Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49909 State: PUBLISHED Published: 2024-10-21T18:01:38.803Z Last Updated: 2025-11-03T20:41:53.950Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn32_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before derefer
ter dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e087c9738ee1cdeebde346f4dfc819e5f7057e90 - https://git.kernel.org/stable/c/f38b09ba6a335c511eb27920bb9bb4a1b2c20084 - https://git.kernel.org/stable/c/496486950c3d2aebf46a3be300296ac091da7a2d - https://git.kernel.org/stable/c/5298270bdabe97be5b8236e544c9e936415fe1f2 - https://git.kernel.org/stable/c/28574b08c70e56d34d6f6379326a860b96749051
CVE ID: CVE-2024-49910 State: PUBLISHED Published: 2024-10-21T18:01:39.483Z Last Updated: 2025-07-11T17:21:06.756Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn401_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn401_set_output_transfer_func function. Previously, set_output_gamma was being checked for null, but then it was being dereferenced without any null check. This could lead to a null pointer dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before deref
inter dereference if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d8ee900b92b6526cf84275b49a473155ad75c70e - https://git.kernel.org/stable/c/dd340acd42c24a3f28dd22fae6bf38662334264c
CVE ID: CVE-2024-49911 State: PUBLISHED Published: 2024-10-21T18:01:40.200Z Last Updated: 2025-11-03T20:41:55.355Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func This commit adds a null check for the set_output_gamma function pointer in the dcn20_set_output_transfer_func function. Previously, set_output_gamma was being checked for null at line 1030, but then it was being dereferenced without any null check at line 1048. This could potentially lead to a null pointer dereference error if set_output_gamma is null. To fix this, we now ensure that
could potentially lead to a null pointer dereference error if set_output_gamma is null. To fix this, we now ensure that set_output_gamma is not null before dereferencing it. We do this by adding a null check for set_output_gamma before the call to set_output_gamma at line 1048. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e8a24767899c86f4c5f1e4d3b2608942d054900f - https://git.kernel.org/stable/c/8c854138b593efbbd8fa46a25f3288c121c1d1a1 - https://git.kernel.org/stable/c/02411e9359297512946705b1cd8cf5e6b0806fa0 - https://git.kernel.org/stable/c/827380b114f83c30b3e56d1a675980b6d65f7c88 - https://git.kernel.org/stable/
f5e6b0806fa0 - https://git.kernel.org/stable/c/827380b114f83c30b3e56d1a675980b6d65f7c88 - https://git.kernel.org/stable/c/62ed6f0f198da04e884062264df308277628004f
CVE ID: CVE-2024-49912 State: PUBLISHED Published: 2024-10-21T18:01:40.870Z Last Updated: 2025-11-03T22:23:10.202Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle null 'stream_status' in 'planes_changed_for_existing_stream' This commit adds a null check for 'stream_status' in the function 'planes_changed_for_existing_stream'. Previously, the code assumed 'stream_status' could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream()
eported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c4b699b93496c423b0e5b584d4eb4ab849313bcf - https://git.kernel.org/stable/c/4778982c73d6c9f3fdbdbc6b6c8aa18df98251af - https://git.kernel.org/stable/c/ec6c32b58e6c4e87760e797c525e99a460c82bcb - https://git.kernel.org/stable/c/0ffd9fb03bbc99ed1eb5dc989d5c7da2faac0659 - https://git.kernel.org/stable/c/8141f21b941710ecebe49220b69822cab3abd23d
CVE ID: CVE-2024-49913 State: PUBLISHED Published: 2024-10-21T18:01:41.551Z Last Updated: 2025-11-03T22:23:11.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream This commit addresses a null pointer dereference issue in the `commit_planes_for_stream` function at line 4140. The issue could occur when `top_pipe_to_program` is null. The fix adds a check to ensure `top_pipe_to_program` is not null before accessing its stream_res. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 com
his prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1ebfa6663807c144be8c8b6727375012409d2356 - https://git.kernel.org/stable/c/8ab59527852a6f7780aad6185729550ca0569122 - https://git.kernel.org/stable/c/40193ff73630adf76bc0d82398f7d90fb576dba4 - https://git.kernel.org/stable/c/e47e563c6f0db7d792a559301862c19ead0dfc2f - https://git.kernel.org/stable/c/3929e382e4758aff42da0102a60d13337c99d3b8 - https://gi
6f0db7d792a559301862c19ead0dfc2f - https://git.kernel.org/stable/c/3929e382e4758aff42da0102a60d13337c99d3b8 - https://git.kernel.org/stable/c/73efd2a611b62fee71a7b7f27d9d08bb60da8a72 - https://git.kernel.org/stable/c/66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad
CVE ID: CVE-2024-49914 State: PUBLISHED Published: 2024-10-21T18:01:42.215Z Last Updated: 2025-07-11T17:21:11.764Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for pipe_ctx->plane_state in dcn20_program_pipe This commit addresses a null pointer dereference issue in the `dcn20_program_pipe` function. The issue could occur when `pipe_ctx->plane_state` is null. The fix adds a check to ensure `pipe_ctx->plane_state` is not null before accessing. This prevents a null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() e
rence. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn20/dcn20_hwseq.c:1925 dcn20_program_pipe() error: we previously assumed 'pipe_ctx->plane_state' could be null (see line 1877) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/68f75e6f08aad66069a629db8d7840919156c761 - https://git.kernel.org/stable/c/65a6fee22d5cfa645cb05489892dc9cd3d142fc2 - https://git.kernel.org/stable/c/8e4ed3cf1642df0c4456443d865cff61a9598aa8
CVE ID: CVE-2024-49915 State: PUBLISHED Published: 2024-10-21T18:01:42.866Z Last Updated: 2025-11-03T20:41:58.162Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr in dcn32_init_hw This commit addresses a potential null pointer dereference issue in the `dcn32_init_hw` function. The issue could occur when `dc->clk_mgr` is null. The fix adds a check to ensure `dc->clk_mgr` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previou
orted by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn32/dcn32_hwseq.c:961 dcn32_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 782) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0d94d9cbd9fec7344d230c4f7b781826f7799c60 - https://git.kernel.org/stable/c/ec1be3c527b4a5fc85bcc1b0be7cec08bf60c796 - https://git.kernel.org/stable/c/f0454b3cb0584a6bf275aeb49be61a760fd546a2 - https://git.kernel.org/stable/c/7d1854c86d02cea8f8a0c0ca05f4ab14292baf3d - https://git.kernel.org/stable/c/c395fd47d1565bd67671f45cca281b3acc2c31ef
CVE ID: CVE-2024-49916 State: PUBLISHED Published: 2024-10-21T18:01:43.547Z Last Updated: 2025-07-11T17:21:14.350Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn401_init_hw This commit addresses a potential null pointer dereference issue in the `dcn401_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../dis
its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn401/dcn401_hwseq.c:416 dcn401_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 225) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ac1c41e318074d8a9ea925787e366be15d7645e8 - https://git.kernel.org/stable/c/4b6377f0e96085cbec96eb7f0b282430ccdd3d75
CVE ID: CVE-2024-49917 State: PUBLISHED Published: 2024-10-21T18:01:44.295Z Last Updated: 2025-11-03T20:41:59.569Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL check for clk_mgr and clk_mgr->funcs in dcn30_init_hw This commit addresses a potential null pointer dereference issue in the `dcn30_init_hw` function. The issue could occur when `dc->clk_mgr` or `dc->clk_mgr->funcs` is null. The fix adds a check to ensure `dc->clk_mgr` and `dc->clk_mgr->funcs` is not null before accessing its functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../displ
s functions. This prevents a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn30/dcn30_hwseq.c:789 dcn30_init_hw() error: we previously assumed 'dc->clk_mgr' could be null (see line 628) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/23cb6139543580dc36743586ca86fbb3f7ab2c9d - https://git.kernel.org/stable/c/205e3b96cc9aa9211fd2c849a16245cf236b2d36 - https://git.kernel.org/stable/c/5443c83eb8fd2f88c71ced38848fbf744d6206a2 - https://git.kernel.org/stable/c/56c326577971adc3a230f29dfd3aa3abdd505f5d - https://git.kernel.org/stable/c/cba7fec864172dadd953daefdd26e01742b
/stable/c/56c326577971adc3a230f29dfd3aa3abdd505f5d - https://git.kernel.org/stable/c/cba7fec864172dadd953daefdd26e01742b71a6a
CVE ID: CVE-2024-49918 State: PUBLISHED Published: 2024-10-21T18:01:45.036Z Last Updated: 2025-07-11T17:21:16.727Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer This commit addresses a potential null pointer dereference issue in the `dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue could occur when `head_pipe` is null. The fix adds a check to ensure `head_pipe` is not null before asserting it. If `head_pipe` is null, the function returns NULL to prevent a potential null pointer dereference. Reported by smatch: dri
`head_pipe` is null, the function returns NULL to prevent a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690 dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed 'head_pipe' could be null (see line 2681) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4f47292f488fa7041284dca1f1244116c18721f1 - https://git.kernel.org/stable/c/96d4c2ee18d732a248d053aae8c4a27cb1d68d1c - https://git.kernel.org/stable/c/ac2140449184a26eac99585b7f69814bd3ba8f2d
CVE ID: CVE-2024-49919 State: PUBLISHED Published: 2024-10-21T18:01:45.769Z Last Updated: 2025-07-11T17:21:18.018Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null check for head_pipe in dcn201_acquire_free_pipe_for_layer This commit addresses a potential null pointer dereference issue in the `dcn201_acquire_free_pipe_for_layer` function. The issue could occur when `head_pipe` is null. The fix adds a check to ensure `head_pipe` is not null before asserting it. If `head_pipe` is null, the function returns NULL to prevent a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/
e function returns NULL to prevent a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn201/dcn201_resource.c:1016 dcn201_acquire_free_pipe_for_layer() error: we previously assumed 'head_pipe' could be null (see line 1010) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/16ce8fd94da8599bb6f0496895d392a69aead1c0 - https://git.kernel.org/stable/c/390d757621f5f35d11a63ed7d9d3262ead240064 - https://git.kernel.org/stable/c/8a1b1655a490a492a5a6987254c935ecce4eb9de - https://git.kernel.org/stable/c/f22f4754aaa47d8c59f166ba3042182859e5dff7
CVE ID: CVE-2024-49920 State: PUBLISHED Published: 2024-10-21T18:01:46.437Z Last Updated: 2025-07-11T17:21:19.261Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before multiple uses [WHAT & HOW] Poniters, such as stream_enc and dc->bw_vbios, are null checked previously in the same function, so Coverity warns "implies that stream_enc and dc->bw_vbios might be null". They are used multiple times in the subsequent code and need to be checked. This fixes 10 FORWARD_NULL issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/
reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/26787fb6c2b2ee0d1a7e1574b36f4711ae40fe27 - https://git.kernel.org/stable/c/fdd5ecbbff751c3b9061d8ebb08e5c96119915b4
CVE ID: CVE-2024-49921 State: PUBLISHED Published: 2024-10-21T18:01:47.112Z Last Updated: 2025-07-11T17:21:20.577Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before used [WHAT & HOW] Poniters, such as dc->clk_mgr, are null checked previously in the same function, so Coverity warns "implies that "dc->clk_mgr" might be null". As a result, these pointers need to be checked when used again. This fixes 10 FORWARD_NULL issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5b35bf1a82eb29841b67ff5643ba83762250fc24 - https://
CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5b35bf1a82eb29841b67ff5643ba83762250fc24 - https://git.kernel.org/stable/c/be1fb44389ca3038ad2430dac4234669bc177ee3
CVE ID: CVE-2024-49922 State: PUBLISHED Published: 2024-10-21T18:01:47.751Z Last Updated: 2025-07-11T17:21:21.706Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check null pointers before using them [WHAT & HOW] These pointers are null checked previously in the same function, indicating they might be null as reported by Coverity. As a result, they need to be checked when used again. This fixes 3 FORWARD_NULL issue reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/65e1d2c291553ef3f433a0b7109cc3002a5f40ae - https://git.kernel.org/stable/c/5e938
nces: - https://git.kernel.org/stable/c/65e1d2c291553ef3f433a0b7109cc3002a5f40ae - https://git.kernel.org/stable/c/5e9386baa3033c369564d55de4bab62423e8a1d3 - https://git.kernel.org/stable/c/1ff12bcd7deaeed25efb5120433c6a45dd5504a8
CVE ID: CVE-2024-49923 State: PUBLISHED Published: 2024-10-21T18:01:48.405Z Last Updated: 2025-07-11T17:21:22.844Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags [WHAT & HOW] "dcn20_validate_apply_pipe_split_flags" dereferences merge, and thus it cannot be a null pointer. Let's pass a valid pointer to avoid null dereference. This fixes 2 FORWARD_NULL issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/39a580cd15397e102aaec25986ae5acf492f8930 - https://git.kernel.org/stable/c/85aa996ec
: - https://git.kernel.org/stable/c/39a580cd15397e102aaec25986ae5acf492f8930 - https://git.kernel.org/stable/c/85aa996ecfaa95d1e922867390502d23ce21b905 - https://git.kernel.org/stable/c/9a05270869f40c89f8d184fe2d37cb86e0d7e5f5 - https://git.kernel.org/stable/c/5559598742fb4538e4c51c48ef70563c49c2af23
CVE ID: CVE-2024-49924 State: PUBLISHED Published: 2024-10-21T18:01:49.076Z Last Updated: 2025-11-03T22:23:13.319Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work. If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer
all pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | pxafb_task pxafb_remove | unregister_framebuffer(info) | do_unregister_framebuffer(fb_info) | put_fb_info(fb_info) | // free fbi->fb | set_ctrlr_state(fbi, state) | __pxafb_lcd_power(fbi, 0) | fbi->lcd_power(on, &fbi->fb.var) | //use fbi->fb Fix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. Additional
efore proceeding with the cleanup in pxafb_remove. Note that only root user can remove the driver at runtime. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd - https://git.kernel.org/stable/c/6d0a07f68b66269e167def6c0b90a219cd3e7473 - https://git.kernel.org/stable/c/e6897e299f57b103e999e62010b88e363b3eebae - https://git.kernel.org/stable/c/4cda484e584be34d55ee17436ebf7ad11922b97a - https://git.kernel.org/stable/c/3c0d416eb4bef705f699213cee94bf54b6acdacd - https://git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370 - https://git.kernel.org/stable/c/aaadc0cb05c999ccd8
://git.kernel.org/stable/c/fdda354f60a576d52dcf90351254714681df4370 - https://git.kernel.org/stable/c/aaadc0cb05c999ccd8898a03298b7e5c31509b08 - https://git.kernel.org/stable/c/a3a855764dbacbdb1cc51e15dc588f2d21c93e0e - https://git.kernel.org/stable/c/4a6921095eb04a900e0000da83d9475eb958e61e
CVE ID: CVE-2024-49925 State: PUBLISHED Published: 2024-10-21T18:01:49.732Z Last Updated: 2025-11-03T20:42:00.980Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: Register sysfs groups through driver core The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup. Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2a9c40c72097b583b23aeb2a26d429ccfc81fbc1
chment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2a9c40c72097b583b23aeb2a26d429ccfc81fbc1 - https://git.kernel.org/stable/c/36bfefb6baaa8e46de44f4fd919ce4347337620f - https://git.kernel.org/stable/c/872cd2d029d2c970a8a1eea88b48dab2b3f2e93a - https://git.kernel.org/stable/c/4684d69b9670a83992189f6271dc0fcdec4ed0d7 - https://git.kernel.org/stable/c/95cdd538e0e5677efbdf8aade04ec098ab98f457
CVE ID: CVE-2024-49926 State: PUBLISHED Published: 2024-10-21T18:01:50.405Z Last Updated: 2025-05-04T09:41:30.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu_tasks_need_gpcb() For kernels built with CONFIG_FORCE_NR_CPUS=y, the nr_cpu_ids is defined as NR_CPUS instead of the number of possible cpus, this will cause the following system panic: smpboot: Allowing 4 CPUs, 0 hotplug CPUs ... setup_percpu: NR_CPUS:512 nr_cpumask_bits:512 nr_cpu_ids:512 nr_node_ids:1 ... BUG: unable to handle page fault for address: ffffffff9911c8c8 Oops: 0000 [#1] PREEMPT SMP PTI CPU:
12 nr_node_ids:1 ... BUG: unable to handle page fault for address: ffffffff9911c8c8 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 15 Comm: rcu_tasks_trace Tainted: G W 6.6.21 #1 5dc7acf91a5e8e9ac9dcfc35bee0245691283ea6 RIP: 0010:rcu_tasks_need_gpcb+0x25d/0x2c0 RSP: 0018:ffffa371c00a3e60 EFLAGS: 00010082 CR2: ffffffff9911c8c8 CR3: 000000040fa20005 CR4: 00000000001706f0 Call Trace: <TASK> ? __die+0x23/0x80 ? page_fault_oops+0xa4/0x180 ? exc_page_fault+0x152/0x180 ? asm_exc_page_fault+0x26/0x40 ? rcu_tasks_need_gpcb+0x25d/0x2c0 ? __pfx_rcu_tasks_kthread+0x40/0x40 rcu_tasks_one_gp+0x69/0x180 rcu_tasks_kthread+0x94/0xc0 kthread+0xe8/0x140 ? __pfx_kthread+0x40/0x40 ret_from_fork+0x34/0x80 ? __pfx_kt
p+0x69/0x180 rcu_tasks_kthread+0x94/0xc0 kthread+0xe8/0x140 ? __pfx_kthread+0x40/0x40 ret_from_fork+0x34/0x80 ? __pfx_kthread+0x40/0x40 ret_from_fork_asm+0x1b/0x80 </TASK> Considering that there may be holes in the CPU numbers, use the maximum possible cpu number, instead of nr_cpu_ids, for configuring enqueue and dequeue limits. [ neeraj.upadhyay: Fix htmldocs build error reported by Stephen Rothwell ] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b3b2431ed27f4ebc28e26cdf005c1de42dc60bdf - https://git.kernel.org/stable/c/3104bddc666ff64b90491868bbc4c7ebdd90aedf - https://git.kernel.org/stable/c/05095271a4fb0f6497121a057f9a2edf386d5d96 - htt