deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-40094
Published: 2024-07-30
Description: GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/graphql-java/graphql-java/commit/97743bc1b5caa2b0bd894dc8e128b47e4d771e4a; https://github.com/graphql-java/graphql-java/discussions/3641; https://github.com/graphql-java/graphql-java/pull/3539
CVE: CVE-2024-7100
Published: 2024-07-30
Description: The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements/bt_bb_button/bt_bb_button.php#L155; https://plugins.trac.wordpress.org/changeset/3127440/; https://wordpress.org/plugins/bold-page-builder/#developers
CVE: CVE-2024-7221
Published: 2024-07-30
Description: A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. This affects an unknown part of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://gist.github.com/topsky979/1e98c4d1a3ba1ed73aab46d360c1c4b8; https://vuldb.com/?ctiid.272792; https://vuldb.com/?id.272792
CVE: CVE-2024-7222
Published: 2024-07-30
Description: A vulnerability, which was classified as critical, was found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /home.php. The manipulation of the argument type leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-272802 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/topsky979/9f3d490a2bfdb5794dffc2f4aed72250; https://vuldb.com/?ctiid.272802; https://vuldb.com/?id.272802
CVE: CVE-2023-52888
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Only free buffer VA that is not NULL

In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly
called only when the buffer to free exists, there are some instances
that didn't do the check and triggered warnings in practice.

We believe those checks were forgotten unintentionally. Add the checks
back to fix the warnings.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/303d01082edaf817ee2df53a40dca9da637a2c04; https://git.kernel.org/stable/c/5c217253c76c94f76d1df31d0bbdcb88dc07be91; https://git.kernel.org/stable/c/eb005c801ec70ff4307727bd3bd6e8280169ef32
CVE: CVE-2024-42099
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Fix invalid dereferencing of indirect CCW data pointer

Fix invalid dereferencing of indirect CCW data pointer in
dasd_eckd_dump_sense() that leads to a kernel panic in error cases.

When using indirect addressing for DASD CCWs (IDAW) the CCW CDA pointer
does not contain the data address itself but a pointer to the IDAL.
This needs to be translated from physical to virtual as well before
using it.

This dereferencing is also used for dasd_page_cache and also fixed
although it is very unlikely that this code path ever gets used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/b3a58f3b90f564f42a5c35778d8c5107b2c2150b; https://git.kernel.org/stable/c/c116475f7d6410b1e6d399207ac75de6cf9c3652; https://git.kernel.org/stable/c/b3a58f3b90f564f42a5c35778d8c5107b2c2150b
CVE: CVE-2024-42100
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common

In order to set the rate range of a hw sunxi_ccu_probe calls
hw_to_ccu_common() assuming all entries in desc->ccu_clks are contained
in a ccu_common struct. This assumption is incorrect and, in
consequence, causes invalid pointer de-references.

Remove the faulty call. Instead, add one more loop that iterates over
the ccu_clks and sets the rate range, if required.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/14c78d69dbca6a28af14095f639ec4318ec07fdc; https://git.kernel.org/stable/c/7a0e2738cb6da5a55c9908dff333600aeb263e07; https://git.kernel.org/stable/c/ea977d742507e534d9fe4f4d74256f6b7f589338
CVE: CVE-2024-42101
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes

In nouveau_connector_get_modes(), the return value of drm_mode_duplicate()
is assigned to mode, which will lead to a possible NULL pointer
dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1f[PII_REDACTED]3008587a8c5cb17eb2ca097592ef; https://git.kernel.org/stable/c/274cba8d2d1b48c72d8bd90e76c9e2dc1aa0a81d; https://git.kernel.org/stable/c/744b229f09134ccd091427a6f9ea6d97302cfdd9
CVE: CVE-2024-42102
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"

Patch series "mm: Avoid possible overflows in dirty throttling".

Dirty throttling logic assumes dirty limits in page units fit into
32-bits.  This patch series makes sure this is true (see patch 2/2 for
more details).


This patch (of 2):

This reverts commit 9319b647902cbd5cc884ac08a8a6d54ce111fc78.

The commit is broken in several ways.  Firstly, the removed (u64) cast
from the multiplication will introduce a multiplication overflow on 32-bit
archs if wb_thresh * bg_thresh >= 1<<32 (which is actually common - the
default settings with 4GB of RAM will trigger this).  Secondly, the
div64_u64() is unnecessarily expensive on 32-bit archs.  We have
div64_ul() in case we want to be safe & cheap.  Thirdly, if dirty
thresholds are larger than 1<<32 pages, then dirty balancing is going to
blow up in many other spectacular ways anyway so trying to fix one
possible overflow is just moot.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-369
References: https://git.kernel.org/stable/c/000099d71648504fb9c7a4616f92c2b70c3e44ec; https://git.kernel.org/stable/c/145faa3d03688cbb7bbaaecbd84c[PII_REDACTED]2c; https://git.kernel.org/stable/c/23a28f5f3f6ca1e4184bd0e9631cd0944cf1c807
CVE: CVE-2024-42104
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: add missing check for inode numbers on directory entries

Syzbot reported that mounting and unmounting a specific pattern of
corrupted nilfs2 filesystem images causes a use-after-free of metadata
file inodes, which triggers a kernel bug in lru_add_fn().

As Jan Kara pointed out, this is because the link count of a metadata file
gets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),
tries to delete that inode (ifile inode in this case).

The inconsistency occurs because directories containing the inode numbers
of these metadata files that should not be visible in the namespace are
read without checking.

Fix this issue by treating the inode numbers of these internal files as
errors in the sanity check helper when reading directory folios/pages.

Also thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer
analysis.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/07c176e7acc5579c133bb923ab21316d192d0a95; https://git.kernel.org/stable/c/1b7d549ed2c1fa202c751b69423a0d3a6bd5a180; https://git.kernel.org/stable/c/265fff1a01cdc083aeaf0d934c929db5cc64aebf
CVE: CVE-2024-42105
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix inode number range checks

Patch series "nilfs2: fix potential issues related to reserved inodes".

This series fixes one use-after-free issue reported by syzbot, caused by
nilfs2's internal inode being exposed in the namespace on a corrupted
filesystem, and a couple of flaws that cause problems if the starting
number of non-reserved inodes written in the on-disk super block is
intentionally (or corruptly) changed from its default value.  


This patch (of 3):

In the current implementation of nilfs2, "nilfs->ns_first_ino", which
gives the first non-reserved inode number, is read from the superblock,
but its lower limit is not checked.

As a result, if a number that overlaps with the inode number range of
reserved inodes such as the root directory or metadata files is set in the
super block parameter, the inode number test macros (NILFS_MDT_INODE and
NILFS_VALID_INODE) will not function properly.

In addition, these test macros use left bit-shift calculations using with
the inode number as the shift count via the BIT macro, but the result of a
shift calculation that exceeds the bit width of an integer is undefined in
the C specification, so if "ns_first_ino" is set to a large value other
than the default value NILFS_USER_INO (=11), the macros may potentially
malfunction depending on the environment.

Fix these issues by checking the lower bound of "nilfs->ns_first_ino" and
by preventing bit shifts equal to or greater than the NILFS_USER_INO
constant in the inode number test macros.

Also, change the type of "ns_first_ino" from signed integer to unsigned
integer to avoid the need for type casting in comparisons such as the
lower bound check introduced this time.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/08cab183a624ba71603f3754643ae11cab34dbc4; https://git.kernel.org/stable/c/1c91058425a01131ea30dda6cf43c67b17884d6a; https://git.kernel.org/stable/c/3be4dcc8d7bea52ea41f87aa4bbf959efe7a5987
CVE: CVE-2024-42107
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: Don't process extts if PTP is disabled

The ice_ptp_extts_event() function can race with ice_ptp_release() and
result in a NULL pointer dereference which leads to a kernel panic.

Panic occurs because the ice_ptp_extts_event() function calls
ptp_clock_event() with a NULL pointer. The ice driver has already
released the PTP clock by the time the interrupt for the next external
timestamp event occurs.

To fix this, modify the ice_ptp_extts_event() function to check the
PTP state and bail early if PTP is not ready.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-367, CWE-476
References: https://git.kernel.org/stable/c/1c4e[PII_REDACTED]00683b1ea87a5e0fc2db64fa9b; https://git.kernel.org/stable/c/996422e3230e41468f652d754fefd1bdbcd4604e; https://git.kernel.org/stable/c/1c4e[PII_REDACTED]00683b1ea87a5e0fc2db64fa9b
CVE: CVE-2024-42108
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: rswitch: Avoid use-after-free in rswitch_poll()

The use-after-free is actually in rswitch_tx_free(), which is inlined in
rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
same pointer, the skb is first freed using dev_kfree_skb_any(), then the
value in skb->len is used to update the interface statistics.

Let's move around the instructions to use skb->len before the skb is
freed.

This bug is trivial to reproduce using KFENCE. It will trigger a splat
every few packets. A simple ARP request or ICMP echo request is enough.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4a41bb9f2b402469d425a1c13359d3b3ea4e6403; https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b; https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67
CVE: CVE-2024-42109
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: unconditionally flush pending work before notifier

syzbot reports:

KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831
KASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530
KASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597
Read of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45
[..]
Workqueue: events nf_tables_trans_destroy_work
Call Trace:
 nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]
 nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]
 nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597

Problem is that the notifier does a conditional flush, but its possible
that the table-to-be-removed is still referenced by transactions being
processed by the worker, so we need to flush unconditionally.

We could make the flush_work depend on whether we found a table to delete
in nf-next to avoid the flush for most cases.

AFAICS this problem is only exposed in nf-next, with
commit e169285f8c56 ("netfilter: nf_tables: do not store nft_ctx in transaction objects"),
with this commit applied there is an unconditional fetch of
table->family which is whats triggering the above splat.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/09e650c3a3a7d[PII_REDACTED]10534ccbf71c75b2e; https://git.kernel.org/stable/c/3325628cb36b7f216c5716e7b5124d9dc81199e4; https://git.kernel.org/stable/c/4c06c13317b9a08decedcd7aaf706691e336277c
CVE: CVE-2024-42110
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()

The following is emitted when using idxd (DSA) dmanegine as the data
mover for ntb_transport that ntb_netdev uses.

[74412.546922] BUG: using smp_processor_id() in preemptible [00000000] code: irq/52-idxd-por/14526
[74412.556784] caller is netif_rx_internal+0x42/0x130
[74412.562282] CPU: 6 PID: 14526 Comm: irq/52-idxd-por Not tainted 6.9.5 #5
[74412.569870] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.E9I.1752.P05[PII_REDACTED] 02/08/2024
[74412.581699] Call Trace:
[74412.584514]  <TASK>
[74412.586933]  dump_stack_lvl+0x55/0x70
[74412.591129]  check_preemption_disabled+0xc8/0xf0
[74412.596374]  netif_rx_internal+0x42/0x130
[74412.600957]  __netif_rx+0x20/0xd0
[74412.604743]  ntb_netdev_rx_handler+0x66/0x150 [ntb_netdev]
[74412.610985]  ntb_complete_rxc+0xed/0x140 [ntb_transport]
[74412.617010]  ntb_rx_copy_callback+0x53/0x80 [ntb_transport]
[74412.623332]  idxd_dma_complete_txd+0xe3/0x160 [idxd]
[74412.628963]  idxd_wq_thread+0x1a6/0x2b0 [idxd]
[74412.634046]  irq_thread_fn+0x21/0x60
[74412.638134]  ? irq_thread+0xa8/0x290
[74412.642218]  irq_thread+0x1a0/0x290
[74412.646212]  ? __pfx_irq_thread_fn+0x10/0x10
[74412.651071]  ? __pfx_irq_thread_dtor+0x10/0x10
[74412.656117]  ? __pfx_irq_thread+0x10/0x10
[74412.660686]  kthread+0x100/0x130
[74412.664384]  ? __pfx_kthread+0x10/0x10
[74412.668639]  ret_from_fork+0x31/0x50
[74412.672716]  ? __pfx_kthread+0x10/0x10
[74412.676978]  ret_from_fork_asm+0x1a/0x30
[74412.681457]  </TASK>

The cause is due to the idxd driver interrupt completion handler uses
threaded interrupt and the threaded handler is not hard or soft interrupt
context. However __netif_rx() can only be called from interrupt context.
Change the call to netif_rx() in order to allow completion via normal
context for dmaengine drivers that utilize threaded irq handling.

While the following commit changed from netif_rx() to __netif_rx(),
baebdf48c360 ("net: dev: Makes sure netif_rx() can be invoked in any context."),
the change should've been a noop instead. However, the code precedes this
fix should've been using netif_rx_ni() or netif_rx_any_context().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4b3b6c7efee69f077b86ef7f088fb96768e46e1f; https://git.kernel.org/stable/c/858ae09f03677a4ab907a15516893bc2cc79d4c3; https://git.kernel.org/stable/c/e15a5d821e5192a3769d846079bc9aa380139baf
CVE: CVE-2024-42112
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: free isb resources at the right time

When using MSI/INTx interrupt, the shared interrupts are still being
handled in the device remove routine, before free IRQs. So isb memory
is still read after it is freed. Thus move wx_free_isb_resources()
from txgbe_close() to txgbe_remove(). And fix the improper isb free
action in txgbe_open() error handling path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/935124dd5883b5de68dc5a94f582480a10643dc9; https://git.kernel.org/stable/c/efdc3f54299835ddef23bea651c753c4d467010b; https://git.kernel.org/stable/c/935124dd5883b5de68dc5a94f582480a10643dc9
CVE: CVE-2024-42113
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net: txgbe: initialize num_q_vectors for MSI/INTx interrupts

When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized.
Thus there will be kernel panic in wx_alloc_q_vectors() to allocate
queue vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/7c36711a2cd8059c2d24f5e5c1d76e8ea2d5613c; https://git.kernel.org/stable/c/9edc7a83cd40ac96ff14fe3a17a38f7ace6611df; https://git.kernel.org/stable/c/c98969226d1fe0c1dd779db8b1c444bc5294fc83
CVE: CVE-2024-42116
Published: 2024-07-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-42117
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: ASSERT when failing to find index by plane/stream id

[WHY]
find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns
an array index and they return -1 when not found; however, -1 is not a
valid index number.

[HOW]
When this happens, call ASSERT(), and return a positive number (which is
fewer than callers' array size) instead.

This fixes 4 OVERRUN and 2 NEGATIVE_RETURNS issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/01eb50e53c1ce505bf449348d[PII_REDACTED]88765; https://git.kernel.org/stable/c/a9c047a5cf3135b8b66bd28fbe2c698b9cace0b3; https://git.kernel.org/stable/c/01eb50e53c1ce505bf449348d[PII_REDACTED]88765
CVE: CVE-2024-42118
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Do not return negative stream id for array

[WHY]
resource_stream_to_stream_idx returns an array index and it return -1
when not found; however, -1 is not a valid array index number.

[HOW]
When this happens, call ASSERT(), and return a zero instead.

This fixes an OVERRUN and an NEGATIVE_RETURNS issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57; https://git.kernel.org/stable/c/a76fa9c4f0fc0aa6f517da3fa7d7c23e8a32c7d0; https://git.kernel.org/stable/c/3ac31c9a707dd1c7c890b95333182f955e9dcb57
CVE: CVE-2024-42119
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Skip finding free audio for unknown engine_id

[WHY]
ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it
also means it is uninitialized and does not need free audio.

[HOW]
Skip and return NULL.

This fixes 2 OVERRUN issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/1357b2165d9ad94faa4c4a20d5e2ce29c2ff29c3; https://git.kernel.org/stable/c/874261358d31fc772f[PII_REDACTED]e670983cc1ca; https://git.kernel.org/stable/c/881fb6afc0004c5e6392ae2848f825bf051dae14
CVE: CVE-2024-42120
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check pipe offset before setting vblank

pipe_ctx has a size of MAX_PIPES so checking its index before accessing
the array.

This fixes an OVERRUN issue reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0b3702f9d43d163fd05e43b7d7e22e766dbef329; https://git.kernel.org/stable/c/5396a70e8cf462ec5ccf2dc8de103c79de9489e6; https://git.kernel.org/stable/c/96bf81cc1bd058bb8af6e755a548e926e934dfd1
CVE: CVE-2024-42121
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check index msg_id before read or write

[WHAT]
msg_id is used as an array index and it cannot be a negative value, and
therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1).

[HOW]
Check whether msg_id is valid before reading and setting.

This fixes 4 OVERRUN issues reported by Coverity.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/59d99deb330af206a4541db0c4da8f73880fba03; https://git.kernel.org/stable/c/9933eca6ada0cd612e19522e7a319bcef464c0eb; https://git.kernel.org/stable/c/a31ea49dc8064a557565725cf[PII_REDACTED]76a6e
CVE: CVE-2024-42122
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add NULL pointer check for kzalloc

[Why & How]
Check return pointer of kzalloc before using it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/062edd612fcd300f0f79a36fca5b8b6a5e2fce70; https://git.kernel.org/stable/c/552e7938b4d7fe548fbf29b9950a14c6149d0470; https://git.kernel.org/stable/c/8e65a1b7118acf6af96449e1e66b7adbc9396912
CVE: CVE-2024-42123
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix double free err_addr pointer warnings

In amdgpu_umc_bad_page_polling_timeout, the amdgpu_umc_handle_bad_pages
will be run many times so that double free err_addr in some special case.
So set the err_addr to NULL to avoid the warnings.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d; https://git.kernel.org/stable/c/8e24beb3c2b08a4763f920399a9cc577ed440a1a; https://git.kernel.org/stable/c/506c245f3f1cd989cb89811a7f06e04ff8813a0d
CVE: CVE-2024-42124
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qedf: Make qedf_execute_tmf() non-preemptible

Stop calling smp_processor_id() from preemptible code in
qedf_execute_tmf90.  This results in BUG_ON() when running an RT kernel.

[ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646
[ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0a8a91932b2772e75bf3f6d133ca4225d1d3e920; https://git.kernel.org/stable/c/0d8b637c9c5eeaa1a4e3dfb336f3ff918eb64fec; https://git.kernel.org/stable/c/2b9c7787cfcd1e76d873a78f16cf45bfa4b100ea
CVE: CVE-2024-42125
Published: 2024-07-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband

We have some policy via BIOS to block uses of 6 GHz. In this case, 6 GHz
sband will be NULL even if it is WiFi 7 chip. So, add NULL handling here
to avoid crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/bb38626f3f97e16e6d368a9ff6daf320f3fe31d9; https://git.kernel.org/stable/c/ce4ba62f8bc5195a9a0d49c6235a9c99e619cadc; https://git.kernel.org/stable/c/bb38626f3f97e16e6d368a9ff6daf320f3fe31d9