Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d to 0. ida_free() is called reporting a warning: [ 4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 ida_free+0x100/0x164 [ 4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0 [ 4.188854] ida_free called for id=0 which is not allocated. [ 4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000 [ 4.203556] Modules linked in: panel_orisetech_otm8009a dw_mipi_dsi_stm(+) gpu_sched dw_mipi_dsi stm32_rproc stm32_crc32 stm32_ipcc(+) optee(+) [ 4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442 [ 4.231481] Hardware name: STM32 (Device Tree Support) [ 4.236627] Workqueue: events_unbound deferred_prob
d 6.12.0 #442 [ 4.231481] Hardware name: STM32 (Device Tree Support) [ 4.236627] Workqueue: events_unbound deferred_probe_work_func [ 4.242504] Call trace: [ 4.242522] unwind_backtrace from show_stack+0x10/0x14 [ 4.250218] show_stack from dump_stack_lvl+0x50/0x64 [ 4.255274] dump_stack_lvl from __warn+0x80/0x12c [ 4.260134] __warn from warn_slowpath_fmt+0x114/0x188 [ 4.265199] warn_slowpath_fmt from ida_free+0x100/0x164 [ 4.270565] ida_free from rproc_type_release+0x38/0x60 [ 4.275832] rproc_type_release from device_release+0x30/0xa0 [ 4.281601] device_release from kobject_put+0xc4/0x294 [ 4.286762] kobject_put from rproc_alloc.part.0+0x208/0x28c [ 4.292430] rproc_alloc.part.0 from devm_rpro
put+0xc4/0x294 [ 4.286762] kobject_put from rproc_alloc.part.0+0x208/0x28c [ 4.292430] rproc_alloc.part.0 from devm_rproc_alloc+0x80/0xc4 [ 4.298393] devm_rproc_alloc from stm32_rproc_probe+0xd0/0x844 [stm32_rproc] [ 4.305575] stm32_rproc_probe [stm32_rproc] from platform_probe+0x5c/0xbc Calling ida_alloc earlier in rproc_alloc ensures that the rproc->index is properly set. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2cf54928e7e32362215c69b68a6a53d110323bf3 - https://git.kernel.org/stable/c/b32d60a852bb3952886625d0c3b1c9a88c3ceb7c - https://git.kernel.org/stable/c/f2013d19b7704cd723ab42664b8d9408ea8cc77c - https://git.kernel.org/stable/c/e
88c3ceb7c - https://git.kernel.org/stable/c/f2013d19b7704cd723ab42664b8d9408ea8cc77c - https://git.kernel.org/stable/c/e9efd9fa4679803fe23188d7b47119cf7bc2de6f - https://git.kernel.org/stable/c/7378aeb664e5ebc396950b36a1f2dedf5aabec20
CVE ID: CVE-2024-58057 State: PUBLISHED Published: 2025-03-06T15:54:00.345Z Last Updated: 2025-05-04T10:08:53.250Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In the default configuration (i.e. when `queue_delayed_work` and friends do not specify which CPU to run the work item on), `WQ_UNBOUND` allows the work item to be executed on any CPU in the same node of the CPU it was enqueued on. While this solution potentially sacrifices locality,
xecuted on any CPU in the same node of the CPU it was enqueued on. While this solution potentially sacrifices locality, it avoids contention with other processes that might dominate the CPU time of the processor the work item was scheduled on. This is not just a theoretical problem: in a particular scenario misconfigured process was hogging most of the time from CPU0, leaving less than 0.5% of its CPU time to the kworker. The IDPF workqueues that were using the kworker on CPU0 suffered large completion delays as a result, causing performance degradation, timeouts and eventual system crash. * I have also run a manual test to gauge the performance improvement. The test consists of an antagonis
al system crash. * I have also run a manual test to gauge the performance improvement. The test consists of an antagonist process (`./stress --cpu 2`) consuming as much of CPU 0 as possible. This process is run under `taskset 01` to bind it to CPU0, and its priority is changed with `chrt -pQ 9900 10000 ${pid}` and `renice -n -20 ${pid}` after start. Then, the IDPF driver is forced to prefer CPU0 by editing all calls to `queue_delayed_work`, `mod_delayed_work`, etc... to use CPU 0. Finally, `ktraces` for the workqueue events are collected. Without the current patch, the antagonist process can force arbitrary delays between `workqueue_queue_work` and `workqueue_execute_start`, that in my tests
gonist process can force arbitrary delays between `workqueue_queue_work` and `workqueue_execute_start`, that in my tests were as high as `30ms`. With the current patch applied, the workqueue can be migrated to another unloaded CPU in the same node, and, keeping everything else equal, the maximum delay I could see was `6us`. References: - https://git.kernel.org/stable/c/66bf9b3d9e1658333741f075320dc8e7cd6f8d09 - https://git.kernel.org/stable/c/868202ec3854e13de1164e4a3e25521194c5af72 - https://git.kernel.org/stable/c/9a5b021cb8186f1854bac2812bd4f396bb1e881c
CVE ID: CVE-2024-58058 State: PUBLISHED Published: 2025-03-06T15:54:01.033Z Last Updated: 2025-11-03T19:33:54.763Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache will free all znode in memory and make c->zroot.znode = NULL, then dumping tnc tree will access c->zroot.znode which cause null pointer dereference. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/428aff8f7cfb0d9a8854477648022cef96bcab28 - https://git.kernel.org/stable/c/6211c11fc20424bbc6d79c835c7c212b553ae898 - https://git.kern
9a8854477648022cef96bcab28 - https://git.kernel.org/stable/c/6211c11fc20424bbc6d79c835c7c212b553ae898 - https://git.kernel.org/stable/c/1787cd67bb94b106555ffe64f887f6aa24b47010 - https://git.kernel.org/stable/c/e01b55f261ccc96e347eba4931e4429d080d879d - https://git.kernel.org/stable/c/40e25a3c0063935763717877bb2a814c081509ff - https://git.kernel.org/stable/c/77e5266e3d3faa6bdcf20d9c68a8972f6aa06522 - https://git.kernel.org/stable/c/2a987950df825d0144370e700dc5fb337684ffba - https://git.kernel.org/stable/c/bdb0ca39e0acccf6771db49c3f94ed787d05f2d7
CVE ID: CVE-2024-58059 State: PUBLISHED Published: 2025-03-06T15:54:02.360Z Last Updated: 2025-10-01T19:36:37.778Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix deadlock during uvc_probe If uvc_probe() fails, it can end up calling uvc_status_unregister() before uvc_status_init() is called. Fix this by checking if dev->status is NULL or not in uvc_status_unregister(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/db577ededf3a18b39567fc1a6209f12a0c4a3c52 - https://git.kernel.org/stable/c/a67f75c2b5ecf534eab416ce16c11fe780c4f8f6
CVE ID: CVE-2024-58060 State: PUBLISHED Published: 2025-03-06T15:54:03.253Z Last Updated: 2025-05-04T10:09:02.737Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing There is a UAF report in the bpf_struct_ops when CONFIG_MODULES=n. In particular, the report is on tcp_congestion_ops that has a "struct module *owner" member. For struct_ops that has a "struct module *owner" member, it can be extended either by the regular kernel module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is don
l module or by the bpf_struct_ops. bpf_try_module_get() will be used to do the refcounting and different refcount is done based on the owner pointer. When CONFIG_MODULES=n, the btf_id of the "struct module" is missing: WARN: resolve_btfids: unresolved symbol module Thus, the bpf_try_module_get() cannot do the correct refcounting. Not all subsystem's struct_ops requires the "struct module *owner" member. e.g. the recent sched_ext_ops. This patch is to disable bpf_struct_ops registration if the struct_ops has the "struct module *" member and the "struct module" btf_id is missing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test. This has happened since the beginning
ing. The btf_type_is_fwd() helper is moved to the btf.h header file for this test. This has happened since the beginning of bpf_struct_ops which has gone through many changes. The Fixes tag is set to a recent commit that this patch can apply cleanly. Considering CONFIG_MODULES=n is not common and the age of the issue, targeting for bpf-next also. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b777b14c2a4a4e2322daf8e8ffd42d2b88831b17 - https://git.kernel.org/stable/c/2324fb4e92092837ee278fdd8d60c48ee1a619ce - https://git.kernel.org/stable/c/96ea081ed52bf077cad6d00153b6fba68e510767
CVE ID: CVE-2024-58061 State: PUBLISHED Published: 2025-03-06T15:54:03.924Z Last Updated: 2025-11-03T19:33:56.141Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls this is a WARN_ON, but that should remain since internally we want to know about bugs that may cause this. Prevent deactivating all links in the debugfs write directly. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/dfe9a043300261afe5eadc07b867a6810c4e999a - https://git.kernel.org/stable/c/d36e48a4d81c647df8a76cc58fd4d2442ba10744 - https://gi
300261afe5eadc07b867a6810c4e999a - https://git.kernel.org/stable/c/d36e48a4d81c647df8a76cc58fd4d2442ba10744 - https://git.kernel.org/stable/c/270ad6776e7cf1be3b769e0447070f9d0e8269db - https://git.kernel.org/stable/c/18100796c11dfdea9101fdc95d2428b2093477ee - https://git.kernel.org/stable/c/7553477cbfd784b128297f9ed43751688415bbaa
CVE ID: CVE-2024-58062 State: PUBLISHED Published: 2025-03-06T15:54:04.590Z Last Updated: 2025-10-01T19:36:37.632Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: avoid NULL pointer dereference When iterating over the links of a vif, we need to make sure that the pointer is valid (in other words - that the link exists) before dereferncing it. Use for_each_vif_active_link that also does the check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fbb563ad5032a07ac83c746ce5c8de5f25b5ffd0 - https://git.kernel.org/stable/c/7f6fb4b7611eb6371c493c42fefad84a1742bcbb - h
/fbb563ad5032a07ac83c746ce5c8de5f25b5ffd0 - https://git.kernel.org/stable/c/7f6fb4b7611eb6371c493c42fefad84a1742bcbb - https://git.kernel.org/stable/c/cf704a7624f99eb2ffca1a16c69183e85544a613
CVE ID: CVE-2024-58063 State: PUBLISHED Published: 2025-03-06T15:54:05.258Z Last Updated: 2025-11-03T19:33:58.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitialize at reverse order when probe fails. When init_sw_vars fails, rtl_deinit_core should not be called, specially now that it destroys the rtl_wq workqueue. And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be leaked. Remove pci_set_drvdata call as it will already be cleaned up by the core driver code and could lead to memory leaks too. cf. commit 8d450935ae7f ("wireless: rtl
lready be cleaned up by the core driver code and could lead to memory leaks too. cf. commit 8d450935ae7f ("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory"). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/85b67b4c4a0f8a6fb20cf4ef7684ff2b0cf559df - https://git.kernel.org/stable/c/455e0f40b5352186a9095f2135d5c89255e7c39a - https://git.kernel.org/stable/c/b96371339fd9cac90f5ee4ac17ee5c4cbbdfa6f7 - https://git.kernel.org/stable/c/ee0b0d7baa8a6d42c7988f6e50c8f164cdf3fa47 - https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a9
g/stable/c/ee0b0d7baa8a6d42c7988f6e50c8f164cdf3fa47 - https://git.kernel.org/stable/c/624cea89a0865a2bc3e00182a6b0f954a94328b4 - https://git.kernel.org/stable/c/32acebca0a51f5e372536bfdc0d7d332ab749013 - https://git.kernel.org/stable/c/6b76bab5c257463302c9e97f5d84d524457468eb - https://git.kernel.org/stable/c/e7ceefbfd8d447abc8aca8ab993a942803522c06
CVE ID: CVE-2024-58064 State: PUBLISHED Published: 2025-03-06T15:54:05.959Z Last Updated: 2025-10-01T19:36:37.346Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap() kunit_kzalloc() may return NULL, dereferencing it without NULL check may lead to NULL dereference. Add a NULL check for ies. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/886271409603956edd09df229dde7442c410a872 - https://git.kernel.org/stable/c/0d17d81143f5aa56ee87e60bb1000a2372a0ada8 - https://git.kernel.org/stable/c/13c4f7714
2 - https://git.kernel.org/stable/c/0d17d81143f5aa56ee87e60bb1000a2372a0ada8 - https://git.kernel.org/stable/c/13c4f7714c6a1ecf748a2f22099447c14fe6ed8c
CVE ID: CVE-2024-58065 State: PUBLISHED Published: 2025-03-06T15:54:06.659Z Last Updated: 2025-10-01T19:36:37.198Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() check The devm_kzalloc() function returns NULL on error, not error pointers. Fix the check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6628f7f88de5f65f01adef5a63c707cb49d0fddb - https://git.kernel.org/stable/c/e5ca5d7b4d7c29246d957dc45d63610584ae3a54
CVE ID: CVE-2024-58066 State: PUBLISHED Published: 2025-03-06T15:54:07.362Z Last Updated: 2025-10-01T19:36:37.073Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() check The devm_kzalloc() function doesn't return error pointers, it returns NULL on error. Update the check to match. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2b3a36fb572caf9fb72f158be328395b1c938bf7 - https://git.kernel.org/stable/c/3acea81be689b77b3ceac6ff345ff0366734d967
CVE ID: CVE-2024-58067 State: PUBLISHED Published: 2025-03-06T15:54:08.095Z Last Updated: 2025-10-01T19:36:36.928Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: mmp: pxa1908-mpmu: Fix a NULL vs IS_ERR() check The devm_kzalloc() function returns NULL on error, not error pointers. Update the check to match. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0869a7b2afdfcdd2beb0a5fb683119bcf39c0e9d - https://git.kernel.org/stable/c/7def56f841af22e07977e193eea002e085facbdb
CVE ID: CVE-2024-58068 State: PUBLISHED Published: 2025-03-06T15:54:08.798Z Last Updated: 2025-11-03T19:34:00.308Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initialized If a driver calls dev_pm_opp_find_bw_ceil/floor() the retrieve bandwidth from the OPP table but the bandwidth table was not created because the interconnect properties were missing in the OPP consumer node, the kernel will crash with: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 ... pc : _read_bw+0x8/0x10 lr : _opp_table_find_key+0x9c/0x174 ... Call trace: _read
at virtual address 0000000000000004 ... pc : _read_bw+0x8/0x10 lr : _opp_table_find_key+0x9c/0x174 ... Call trace: _read_bw+0x8/0x10 (P) _opp_table_find_key+0x9c/0x174 (L) _find_key+0x98/0x168 dev_pm_opp_find_bw_ceil+0x50/0x88 ... In order to fix the crash, create an assert function to check if the bandwidth table was created before trying to get a bandwidth with _read_bw(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8532fd078d2a5286915d03bb0a0893ee1955acef - https://git.kernel.org/stable/c/84ff05c9bd577157baed711a4f0b41206593978b - https://git.kernel.org/stable/c/ff2def251849133be6076a7c2d427d8eb963c223 - https:/
5c9bd577157baed711a4f0b41206593978b - https://git.kernel.org/stable/c/ff2def251849133be6076a7c2d427d8eb963c223 - https://git.kernel.org/stable/c/5165486681dbd67b61b975c63125f2a5cb7f96d1 - https://git.kernel.org/stable/c/b44b9bc7cab2967c3d6a791b1cd542c89fc07f0e
CVE ID: CVE-2024-58069 State: PUBLISHED Published: 2025-03-06T15:54:09.480Z Last Updated: 2025-11-03T19:34:03.211Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem client uses a buffer size less than 4 bytes, regmap_read will write out of bounds as it expects the buffer to point at an unsigned int. Fix this by using an intermediary unsigned int to hold the value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referenc
ary unsigned int to hold the value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4 - https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c - https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574 - https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1 - https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9 - https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128 - https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1 - https://git.kernel.org/stable/c/3ab8c5ed4f84fa20c
s://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1 - https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c
CVE ID: CVE-2024-58070 State: PUBLISHED Published: 2025-03-06T15:54:10.166Z Last Updated: 2025-10-01T19:36:36.533Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT is enabled. [ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_prog
ernel/locking/spinlock_rt.c:48 [ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs [ 35.118569] preempt_count: 1, expected: 0 [ 35.118571] RCU nest depth: 1, expected: 1 [ 35.118577] INFO: lockdep is turned off. ... [ 35.118647] __might_resched+0x433/0x5b0 [ 35.118677] rt_spin_lock+0xc3/0x290 [ 35.118700] ___slab_alloc+0x72/0xc40 [ 35.118723] __kmalloc_noprof+0x13f/0x4e0 [ 35.118732] bpf_map_kzalloc+0xe5/0x220 [ 35.118740] bpf_selem_alloc+0x1d2/0x7b0 [ 35.118755] bpf_local_storage_update+0x2fa/0x8b0 [ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0 [ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 [ 35.118795] bpf_trace_run3+0
ing+0x15a/0x1d0 [ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 [ 35.118795] bpf_trace_run3+0x222/0x400 [ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20 [ 35.118824] trace_inet_sock_set_state+0x112/0x130 [ 35.118830] inet_sk_state_store+0x41/0x90 [ 35.118836] tcp_set_state+0x3b3/0x640 There is no need to adjust the gfp_flags passing to the bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL. The verifier has ensured GFP_KERNEL is passed only in sleepable context. It has been an old issue since the first introduction of the bpf_local_storage ~5 years ago, so this patch targets the bpf-next. bpf_mem_alloc is needed to solve it, so the Fixes tag is set
_storage ~5 years ago, so this patch targets the bpf-next. bpf_mem_alloc is needed to solve it, so the Fixes tag is set to the commit when bpf_mem_alloc was first used in the bpf_local_storage. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3392fa605d7c5708c5fbe02e4fbdac547c3b7352 - https://git.kernel.org/stable/c/b0027500000dfcb8ee952557d565064cea22c43e - https://git.kernel.org/stable/c/c1d398a3af7e59d7fef351c84fed7ebb575d1f1a - https://git.kernel.org/stable/c/8eef6ac4d70eb1f0099fff93321d90ce8fa49ee1
CVE ID: CVE-2024-58071 State: PUBLISHED Published: 2025-03-06T15:54:10.950Z Last Updated: 2025-11-03T19:34:05.983Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lower of vlan1. This is not useful in practice and can lead to recursive locking: $ ip link add veth0 type veth peer name veth1 $ ip link set veth0 up $ ip link set veth1 up $ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 $ ip link add team0 type team $ ip link s
veth1 up $ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1 $ ip link add team0 type team $ ip link set veth0.1 down $ ip link set veth0.1 master team0 team0: Port device veth0.1 added $ ip link set veth0 down $ ip link set veth0 master team0 ============================================ WARNING: possible recursive locking detected 6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted -------------------------------------------- ip/7684 is trying to acquire lock: ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) but task is already holding lock: ff
am_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) but task is already holding lock: ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977) other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(team->team_lock_key); lock(team->team_lock_key); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by ip/7684: stack backtrace: CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK
69bb #46 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:122) print_deadlock_bug.cold (kernel/locking/lockdep.c:3040) __lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226) ? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548) lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973) ? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2)) ? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/