Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
e IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle. [1] PM: late suspend of devices complete after 1.754 msecs WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rp
wpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0
ces_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0) [...] PM: noirq suspend of devices complete after 3095.584 msecs Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4e1e03760ee7cc4779b6306867fe0fc02921b963 - https://git.kernel.org/stable/c/b0de20de29b13950493a36bd4cf531200eb0e807 - https://git.kernel.org/stable/c/32ee78823dea2d54adaf6e05f86622eba359e091 - https://git.kernel.o
3a36bd4cf531200eb0e807 - https://git.kernel.org/stable/c/32ee78823dea2d54adaf6e05f86622eba359e091 - https://git.kernel.org/stable/c/df293ea78740a41384d648041f38f645700288e1 - https://git.kernel.org/stable/c/90320cfc07b7d6e7a58fd8168f6380ec52ff0251 - https://git.kernel.org/stable/c/10a58555e0bb5cc4673c8bb73b8afc5fa651f0ac - https://git.kernel.org/stable/c/e65a9af05a0b59ebeba28e5e82265a233db7bc27 - https://git.kernel.org/stable/c/dfeb67b2194ecc55ef8065468c5adda3cdf59114 - https://git.kernel.org/stable/c/dc09f007caed3b2f6a3b6bd7e13777557ae22bfd
CVE ID: CVE-2024-49964 State: PUBLISHED Published: 2024-10-21T18:02:15.755Z Last Updated: 2025-05-04T09:42:30.449Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix memfd_pin_folios free_huge_pages leak memfd_pin_folios followed by unpin_folios fails to restore free_huge_pages if the pages were not already faulted in, because the folio refcount for pages created by memfd_alloc_folio never goes to 0. memfd_pin_folios needs another folio_put to undo the folio_try_get below: memfd_alloc_folio() alloc_hugetlb_folio_nodemask() dequeue_hugetlb_folio_nodemask() dequeue_hugetlb_folio_node_exact() folio_ref_unfreeze(folio,
_hugetlb_folio_nodemask() dequeue_hugetlb_folio_nodemask() dequeue_hugetlb_folio_node_exact() folio_ref_unfreeze(folio, 1); ; adds 1 refcount folio_try_get() ; adds 1 refcount hugetlb_add_to_page_cache() ; adds 512 refcount (on x86) With the fix, after memfd_pin_folios + unpin_folios, the refcount for the (unfaulted) page is 512, which is correct, as the refcount for a faulted unpinned page is 513. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/59e081ff2e91bbf19b8c1ecb75b031f778858383 - https://git.kernel.org/stable/c/c56b6f3d801d7ec8965993342bdd9e2972b6cb8e
CVE ID: CVE-2024-49965 State: PUBLISHED Published: 2024-10-21T18:02:16.407Z Last Updated: 2025-11-03T22:23:47.003Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove unreasonable unlock in ocfs2_read_blocks Patch series "Misc fixes for ocfs2_read_blocks", v5. This series contains 2 fixes for ocfs2_read_blocks(). The first patch fix the issue reported by syzbot, which detects bad unlock balance in ocfs2_read_blocks(). The second patch fixes an issue reported by Heming Zhao when reviewing above fix. This patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Additional Analyst Notes: -
is patch (of 2): There was a lock release before exiting, so remove the unreasonable unlock. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5245f109b4afb6595360d4c180d483a6d2009a59 - https://git.kernel.org/stable/c/9753bcb17b36c9add9b32c61766ddf8d2d161911 - https://git.kernel.org/stable/c/3f1ca6ba5452d53c598a45d21267a2c0c221eef3 - https://git.kernel.org/stable/c/f55a33fe0fb5274ef185fd61947cf142138958af - https://git.kernel.org/stable/c/81aba693b129e82e11bb54f569504d943d018de9 - https://git.kernel.org/stable/c/84543da867c967edffd5065fa910ebf56aaae49d - https://git.kernel.org/stable/c/df4f20fc3673cee11abf2c571987a95733c
/stable/c/84543da867c967edffd5065fa910ebf56aaae49d - https://git.kernel.org/stable/c/df4f20fc3673cee11abf2c571987a95733cb638d - https://git.kernel.org/stable/c/39a88623af3f1c686bf6db1e677ed865ffe6fccc - https://git.kernel.org/stable/c/c03a82b4a0c935774afa01fd6d128b444fd930a1
CVE ID: CVE-2024-49966 State: PUBLISHED Published: 2024-10-21T18:02:17.076Z Last Updated: 2025-11-03T22:23:48.460Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled: ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c This reports that there is an active delayed work when freeing oinfo in error handling, so cance
qsync_work_fn+0x0/0x16c This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fc5cc716dfbdc5fd5f373ff3b51358174cf88bfc - https://git.kernel.org/stable/c/89043e7ed63c7fc141e68ea5a79758ed24b6c699 - https://git.kernel.org/stable/c/14114d8148db07e7946fb06b56a50cfa425e26c7 - https://git.kernel.org/stable/c/4173d1277c00baeedaaca76783e98b8fd0e3c08d - https://git.kernel.org/stable/c/bbf41277df8b33fbedf4750a9300c147e8f104eb - https://git.kernel.org/stable/c
b8fd0e3c08d - https://git.kernel.org/stable/c/bbf41277df8b33fbedf4750a9300c147e8f104eb - https://git.kernel.org/stable/c/ef768020366f47d23f39c4f57bcb03af6d1e24b3 - https://git.kernel.org/stable/c/a4346c04d055bf7e184c18a73dbd23b6a9811118 - https://git.kernel.org/stable/c/0d707a33c84b371cb66120e198eed3374726ddd8 - https://git.kernel.org/stable/c/35fccce29feb3706f649726d410122dd81b92c18
CVE ID: CVE-2024-49967 State: REJECTED Published: 2024-10-21T18:02:17.714Z Last Updated: 2025-01-07T08:46:31.368Z Description: No description available.
CVE ID: CVE-2024-49968 State: PUBLISHED Published: 2024-10-21T18:02:18.369Z Last Updated: 2025-05-04T09:42:36.816Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: filesystems without casefold feature cannot be mounted with siphash When mounting the ext4 filesystem, if the default hash version is set to DX_HASH_SIPHASH but the casefold feature is not set, exit the mounting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e1373903db6c4ac994de0d18076280ad88e12dee - https://git.kernel.org/stable/c/985b67cd86392310d9e9326de941c22fc9340eec
CVE ID: CVE-2024-49969 State: PUBLISHED Published: 2024-10-21T18:02:19.044Z Last Updated: 2025-11-03T22:23:51.730Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in DCN30 color transformation This commit addresses a potential index out of bounds issue in the `cm3_helper_translate_curve_to_hw_format` function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the functi
check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error. drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Additional Analyst
helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/7ab69af56a23859b647dee69fa1052c689343621 - https://git.kernel.org/stable/c/c13f9c62015c56a938304cef6d507227ea3e0039 - https://git.kernel.org/stable/c/0f1e222a4b41d77c442901d166fbdca967af0d86 - https://git.kernel.org/stable/c/929506d5671419cffd8d01e9a7f5eae53682a838 - https://git.kernel.org/stable/c/578422ddae3d13362b64e77ef9bab98780641631 - https://git.kernel.org/stable/c/b9d8b94ec7e67f0cae228c054f77b73967c389a3 - https://git.kernel.org/stable/c/d81873f9e715b72d4f8d391c8eb
rnel.org/stable/c/b9d8b94ec7e67f0cae228c054f77b73967c389a3 - https://git.kernel.org/stable/c/d81873f9e715b72d4f8d391c8eb243946f784dfc
CVE ID: CVE-2024-49970 State: PUBLISHED Published: 2024-10-21T18:02:19.694Z Last Updated: 2025-07-11T17:21:24.073Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN401 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four elements, corresponding to the four calls to stream_enc_regs() in the array initializer. This means that valid indices for this array are 0, 1, 2, and 3. The error message 'stream_enc_regs' 4 <= 5 below, is indicating that there is an attempt to access this array with an index of 5
r message 'stream_enc_regs' 4 <= 5 below, is indicating that there is an attempt to access this array with an index of 5, which is out of bounds. This could lead to undefined behavior Here, eng_id is used as an index to access the stream_enc_regs array. If eng_id is 5, this would result in an out-of-bounds access on the stream_enc_regs array. Thus fixing Buffer overflow error in dcn401_stream_encoder_create Found by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn401/dcn401_resource.c:1209 dcn401_stream_encoder_create() error: buffer overflow 'stream_enc_regs' 4 <= 5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b219b46ad42df1de
4 <= 5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b219b46ad42df1dea9258788bcfea37181f3ccb2 - https://git.kernel.org/stable/c/bdf606810210e8e07a0cdf1af3c467291363b295
CVE ID: CVE-2024-49971 State: PUBLISHED Published: 2024-10-21T18:02:20.344Z Last Updated: 2025-05-04T09:42:41.395Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase array size of dummy_boolean [WHY] dml2_core_shared_mode_support and dml_core_mode_support access the third element of dummy_boolean, i.e. hw_debug5 = &s->dummy_boolean[2], when dummy_boolean has size of 2. Any assignment to hw_debug5 causes an OVERRUN. [HOW] Increase dummy_boolean's array size to 3. This fixes 2 OVERRUN issues reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c
s reported by Coverity. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e9e48b7bb9cf3b78f0305ef0144aaf61da0a83d8 - https://git.kernel.org/stable/c/6d64d39486197083497a01b39e23f2f8474b35d3
CVE ID: CVE-2024-49972 State: PUBLISHED Published: 2024-10-21T18:02:21.014Z Last Updated: 2025-09-03T13:06:42.389Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Deallocate DML memory if allocation fails [Why] When DC state create DML memory allocation fails, memory is not deallocated subsequently, resulting in uninitialized structure that is not NULL. [How] Deallocate memory if DML memory allocation fails. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/80345daa5746184195f2d383a2f1bad058f0f94c - https://git.kernel.org/stable/c/892abca6877a96c9123bb1c010cafccdf8c
/stable/c/80345daa5746184195f2d383a2f1bad058f0f94c - https://git.kernel.org/stable/c/892abca6877a96c9123bb1c010cafccdf8ca1b75
CVE ID: CVE-2024-49973 State: PUBLISHED Published: 2024-10-21T18:02:21.696Z Last Updated: 2025-11-03T22:23:53.307Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/64648ae8c97ec5a3165021627f5a1658ebe081ca -
hment: - CVE Program Container: References: - https://git.kernel.org/stable/c/64648ae8c97ec5a3165021627f5a1658ebe081ca - https://git.kernel.org/stable/c/991e8b0bab669b7d06927c3e442b3352532e8581 - https://git.kernel.org/stable/c/21950321ad33d7613b1453f4c503d7b1871deb61 - https://git.kernel.org/stable/c/fe44b3bfbf0c74df5712f44458689d0eccccf47d - https://git.kernel.org/stable/c/1c723d785adb711496bc64c24240f952f4faaabf - https://git.kernel.org/stable/c/92bc8647b4d65f4d4bf8afdb206321c1bc55a486 - https://git.kernel.org/stable/c/585c048d15ed559f20cb94c8fa2f30077efa4fbc - https://git.kernel.org/stable/c/ced8e8b8f40accfcce4a2bbd8b150aa76d5eff9a
CVE ID: CVE-2024-49974 State: PUBLISHED Published: 2024-10-21T18:02:22.392Z Last Updated: 2025-11-03T22:23:54.801Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB chunks, so can run for a long time. Thus IMO async COPY can become a DoS vector. Add a restriction mechanism that bounds the number of concurrent background COPY operations. Start simple and try to be fair -- this patch implements a per-namespace
umber of concurrent background COPY operations. Start simple and try to be fair -- this patch implements a per-namespace limit. An async COPY request that occurs while this limit is exceeded gets NFS4ERR_DELAY. The requesting client can choose to send the request again after a delay or fall back to a traditional read/write style copy. If there is need to make the mechanism more sophisticated, we can visit that in future patches. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9e52ff544e0bfa09ee339fd7b0937ee3c080c24e - https://git.kernel.org/stable/c/43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf - https://git.kernel.org/stab
0937ee3c080c24e - https://git.kernel.org/stable/c/43e46ee5efc03990b223f7aa8b77aa9c3d3acfdf - https://git.kernel.org/stable/c/7ea9260874b779637aff6d24c344b8ef4ac862a0 - https://git.kernel.org/stable/c/ae267989b7b7933dfedcd26468d0a88fc3a9da9e - https://git.kernel.org/stable/c/b4e21431a0db4854b5023cd5af001be557e6c3db - https://git.kernel.org/stable/c/6a488ad7745b8f64625c6d3a24ce7e448e83f11b - https://git.kernel.org/stable/c/aadc3bbea163b6caaaebfdd2b6c4667fbc726752
CVE ID: CVE-2024-49975 State: PUBLISHED Published: 2024-10-21T18:02:23.099Z Last Updated: 2025-11-03T22:23:56.236Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f31f
onal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f31f92107e5a8ecc8902705122c594e979a351fe - https://git.kernel.org/stable/c/fe5e9182d3e227476642ae2b312e2356c4d326a3 - https://git.kernel.org/stable/c/f561b48d633ac2e7d0d667020fc634a96ade33a0 - https://git.kernel.org/stable/c/21cb47db1ec9765f91304763a24565ddc22d2492 - https://git.kernel.org/stable/c/24141df5a8615790950deedd926a44ddf1dfd6d8 - https://git.kernel.org/stable/c/5b981d8335e18aef7908a068529a3287258ff6d8 - https://git.kernel.org/stable/c/2aa45f43709ba2082917bd2973d02687075b6eee - https://git.kernel.org/stable/c/9634e8dc964a4adafa7e1535147abd7ec29441a6 - https://git.kern
082917bd2973d02687075b6eee - https://git.kernel.org/stable/c/9634e8dc964a4adafa7e1535147abd7ec29441a6 - https://git.kernel.org/stable/c/34820304cc2cd1804ee1f8f3504ec77813d29c8e
CVE ID: CVE-2024-49976 State: PUBLISHED Published: 2024-10-21T18:02:23.774Z Last Updated: 2025-05-04T09:42:49.116Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interface_lock in stop_kthread() stop_kthread() is the offline callback for "trace/osnoise:online", since commit 5bfbcd1ee57b ("tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread()"), the following ABBA deadlock scenario is introduced: T1 | T2 [BP] | T3 [AP] osnoise_hotplug_workfn() | work_for_cpu_fn() | cpuhp_thread_fun() | _cpu_down() | osnoise_cpu_die() mutex_lock(&interface_lock) | | stop_kthread() | cpus_write_lo
() | cpuhp_thread_fun() | _cpu_down() | osnoise_cpu_die() mutex_lock(&interface_lock) | | stop_kthread() | cpus_write_lock() | mutex_lock(&interface_lock) cpus_read_lock() | cpuhp_kick_ap() | As the interface_lock here in just for protecting the "kthread" field of the osn_var, use xchg() instead to fix this issue. Also use for_each_online_cpu() back in stop_per_cpu_kthreads() as it can take cpu_read_lock() again. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a4a05ceffe8fad68b45de38fe2311bda619e76e2 - https://git.kernel.org/stable/c/09cb44cc3d3df7ade2cebc939d6257a2fa8afc7a - https://git.kernel.org/stable/c/db8571a9a098086608c11a15856ff585789e
stable/c/09cb44cc3d3df7ade2cebc939d6257a2fa8afc7a - https://git.kernel.org/stable/c/db8571a9a098086608c11a15856ff585789e67e8 - https://git.kernel.org/stable/c/b484a02c9cedf8703eff8f0756f94618004bd165
CVE ID: CVE-2024-49977 State: PUBLISHED Published: 2024-10-21T18:02:24.480Z Last Updated: 2025-11-03T22:23:57.678Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") allows the "port_transmit_rate_kbps" to be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled. This leads to a zero-division error. When tc-cbs is disabled, the idleslope, sendslope, and credit values the credit values are not required to be configured. Therefore, adding
led, the idleslope, sendslope, and credit values the credit values are not required to be configured. Therefore, adding a return statement after setting the txQ mode to DCB when tc-cbs is disabled would prevent a zero-division error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e33fe25b1efe4f2e6a5858786dbc82ae4c44ed4c - https://git.kernel.org/stable/c/b0da9504a528f05f97d926b4db74ff21917a33e9 - https://git.kernel.org/stable/c/5d43e1ad4567d67af2b42d3ab7c14152ffed25c6 - https://git.kernel.org/stable/c/03582f4752427f60817d896f1a827aff772bd31e - https://git.kernel.org/stable/c/e297a2bf56d12fd7f91a0c209eb6ea84361f3368 - h
/03582f4752427f60817d896f1a827aff772bd31e - https://git.kernel.org/stable/c/e297a2bf56d12fd7f91a0c209eb6ea84361f3368 - https://git.kernel.org/stable/c/837d9df9c0792902710149d1a5e0991520af0f93 - https://git.kernel.org/stable/c/675faf5a14c14a2be0b870db30a70764df81e2df
CVE ID: CVE-2024-49978 State: PUBLISHED Published: 2024-10-21T18:02:25.151Z Last Updated: 2025-11-03T22:23:59.132Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gso: fix udp gso fraglist segmentation after pull from frag_list Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as N
ne or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For UDP, this causes a NULL ptr deref in __udpv4_gso_segment_list_csum at udp_hdr(seg->next)->dest. Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/080e6c9a3908de193a48f646c5ce1bfb15676ffc - https://git.
Program Container: References: - https://git.kernel.org/stable/c/080e6c9a3908de193a48f646c5ce1bfb15676ffc - https://git.kernel.org/stable/c/af3122f5fdc0d00581d6e598a668df6bf54c9daa - https://git.kernel.org/stable/c/33e28acf42ee863f332a958bfc2f1a284a3659df - https://git.kernel.org/stable/c/3cd00d2e3655fad3bda96dc1ebf17b6495f86fea - https://git.kernel.org/stable/c/a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab
CVE ID: CVE-2024-49979 State: PUBLISHED Published: 2024-10-21T18:02:25.819Z Last Updated: 2025-05-04T09:42:53.579Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: gso: fix tcp fraglist segmentation after pull from frag_list Detect tcp gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such