Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For TCP, this causes a NULL ptr deref in __tcpv4_gso_segment_list_csum at tcp_hdr(seg->next). Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Approach and description based on a patch by Willem de Bruijn. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f
ijn. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f1b5585245c51e0355c9f46 - https://git.kernel.org/stable/c/2d4a83a44428de45bfe9dccb0192a3711d1097e0 - https://git.kernel.org/stable/c/17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8
CVE ID: CVE-2024-49980 State: PUBLISHED Published: 2024-10-21T18:02:26.494Z Last Updated: 2025-05-04T09:42:55.208Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: vrf: revert "vrf: Remove unnecessary RCU-bh critical section" This reverts commit 504fc6f4f7f681d2a03aa5f68aad549d90eab853. dev_queue_xmit_nit is expected to be called with BH disabled. __dev_queue_xmit has the following: /* Disable soft irqs for various locks below. Also * stops preemption for RCU. */ rcu_read_lock_bh(); VRF must follow this invariant. The referenced commit removed this protection. Which triggered a lockdep warning: ================================ WA
t. The referenced commit removed this protection. Which triggered a lockdep warning: ================================ WARNING: inconsistent lock state 6.11.0 #1 Tainted: G W -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. btserver/134819 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff8882da30c118 (rlock-AF_PACKET){+.?.}-{2:2}, at: tpacket_rcv+0x863/0x3b30 {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x19a/0x4f0 _raw_spin_lock+0x27/0x40 packet_rcv+0xa33/0x1320 __netif_receive_skb_core.constprop.0+0xcb0/0x3a90 __netif_receive_skb_list_core+0x2c9/0x890 netif_receive_skb_list_internal+0x610/0xcc0 [...] other info that might help us debug this: Possible unsafe lo
2c9/0x890 netif_receive_skb_list_internal+0x610/0xcc0 [...] other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rlock-AF_PACKET); <Interrupt> lock(rlock-AF_PACKET); *** DEADLOCK *** Call Trace: <TASK> dump_stack_lvl+0x73/0xa0 mark_lock+0x102e/0x16b0 __lock_acquire+0x9ae/0x6170 lock_acquire+0x19a/0x4f0 _raw_spin_lock+0x27/0x40 tpacket_rcv+0x863/0x3b30 dev_queue_xmit_nit+0x709/0xa40 vrf_finish_direct+0x26e/0x340 [vrf] vrf_l3_out+0x5f4/0xe80 [vrf] __ip_local_out+0x51e/0x7a0 [...] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/718a752bd746b3f4dd62516bb437baf73d548415 - https://git.kernel.org/stable/c/8c9381b
es: - https://git.kernel.org/stable/c/718a752bd746b3f4dd62516bb437baf73d548415 - https://git.kernel.org/stable/c/8c9381b3138246d46536db93ed696832abd70204 - https://git.kernel.org/stable/c/e61f8c4d179b2ffc0d3b7f821c3734be738643d0 - https://git.kernel.org/stable/c/b04c4d9eb4f25b950b33218e33b04c94e7445e51
CVE ID: CVE-2024-49981 State: PUBLISHED Published: 2024-10-21T18:02:27.142Z Last Updated: 2025-11-03T22:24:00.609Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race condition in venus_probe, core->work is bound with venus_sys_error_handler, which is used to handle error. The code use core->sys_err_done to make sync work. The core->work is started in venus_event_notify. If we call venus_remove, there might be an unfished work. The possible sequence is as follows: CPU0 CPU1 |venus_sys_error_handler venus_remove | hfi_destroy | venus_hfi_destroy | kfree(hdev); | |hfi_re
s as follows: CPU0 CPU1 |venus_sys_error_handler venus_remove | hfi_destroy | venus_hfi_destroy | kfree(hdev); | |hfi_reinit |venus_hfi_queues_reinit |//use hdev Fix it by canceling the work in venus_remove. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5098b9e6377577fe13d03e1d8914930f014a3314 - https://git.kernel.org/stable/c/63bbe26471ebdcc3c20bb4cc3950d666279ad658 - https://git.kernel.org/stable/c/60b6968341a6dd5353554f3e72db554693a128a5 - https://git.kernel.org/stable/c/bf6be32e2d39f6301ff1831e249d32a8744ab28a - https://git.kernel.org/stable/c/2a541fcc0bd2b05a458e9613376df1289ec11621 - https://git.kernel.org/stab
49d32a8744ab28a - https://git.kernel.org/stable/c/2a541fcc0bd2b05a458e9613376df1289ec11621 - https://git.kernel.org/stable/c/b0686aedc5f1343442d044bd64eeac7e7a391f4e - https://git.kernel.org/stable/c/d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c - https://git.kernel.org/stable/c/10941d4f99a5a34999121b314afcd9c0a1c14f15 - https://git.kernel.org/stable/c/c5a85ed88e043474161bbfe54002c89c1cb50ee2
CVE ID: CVE-2024-49982 State: PUBLISHED Published: 2024-10-21T18:02:27.820Z Last Updated: 2025-11-03T22:24:03.908Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of doing in aoecmd_cfg_pkts(). It avoids that the tx() runs into use-after-free. Then Nicolai Stange found more places in aoe have potential use-after-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions
ter-free problem with tx(). e.g. revalidate(), aoecmd_ata_rw(), resend(), probe() and aoecmd_cfg_rsp(). Those functions also use aoenet_xmit() to push packet to tx queue. So they should also use dev_hold() to increase the refcnt of skb->dev. On the other hand, moving dev_put() to tx() causes that the refcnt of skb->dev be reduced to a negative value, because corresponding dev_hold() are not called in revalidate(), aoecmd_ata_rw(), resend(), probe(), and aoecmd_cfg_rsp(). This patch fixed this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e - https://git.kernel.org/stable/
References: - https://git.kernel.org/stable/c/12f7b89dd72b25da4eeaa22097877963cad6418e - https://git.kernel.org/stable/c/a786265aecf39015418e4f930cc1c14603a01490 - https://git.kernel.org/stable/c/f63461af2c1a86af4217910e47a5c46e3372e645 - https://git.kernel.org/stable/c/07b418d50ccbbca7e5d87a3a0d41d436cefebf79 - https://git.kernel.org/stable/c/bc2cbf7525ac288e07d465f5a1d8cb8fb9599254 - https://git.kernel.org/stable/c/acc5103a0a8c200a52af7d732c36a8477436a3d3 - https://git.kernel.org/stable/c/89d9a69ae0c667e4d9d028028e2dcc837bae626f - https://git.kernel.org/stable/c/8253a60c89ec35c8f36fb2cc08cdf854c7a3eb58 - https://git.kernel.org/stable/c/6d6e54fc71ad1ab0a87047fd9c211e75d86084a3
CVE ID: CVE-2024-49983 State: PUBLISHED Published: 2024-10-21T18:02:28.474Z Last Updated: 2025-11-03T22:24:05.400Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process: ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(&ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth > path[0]
lit_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!! So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4_find_extent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4_find_extent() instead of using strange error codes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf - https://git.ker
gram Container: References: - https://git.kernel.org/stable/c/8c26d9e53e5fbacda0732a577e97c5a5b7882aaf - https://git.kernel.org/stable/c/a34bed978364114390162c27e50fca50791c568d - https://git.kernel.org/stable/c/6367d3f04c69e2b8770b8137bd800e0784b0abbc - https://git.kernel.org/stable/c/1b558006d98b7b0b730027be0ee98973dd10ee0d - https://git.kernel.org/stable/c/3ff710662e8d86a63a39b334e9ca0cb10e5c14b0 - https://git.kernel.org/stable/c/63adc9016917e6970fb0104ee5fd6770f02b2d80 - https://git.kernel.org/stable/c/5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95
CVE ID: CVE-2024-49984 State: PUBLISHED Published: 2024-10-21T18:02:29.151Z Last Updated: 2025-05-04T09:43:01.904Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Prevent out of bounds access in performance query extensions Check that the number of perfmons userspace is passing in the copy and reset extensions is not greater than the internal kernel storage where the ids will be copied into. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3e50d72abe50204c7b19784a66e86da29dde32c2 - https://git.kernel.org/stable/c/d9536f16be3970c170571efa707c13cd089c774e - https://git.kerne
c7b19784a66e86da29dde32c2 - https://git.kernel.org/stable/c/d9536f16be3970c170571efa707c13cd089c774e - https://git.kernel.org/stable/c/f32b5128d2c440368b5bf3a7a356823e235caabb
CVE ID: CVE-2024-49985 State: PUBLISHED Published: 2024-10-21T18:02:29.827Z Last Updated: 2025-11-03T22:24:06.897Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex. This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, in
tex. This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, including its I2C access. The I2C access resumes this I2C bus controller via .runtime_resume callback, which calls clk_prepare_enable(), which attempts to grab the prepare_lock mutex again and deadlocks. Since the clock are already prepared since probe() and unprepared in remove(), use simple clk_enable()/clk_disable() calls to enable and disable the clock on runtime suspend and resume, to avoid hitting the prepare_lock mutex. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d6f1250a4d5773f447740b9fe37b8
A ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d6f1250a4d5773f447740b9fe37b8692105796d4 - https://git.kernel.org/stable/c/9b8bc33ad64192f54142396470cc34ce539a8940 - https://git.kernel.org/stable/c/1883cad2cc629ded4a3556c0bbb8b42533ad8764 - https://git.kernel.org/stable/c/c2024b1a583ab9176c797ea1e5f57baf8d5e2682 - https://git.kernel.org/stable/c/22a1f8a5b56ba93d3e8b7a1dafa24e01c8bb48ba - https://git.kernel.org/stable/c/fac3c9f7784e8184c0338e9f0877b81e55d3ef1c - https://git.kernel.org/stable/c/894cd5f5fd9061983445bbd1fa3d81be43095344 - https://git.kernel.org/stable/c/048bbbdbf85e5e00258dfb12f5e368f908801d7b
CVE ID: CVE-2024-49986 State: PUBLISHED Published: 2024-10-21T18:02:30.507Z Last Updated: 2025-11-03T22:24:08.353Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors x86_android_tablet_remove() frees the pdevs[] array, so it should not be used after calling x86_android_tablet_remove(). When platform_device_register() fails, store the pdevs[x] PTR_ERR() value into the local ret variable before calling x86_android_tablet_remove() to avoid using pdevs[] after it has been freed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
e() to avoid using pdevs[] after it has been freed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ba0b09a2f327319e252d8f3032019b958c0a5cd9 - https://git.kernel.org/stable/c/aac871e493fc8809e60209d9899b1af07e9dbfc8 - https://git.kernel.org/stable/c/f08adc5177bd4343df09033f62ab562c09ba7f7d - https://git.kernel.org/stable/c/73a98cf79e4dbfa3d0c363e826c65aae089b313c - https://git.kernel.org/stable/c/2fae3129c0c08e72b1fe93e61fd8fd203252094a
CVE ID: CVE-2024-49987 State: PUBLISHED Published: 2024-10-21T18:02:31.209Z Last Updated: 2025-05-21T09:13:35.009Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of l
g qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions: "Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf
by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c2d9f9a7837ab29ccae0c42252f17d436bf0a501 - https://git.kernel.org/stable/c/2e0f6f33f2aa87493b365a38a8fd87b8854b7734 - https://git.kernel.org/stable/c/c208b02827eb642758cef65641995fd3f38c89af - https://git.kernel.org/stable/c/f04e2ad394e2755d0bb2d858ecb5598718bf00d5
CVE ID: CVE-2024-49988 State: PUBLISHED Published: 2024-10-21T18:02:31.845Z Last Updated: 2025-05-04T09:43:07.578Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: add refcnt to ksmbd_conn struct When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18f06bacc197d4ac9b518ad1c69999bc3d83e7aa - https://git.kernel.org/stable/c/9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b - http
f06bacc197d4ac9b518ad1c69999bc3d83e7aa - https://git.kernel.org/stable/c/9fd3cde4628bcd3549ab95061f2bab74d2ed4f3b - https://git.kernel.org/stable/c/e9dac92f4482a382e8c0fe1bc243da5fc3526b0c - https://git.kernel.org/stable/c/ee426bfb9d09b29987369b897fe9b6485ac2be27
CVE ID: CVE-2024-49989 State: PUBLISHED Published: 2024-10-21T18:02:32.507Z Last Updated: 2025-11-03T19:31:34.549Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix double free issue during amdgpu module unload Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occur when unloading the amdgpu module. [ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0 [ 279.190577] Call Trace: [ 279.190580] <TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601
<TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601] ? do_error_trap+0x73/0xa0 [ 279.190605] ? __slab_free+0x152/0x2f0 [ 279.190609] ? exc_invalid_op+0x56/0x70 [ 279.190616] ? __slab_free+0x152/0x2f0 [ 279.190642] ? asm_exc_invalid_op+0x1f/0x30 [ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191096] ? __slab_free+0x152/0x2f0 [ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191469] kfree+0x260/0x2b0 [ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191821] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [a
21] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [amdgpu] [ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu] [ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu] [ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu] [ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu] [ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu] [ 279.194632] pci_device_remove+0x3a/0xa0 [ 279.194638] device_remove+0x40/0x70 [ 279.194642] device_release_driver_internal+0x1ad/0x210 [ 279.194647] driver_detach+0x4e/0xa0 [ 279.194650] bus_remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.19
remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu] [ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0 [ 279.194946] __x64_sys_delete_module+0x16/0x20 [ 279.194950] do_syscall_64+0x58/0x120 [ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 279.194980] </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/43c296870740a3a264cdca9f18db12e12e9cfbdb - https://git.kernel.org/stable/c/df948b5ba6858d5da34f622d408e5517057cec07 - https://git.kernel.org/stable/c/cf6f3ebd6312d465fee096d1f58089b177c7c67f - https:/
b5ba6858d5da34f622d408e5517057cec07 - https://git.kernel.org/stable/c/cf6f3ebd6312d465fee096d1f58089b177c7c67f - https://git.kernel.org/stable/c/7af9e6fa63dbd43a61d4ecc8f59426596a75e507 - https://git.kernel.org/stable/c/3c0ff4de45ce2c5f7997a1ffa6eefee4b79e6b58 - https://git.kernel.org/stable/c/20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d
CVE ID: CVE-2024-49990 State: PUBLISHED Published: 2024-10-21T18:02:33.167Z Last Updated: 2025-05-04T09:43:10.703Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Check GSC structure validity Sometimes xe_gsc is not initialized when checked at HDCP capability check. Add gsc structure check to avoid null pointer error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c940627857eedca8407b84b40ceb4252b100d291 - https://git.kernel.org/stable/c/7266a424b1e502745170322e3c27f697d12de627 - https://git.kernel.org/stable/c/b4224f6bae3801d589f815672ec62800a1501b0d
CVE ID: CVE-2024-49991 State: PUBLISHED Published: 2024-10-21T18:02:33.805Z Last Updated: 2025-11-03T22:24:09.828Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer Pass pointer reference to amdgpu_bo_unref to clear the correct pointer, otherwise amdgpu_bo_unref clear the local variable, the original pointer not set to NULL, this could cause use-after-free bug. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c - https://git.kernel.org/stable/c/30ceb873cc2e97348d9
//git.kernel.org/stable/c/e7831613cbbcd9058d3658fbcdc5d5884ceb2e0c - https://git.kernel.org/stable/c/30ceb873cc2e97348d9da2265b2d1ddf07f682e1 - https://git.kernel.org/stable/c/71f3240f82987f0f070ea5bed559033de7d4c0e1 - https://git.kernel.org/stable/c/6c9289806591807e4e3be9a23df8ee2069180055 - https://git.kernel.org/stable/c/c86ad39140bbcb9dc75a10046c2221f657e8083b
CVE ID: CVE-2024-49992 State: PUBLISHED Published: 2024-10-21T18:02:34.442Z Last Updated: 2025-11-03T22:24:11.293Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/stm: Avoid use-after-free issues with crtc and plane ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1]. Use allocations managed by the DRM framework. Found by Linux Verification Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diuj
tion Center (linuxtesting.org). [1] https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d02611ff001454358be6910cb926799e2d818716 - https://git.kernel.org/stable/c/0a1741d10da29aa84955ef89ae9a03c4b6038657 - https://git.kernel.org/stable/c/454e5d7e671946698af0f201e48469e5ddb42851 - https://git.kernel.org/stable/c/b22eec4b57d04befa90e8554ede34e6c67257606 - https://git.kernel.org/stable/c/19dd9780b7ac673be95bf6fd6892a184c9db611f
CVE ID: CVE-2024-49993 State: REJECTED Published: 2024-10-21T18:02:35.075Z Last Updated: 2024-11-10T09:39:42.506Z Description: No description available.
CVE ID: CVE-2024-49994 State: PUBLISHED Published: 2024-10-21T18:02:35.722Z Last Updated: 2025-11-03T20:42:46.112Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blk_ioctl_discard() but for secure erase. Same problem: uint64_t r[2] = {512, 18446744073709551104ULL}; ioctl(fd, BLKSECDISCARD, r); will enter near infinite loop inside blkdev_issue_secure_erase(): a.out: attempt to access beyond end of device loop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048 bio_check_eod: 3286214
tempt to access beyond end of device loop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048 bio_check_eod: 3286214 callbacks suppressed Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8476f8428e8b48fd7a0e4258fa2a96a8f4468239 - https://git.kernel.org/stable/c/a99bacb35c1416355eef957560e8fcac3a665549 - https://git.kernel.org/stable/c/0842ddd83939eb4db940b9af7d39e79722bc41aa - https://git.kernel.org/stable/c/6c9915fa9410cbb9bd75ee283c03120046c56d3d - https://git.kernel.org/stable/c/697ba0b6ec4ae04afb67d3911799b5e2043b4455
CVE ID: CVE-2024-49995 State: REJECTED Published: 2024-10-21T18:02:36.411Z Last Updated: 2025-04-24T13:44:04.982Z Description: No description available.