Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/12e2c520a0a4202575e4a45ea41f06a8e9aa3417 - https://git.kernel.org/stable/c/8be4e51f3ecfb0915e3510b600c4cce0dc68a383 - https://git.kernel.org/stable/c/380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6 - https://git.kernel.org/stable/c/2a5b8de6fcb944f9af0c5fcb30bb0c039705e051 - https://git.kernel.org/stable/c/06258e57fee253f4046d3a6a86d7fde09f596eac - https://git.kernel.org/stable/c/025067eeb945aa17c7dd483a63960125b7efb577 - https://git.kernel.org/stable/c/dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325 - ht
025067eeb945aa17c7dd483a63960125b7efb577 - https://git.kernel.org/stable/c/dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325 - https://git.kernel.org/stable/c/9beaff47bcea5eec7d4ead98f5043057161fd71a - https://git.kernel.org/stable/c/109aa654f85c5141e813b2cd1bd36d90be678407
CVE ID: CVE-2024-53158 State: PUBLISHED Published: 2024-12-24T11:28:57.160Z Last Updated: 2025-11-03T20:46:49.804Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. However, that check doesn't make sense on the first iteration through the loop. It leads to reading before the start of these->clk_perf_tbl[] array. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/37cdd4f0c266560b
Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/37cdd4f0c266560b7b924c42361eeae3dc5f0c3e - https://git.kernel.org/stable/c/7a3465b79ef0539aa10b310ac3cc35e0ae25b79e - https://git.kernel.org/stable/c/748557ca7dc94695a6e209eb68fce365da9a3bb3 - https://git.kernel.org/stable/c/f4b7bf5a50f1fa25560f0b66a13563465542861b - https://git.kernel.org/stable/c/b0a9c6ccaf88c4701787f61ecd2ec0eb014a0677 - https://git.kernel.org/stable/c/c24e019ca12d9ec814af04b30a64dd7173fb20fe - https://git.kernel.org/stable/c/56eda41dcce0ec4d3418b4f85037bdea181486cc - https://git.kernel.org/stable/c/351bb7f9ecb9d1f09bd7767491a2b8d07f4f1ea4 - https://git.kernel.org/stabl
37bdea181486cc - https://git.kernel.org/stable/c/351bb7f9ecb9d1f09bd7767491a2b8d07f4f1ea4 - https://git.kernel.org/stable/c/78261cb08f06c93d362cab5c5034bf5899bc7552
CVE ID: CVE-2024-53159 State: REJECTED Published: 2024-12-24T11:28:58.241Z Last Updated: 2025-01-09T15:48:23.224Z Description: No description available.
CVE ID: CVE-2024-53160 State: PUBLISHED Published: 2024-12-24T11:29:00.964Z Last Updated: 2025-10-01T20:17:08.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu KCSAN reports a data race when access the krcp->monitor_work.timer.expires variable in the schedule_delayed_monitor_work() function: <snip> BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1: schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline] kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839 trie_update_elem+0x47c/0x620 kernel/bpf/lpm_
rcu/tree.c:3520 [inline] kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839 trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441 bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203 generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849 bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143 __sys_bpf+0x2e5/0x7a0 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739 x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f write
/common.c:52 [inline] do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0: __mod_timer+0x578/0x7f0 kernel/time/timer.c:1173 add_timer_global+0x51/0x70 kernel/time/timer.c:1330 __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523 queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552 queue_delayed_work include/linux/workqueue.h:677 [inline] schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline] kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310 worker_thread+0x51d/0x6f0 k
kernel/workqueue.c:3229 [inline] process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391 kthread+0x1d1/0x210 kernel/kthread.c:389 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Reported by Kernel Concurrency Sanitizer on: CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound kfree_rcu_monitor <snip> kfree_rcu_monitor() rearms the work if a "krcp" has to be still offloaded and this is done without holding krcp->lock, wh
free_rcu_monitor() rearms the work if a "krcp" has to be still offloaded and this is done without holding krcp->lock, whereas the kvfree_call_rcu() holds it. Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so both functions do not race anymore. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/967a0e61910825d1fad009d836a6cb41f7402395 - https://git.kernel.org/stable/c/05b8ea1f16667f07c8e5843fb4bde3e49d49ead8 - https://git.kernel.org/stable/c/5ced426d97ce84299ecfcc7bd8b38f975fd11089 - https://git.kernel.org/stable/c/a23da88c6c80e41e0503e0b481a22c9eea63f263
CVE ID: CVE-2024-53161 State: PUBLISHED Published: 2024-12-24T11:29:01.938Z Last Updated: 2025-11-03T20:46:52.800Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. A
iable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8cc31cfa36ff37aff399b72faa2ded58110112ae - https://git.kernel.org/stable/c/e0269ea7a628fdeddd65b92fe29c09655dbb80b9 - https://git.kernel.org/stable/c/4ad7033de109d0fec99086f352f58a3412e378b8 - https://git.kernel.org/stable/c/578ca89b04680145d41011e7cec8806fefbb59e7 - https://git.kernel.org/stable/c/ac6ebb9edcdb7077e841862c402697c4c48a7c0a - https://git.kernel.org/stable/c/fdb90006184aa84c7b4e09144ed0936d4e1891a7 - https://git.kernel.org/stable/c/000930193
a - https://git.kernel.org/stable/c/fdb90006184aa84c7b4e09144ed0936d4e1891a7 - https://git.kernel.org/stable/c/000930193fe5eb79ce5563ee2e9ddb0c6e4e1bb5 - https://git.kernel.org/stable/c/1fe774a93b46bb029b8f6fa9d1f25affa53f06c6
CVE ID: CVE-2024-53162 State: PUBLISHED Published: 2024-12-24T11:29:10.439Z Last Updated: 2025-10-01T20:17:07.954Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_4xxx - fix off by one in uof_get_name() The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/05c9a7a5344425860202a8f3efea4d8ed2d10edb - https://git.kernel.org/stable/c/e69d2845aaa080960f38761f78fd25aa856620c6 - https://git.kernel.org/stable/c/700852528fc5295897d6089eea0656d67f9b9d88 - https://git.kernel.org/st
f78fd25aa856620c6 - https://git.kernel.org/stable/c/700852528fc5295897d6089eea0656d67f9b9d88 - https://git.kernel.org/stable/c/475b5098043eef6e72751aadeab687992a5b63d1
CVE ID: CVE-2024-53163 State: PUBLISHED Published: 2024-12-24T11:29:19.315Z Last Updated: 2025-10-01T20:17:07.828Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_420xx - fix off by one in uof_get_name() This is called from uof_get_name_420xx() where "num_objs" is the ARRAY_SIZE() of fw_objs[]. The > needs to be >= to prevent an out of bounds access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c23661a36eea840b657e485d48ed88b246da1bb8 - https://git.kernel.org/stable/c/91eef1ad75f03d37dba926b73f9dd6f058bc4d58 - https://git.kernel.org/stable/c/93a11608fb3720e1bc2b
/git.kernel.org/stable/c/91eef1ad75f03d37dba926b73f9dd6f058bc4d58 - https://git.kernel.org/stable/c/93a11608fb3720e1bc2b19a2649ac2b49cca1921
CVE ID: CVE-2024-53164 State: PUBLISHED Published: 2024-12-27T13:38:43.407Z Last Updated: 2025-11-03T20:46:55.582Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become empty. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/44782565e1e6174c94bddfa72ac7267cd09c1648 - https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52 - https://git.k
6174c94bddfa72ac7267cd09c1648 - https://git.kernel.org/stable/c/5e473f462a16f1a34e49ea4289a667d2e4f35b52 - https://git.kernel.org/stable/c/33db36b3c53d0fda2699ea39ba72bee4de8336e8 - https://git.kernel.org/stable/c/489422e2befff88a1de52b2acebe7b333bded025 - https://git.kernel.org/stable/c/97e13434b5da8e91bdf965352fad2141d13d72d3 - https://git.kernel.org/stable/c/e3e54ad9eff8bdaa70f897e5342e34b76109497f - https://git.kernel.org/stable/c/5eb7de8cd58e73851cd37ff8d0666517d9926948
CVE ID: CVE-2024-53165 State: PUBLISHED Published: 2024-12-27T13:49:11.401Z Last Updated: 2025-11-03T20:46:56.971Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let's only add it to the list after everything has succeeded. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3c7c806b3eafd94ae0f77305a174d63b69ec187c - https://git.kernel.org/stable/c/d8de818d
s: - https://git.kernel.org/stable/c/3c7c806b3eafd94ae0f77305a174d63b69ec187c - https://git.kernel.org/stable/c/d8de818df12d86a1a26a8efd7b4b3b9c6dc3c5cc - https://git.kernel.org/stable/c/971b4893457788e0e123ea552f0bb126a5300e61 - https://git.kernel.org/stable/c/c3f4f4547fb291982f5ef56c048277c4d5ccc4e4 - https://git.kernel.org/stable/c/c43df7dae28fb9fce96ef088250c1e3c3a77c527 - https://git.kernel.org/stable/c/b8b84dcdf3ab1d414304819f824b10efba64132c - https://git.kernel.org/stable/c/6ba6e19912570b2ad68298be0be1dc779014a303 - https://git.kernel.org/stable/c/588bdec1ff8b81517dbae0ae51c9df52c0b952d3 - https://git.kernel.org/stable/c/63e72e551942642c48456a4134975136cdcb9b3c
CVE ID: CVE-2024-53166 State: PUBLISHED Published: 2024-12-27T13:49:12.233Z Last Updated: 2025-11-03T19:32:00.758Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq with io_uring can trigger following UAF in v6.6: ================================================================== BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x5
================================================================= BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50 Call Trace: <TASK> dump_stack_lvl+0x47/0x80 print_address_description.constprop.0+0x66/0x300 print_report+0x3e/0x70 kasan_report+0xb4/0xf0 bfqq_group+0x15/0x50 bfqq_request_over_limit+0x130/0x9a0 bfq_limit_depth+0x1b5/0x480 __blk_mq_alloc_requests+0x2b5/0xa00 blk_mq_get_new_requests+0x11d/0x1d0 blk_mq_submit_bio+0x286/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __block_write_full_folio+0x3d0/0x640 writepage_cb+0x3b/0xc0 write_cache_pages+0x254/0x6c0 write_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd
e_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 808602: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x83/0x90 kmem_cache_alloc_node+0x1b1/0x6d0 bfq_get_queue+0x138/0xfa0 bfq_get_bfqq_handle_split+0xe3/0x2c0 bfq_init_rq+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_
+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_mq_submit_bio+0x8a4/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __blkdev_direct_IO_async+0x2dd/0x330 blkdev_write_iter+0x39a/0x450 io_write+0x22a/0x840 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Freed by task 808589: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 __kasan_slab_free+0x126/0x1b0 kmem_cache_free+0x10c/0x750 bfq_put_queue+0x2dd/0x770 __bfq_insert_request.isra.0+0x155/0x7a0 bfq_insert_request.isra.0+0x122/0x
he_free+0x10c/0x750 bfq_put_queue+0x2dd/0x770 __bfq_insert_request.isra.0+0x155/0x7a0 bfq_insert_request.isra.0+0x122/0x480 bfq_insert_requests+0x156/0x180 blk_mq_dispatch_plug_list+0x528/0x7e0 blk_mq_flush_plug_list.part.0+0xe5/0x590 __blk_flush_plug+0x3b/0x90 blk_finish_plug+0x40/0x60 do_writepages+0x19d/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Fix the problem by protecting bic_to_bfqq() with bfqd->loc
27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Fix the problem by protecting bic_to_bfqq() with bfqd->lock. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ada4ca5fd5a9d5212f28164d49a4885951c979c9 - https://git.kernel.org/stable/c/906cdbdd3b018ff69cc830173bce277a847d4fdc - https://git.kernel.org/stable/c/dcaa738afde55085ac6056252e319479cf23cde2 - https://git.kernel.org/stable/c/01a853faaeaf3379ccf358ade582b1d28752126e - https://git.kernel.org/stable/c/e8b8344de3980709080d86c157d24e7de07d70ad
CVE ID: CVE-2024-53167 State: PUBLISHED Published: 2024-12-27T13:49:13.201Z Last Updated: 2025-05-04T09:54:43.437Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfs/blocklayout: Don't attempt unregister for invalid block device Since commit d869da91cccb ("nfs/blocklayout: Fix premature PR key unregistration") an unmount of a pNFS SCSI layout-enabled NFS may dereference a NULL block_device in: bl_unregister_scsi+0x16/0xe0 [blocklayoutdriver] bl_free_device+0x70/0x80 [blocklayoutdriver] bl_free_deviceid_node+0x12/0x30 [blocklayoutdriver] nfs4_put_deviceid_node+0x60/0xc0 [nfsv4] nfs4_deviceid_purge_client+0x132/0x190 [nfsv4] unse
12/0x30 [blocklayoutdriver] nfs4_put_deviceid_node+0x60/0xc0 [nfsv4] nfs4_deviceid_purge_client+0x132/0x190 [nfsv4] unset_pnfs_layoutdriver+0x59/0x60 [nfsv4] nfs4_destroy_server+0x36/0x70 [nfsv4] nfs_free_server+0x23/0xe0 [nfs] deactivate_locked_super+0x30/0xb0 cleanup_mnt+0xba/0x150 task_work_run+0x59/0x90 syscall_exit_to_user_mode+0x217/0x220 do_syscall_64+0x8e/0x160 This happens because even though we were able to create the nfs4_deviceid_node, the lookup for the device was unable to attach the block device to the pnfs_block_dev. If we never found a block device to register, we can avoid this case with the PNFS_BDEV_REGISTERED flag. Move the deref behind the test for the flag. References:
ter, we can avoid this case with the PNFS_BDEV_REGISTERED flag. Move the deref behind the test for the flag. References: - https://git.kernel.org/stable/c/3402704a424f34bbcca7f4a4503859357f422217 - https://git.kernel.org/stable/c/faa4bacfaeed827a4ca8cb8529a3ce65a9e8ef46 - https://git.kernel.org/stable/c/3a4ce14d9a6b868e0787e4582420b721c04ee41e
CVE ID: CVE-2024-53168 State: PUBLISHED Published: 2024-12-27T13:49:14.165Z Last Updated: 2025-05-04T09:54:45.571Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.0-rc4-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 Call Trace: <IRQ> dump_stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_
stack_lvl+0x68/0xa0 print_address_description.constprop.0+0x2c/0x3d0 print_report+0xb4/0x270 kasan_report+0xbd/0xf0 tcp_write_timer_handler+0x156/0x3e0 tcp_write_timer+0x66/0x170 call_timer_fn+0xfb/0x1d0 __run_timers+0x3f8/0x480 run_timer_softirq+0x9b/0x100 handle_softirqs+0x153/0x390 __irq_exit_rcu+0x103/0x120 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x76/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 f8 25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 0000
25 00 fb f4 <fa> c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 RSP: 0018:ffffffffa2007e28 EFLAGS: 00000242 RAX: 00000000000f3b31 RBX: 1ffffffff4400fc7 RCX: ffffffffa09c3196 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff9f00590f RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed102360835d R10: ffff88811b041aeb R11: 0000000000000001 R12: 0000000000000000 R13: ffffffffa202d7c0 R14: 0000000000000000 R15: 00000000000147d0 default_idle_call+0x6b/0xa0 cpuidle_idle_call+0x1af/0x1f0 do_idle+0xbc/0x130 cpu_startup_entry+0x33/0x40 rest_init+0x11f/0x210 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x1
0 start_kernel+0x39a/0x420 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x97/0xa0 common_startup_64+0x13e/0x141 </TASK> Allocated by task 595: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x87/0x90 kmem_cache_alloc_noprof+0x12b/0x3f0 copy_net_ns+0x94/0x380 create_new_namespaces+0x24c/0x500 unshare_nsproxy_namespaces+0x75/0xf0 ksys_unshare+0x24e/0x4f0 __x64_sys_unshare+0x1f/0x30 do_syscall_64+0x70/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 100: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 w
0x3b/0x60 __kasan_slab_free+0x54/0x70 kmem_cache_free+0x156/0x5d0 cleanup_net+0x5d3/0x670 process_one_work+0x776/0xa90 worker_thread+0x2e2/0x560 kthread+0x1a8/0x1f0 ret_from_fork+0x34/0x60 ret_from_fork_asm+0x1a/0x30 Reproduction script: mkdir -p /mnt/nfsshare mkdir -p /mnt/nfs/netns_1 mkfs.ext4 /dev/sdb mount /dev/sdb /mnt/nfsshare systemctl restart nfs-server chmod 777 /mnt/nfsshare exportfs -i -o rw,no_root_squash *:/mnt/nfsshare ip netns add netns_1 ip link add name veth_1_peer type veth peer veth_1 ifconfig veth_1_peer 11.11.0.254 up ip link set veth_1 netns netns_1 ip netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --t
netns exec netns_1 ifconfig veth_1 11.11.0.1 ip netns exec netns_1 /root/iptables -A OUTPUT -d 11.11.0.254 -p tcp \ --tcp-flags FIN FIN -j DROP (note: In my environment, a DESTROY_CLIENTID operation is always sent immediately, breaking the nfs tcp connection.) ip netns exec netns_1 timeout -s 9 300 mount -t nfs -o proto=tcp,vers=4.1 \ 11.11.0.254:/mnt/nfsshare /mnt/nfs/netns_1 ip netns del netns_1 The reason here is that the tcp socket in netns_1 (nfs side) has been shutdown and closed (done in xs_destroy), but the FIN message (with ack) is discarded, and the nfsd side keeps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends t
ps sending retransmission messages. As a result, when the tcp sock in netns_1 processes the received message, it sends the message (FIN message) in the sending queue, and the tcp timer is re-established. When the network namespace is deleted, the net structure accessed by tcp's timer handler function causes problems. To fix this problem, let's hold netns refcnt for the tcp kernel socket as done in other modules. This is an ugly hack which can easily be backported to earlier kernels. A proper fix which cleans up the interfaces will follow, but may not be so easy to backport. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0ca87e5063757132a044d3
Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0ca87e5063757132a044d35baba40a7d4bb25394 - https://git.kernel.org/stable/c/694ccb05b79ee5f5a9f14c2f80d2635d3bb8bdc3 - https://git.kernel.org/stable/c/61c0a5eac96836de5e3a5897eccdc63162a94936 - https://git.kernel.org/stable/c/3f23f96528e8fcf8619895c4c916c52653892ec1
CVE ID: CVE-2024-53169 State: PUBLISHED Published: 2024-12-27T13:49:14.925Z Last Updated: 2025-10-01T20:17:07.698Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: fix kernel crash while shutting down controller The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: