
CVE ID: CVE-2024-50063 State: PUBLISHED Published: 2024-10-21T19:39:51.718Z Last Updated: 2025-11-03T19:31:40.086Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one kernel function tail calls prog attached to another kernel function, the ctx access or return value verification could be bypassed. For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which take
assed. For example, if prog1 is attached to func1 which takes only 1 parameter and prog2 is attached to func2 which takes two parameters. Since verifier assumes the bpf ctx passed to prog2 is constructed based on func2's prototype, verifier allows prog2 to access the second parameter from the bpf ctx passed to it. The problem is that verifier does not prevent prog1 from passing its bpf ctx to prog2 via tail call. In this case, the bpf ctx passed to prog2 is constructed from func1 instead of func2, that is, the assumption for ctx access verification is bypassed. Another example, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_
ple, if BPF LSM prog1 is attached to hook file_alloc_security, and BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier knows the return value rules for these two hooks, e.g. it is legal for bpf_lsm_audit_rule_known to return positive number 1, and it is illegal for file_alloc_security to return positive number. So verifier allows prog2 to return positive number 1, but does not allow prog1 to return positive number. The problem is that verifier does not prevent prog1 from calling prog2 via tail call. In this case, prog2's return value 1 will be used as the return value for prog1's hook file_alloc_security. That is, the return value rule is bypassed. This patch adds restrictio
eturn value for prog1's hook file_alloc_security. That is, the return value rule is bypassed. This patch adds restriction for tail call to prevent such bypasses. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d9a807fb7cbfad4328824186e2e4bee28f72169b - https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1 - https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1 - https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356
CVE ID: CVE-2024-50064 State: PUBLISHED Published: 2024-10-21T19:39:52.348Z Last Updated: 2025-05-04T09:45:04.691Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: zram: free secondary algorithms names We need to kfree() secondary algorithms names when reset zram device that had multi-streams, otherwise we leak memory. [senozhatsky@chromium.org: kfree(NULL) is legal] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6272936fd242ca1f784c3e21596dfb3859dff276 - https://git.kernel.org/stable/c/ef35cc0d15b89dd013e1bb829fe97db7b1ab79eb - https://git.kernel.org/stable/c/684826f8271ad97580b1
/git.kernel.org/stable/c/ef35cc0d15b89dd013e1bb829fe97db7b1ab79eb - https://git.kernel.org/stable/c/684826f8271ad97580b138b9ffd462005e470b99
CVE ID: CVE-2024-50065 State: PUBLISHED Published: 2024-10-21T19:39:53.080Z Last Updated: 2025-05-04T12:59:27.090Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ntfs3: Change to non-blocking allocation in ntfs_d_hash d_hash is done while under "rcu-walk" and should not sleep. __get_name() allocates using GFP_KERNEL, having the possibility to sleep when under memory pressure. Change the allocation to GFP_NOWAIT. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c556e72cea2a1131ae418be017dd6fc76fffe2fb - https://git.kernel.org/stable/c/d0c710372e238510db08ea01e7b8bd81ed995dd6 - http
56e72cea2a1131ae418be017dd6fc76fffe2fb - https://git.kernel.org/stable/c/d0c710372e238510db08ea01e7b8bd81ed995dd6 - https://git.kernel.org/stable/c/589996bf8c459deb5bbc9747d8f1c51658608103
CVE ID: CVE-2024-50066 State: PUBLISHED Published: 2024-10-23T05:20:37.942Z Last Updated: 2025-05-04T09:45:07.606Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/mremap: fix move_normal_pmd/retract_page_tables race In mremap(), move_page_tables() looks at the type of the PMD entry and the specified address range to figure out by which method the next chunk of page table entries should be moved. At that point, the mmap_lock is held in write mode, but no rmap locks are held yet. For PMD entries that point to page tables and are fully covered by the source address range, move_pgt_entry(NORMAL_PMD, ...) is called, which first ta
page tables and are fully covered by the source address range, move_pgt_entry(NORMAL_PMD, ...) is called, which first takes rmap locks, then does move_normal_pmd(). move_normal_pmd() takes the necessary page table locks at source and destination, then moves an entire page table from the source to the destination. The problem is: The rmap locks, which protect against concurrent page table removal by retract_page_tables() in the THP code, are only taken after the PMD entry has been read and it has been decided how to move it. So we can race as follows (with two processes that have mappings of the same tmpfs file that is stored on a tmpfs mount with huge=advise); note that process A accesses pa
have mappings of the same tmpfs file that is stored on a tmpfs mount with huge=advise); note that process A accesses page tables through the MM while process B does it through the file rmap: process A process B ========= ========= mremap mremap_to move_vma move_page_tables get_old_pmd alloc_new_pmd *** PREEMPT *** madvise(MADV_COLLAPSE) do_madvise madvise_walk_vmas madvise_vma_behavior madvise_collapse hpage_collapse_scan_file collapse_file retract_page_tables i_mmap_lock_read(mapping) pmdp_collapse_flush i_mmap_unlock_read(mapping) move_pgt_entry(NORMAL_PMD, ...) take_rmap_locks move_normal_pmd drop_rmap_locks When this happens, move_normal_pmd() can end up creating bogus PMD entries in th
p_locks move_normal_pmd drop_rmap_locks When this happens, move_normal_pmd() can end up creating bogus PMD entries in the line `pmd_populate(mm, new_pmd, pmd_pgtable(pmd))`. The effect depends on arch-specific and machine-specific details; on x86, you can end up with physical page 0 mapped as a page table, which is likely exploitable for user->kernel privilege escalation. Fix the race by letting process B recheck that the PMD still points to a page table after the rmap locks have been taken. Otherwise, we bail and let the caller fall back to the PTE-level copying path, which will then bail immediately at the pmd_none() check. Bug reachability: Reaching this bug requires that you can create s
h will then bail immediately at the pmd_none() check. Bug reachability: Reaching this bug requires that you can create shmem/file THP mappings - anonymous THP uses different code that doesn't zap stuff under rmap locks. File THP is gated on an experimental config flag (CONFIG_READ_ONLY_THP_FOR_FS), so on normal distro kernels you need shmem THP to hit this bug. As far as I know, getting shmem THP normally requires that you can mount your own tmpfs with the right mount flags, which would require creating your own user+mount namespace; though I don't know if some distros maybe enable shmem THP by default or something like that. Bug impact: This issue can likely be used for user->kernel privile
e enable shmem THP by default or something like that. Bug impact: This issue can likely be used for user->kernel privilege escalation when it is reachable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/17396e32f975130b3e6251f024c8807d192e4c3e - https://git.kernel.org/stable/c/1552ce9ce8af47c0fe911682e5e1855e25851ca9 - https://git.kernel.org/stable/c/6fa1066fc5d00cb9f1b0e83b7ff6ef98d26ba2aa - https://project-zero.issues.chromium.org/issues/371047675