deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52647
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access

When translating source to sink streams in the crossbar subdev, the
driver tries to locate the remote subdev connected to the sink pad. The
remote pad may be NULL, if userspace tries to enable a stream that ends
at an unconnected crossbar sink. When that occurs, the driver
dereferences the NULL pad, leading to a crash.

Prevent the crash by checking if the pad is NULL before using it, and
return an error if it is.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/91c8ce42fcde09f1da24acab9013b3e19cb88a4e; https://git.kernel.org/stable/c/c4bd29bf5b7f67925bc1abd16069f22dadf5f061; https://git.kernel.org/stable/c/c95318607fbe8fdd44991a8dad2e44118e6b8812
CVE: CVE-2024-26929
Published: 2024-05-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-26930
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix double free of the ha->vp_map pointer

Coverity scan reported potential risk of double free of the pointer
ha->vp_map.  ha->vp_map was freed in qla2x00_mem_alloc(), and again freed
in function qla2x00_mem_free(ha).

Assign NULL to vp_map and kfree take care of NULL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f; https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73; https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b
CVE: CVE-2024-26932
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()

When unregister pd capabilitie in tcpm, KASAN will capture below double
-free issue. The root cause is the same capabilitiy will be kfreed twice,
the first time is kfreed by pd_capabilities_release() and the second time
is explicitly kfreed by tcpm_port_unregister_pd().

[    3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc
[    3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10
[    4.001206]
[    4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20[PII_REDACTED]6-g52728c567a55 #53
[    4.012402] Hardware name: Freescale i.MX8QXP MEK (DT)
[    4.017569] Workqueue: events_unbound deferred_probe_work_func
[    4.023456] Call trace:
[    4.025920]  dump_backtrace+0x94/0xec
[    4.029629]  show_stack+0x18/0x24
[    4.032974]  dump_stack_lvl+0x78/0x90
[    4.036675]  print_report+0xfc/0x5c0
[    4.040289]  kasan_report_invalid_free+0xa0/0xc0
[    4.044937]  __kasan_slab_free+0x124/0x154
[    4.049072]  kfree+0xb4/0x1e8
[    4.052069]  tcpm_port_unregister_pd+0x1a4/0x3dc
[    4.056725]  tcpm_register_port+0x1dd0/0x2558
[    4.061121]  tcpci_register_port+0x420/0x71c
[    4.065430]  tcpci_probe+0x118/0x2e0

To fix the issue, this will remove kree() from tcpm_port_unregister_pd().
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69; https://git.kernel.org/stable/c/b63f90487bdf93a4223ce7853d14717e9d452856; https://git.kernel.org/stable/c/242e425ed580b2f4dbcb86c8fc03a410a4084a69
CVE: CVE-2024-26933
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix deadlock in port "disable" sysfs attribute

The show and store callback routines for the "disable" sysfs attribute
file in port.c acquire the device lock for the port's parent hub
device.  This can cause problems if another process has locked the hub
to remove it or change its configuration:

	Removing the hub or changing its configuration requires the
	hub interface to be removed, which requires the port device
	to be removed, and device_del() waits until all outstanding
	sysfs attribute callbacks for the ports have returned.  The
	lock can't be released until then.

	But the disable_show() or disable_store() routine can't return
	until after it has acquired the lock.

The resulting deadlock can be avoided by calling
sysfs_break_active_protection().  This will cause the sysfs core not
to wait for the attribute's callback routine to return, allowing the
removal to proceed.  The disadvantage is that after making this call,
there is no guarantee that the hub structure won't be deallocated at
any moment.  To prevent this, we have to acquire a reference to it
first by calling hub_get().
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/4facc9421117ba9d8148c73771b213887fec77f7; https://git.kernel.org/stable/c/73d1589b91f2099e5f6534a8497b7c6b527e064e; https://git.kernel.org/stable/c/9dac54f08198147f5ec0ec52fcf1bc8ac899ac05
CVE: CVE-2024-26934
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix deadlock in usb_deauthorize_interface()

Among the attribute file callback routines in
drivers/usb/core/sysfs.c, the interface_authorized_store() function is
the only one which acquires a device lock on an ancestor device: It
calls usb_deauthorize_interface(), which locks the interface's parent
USB device.

The will lead to deadlock if another process already owns that lock
and tries to remove the interface, whether through a configuration
change or because the device has been disconnected.  As part of the
removal procedure, device_del() waits for all ongoing sysfs attribute
callbacks to complete.  But usb_deauthorize_interface() can't complete
until the device lock has been released, and the lock won't be
released until the removal has finished.

The mechanism provided by sysfs to prevent this kind of deadlock is
to use the sysfs_break_active_protection() function, which tells sysfs
not to wait for the attribute callback.

Reported-and-tested by: Yue Sun <samsun1006219@gmail.com>
Reported by: xingwei lee <xrivendell7@gmail.com>
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/07acf979da33c721357ff27129edf74c23c036c6; https://git.kernel.org/stable/c/122a06f1068bf5e39089863f4f60b1f5d4273384; https://git.kernel.org/stable/c/12d6a5681a0a5cecc2af7860f0a1613fa7c6e947
CVE: CVE-2024-26935
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix unremoved procfs host directory regression

Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name}
directory earlier") fixed a bug related to modules loading/unloading, by
adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led
to a potential duplicate call to the hostdir_rm() routine, since it's also
called from scsi_host_dev_release(). That triggered a regression report,
which was then fixed by commit be03df3d4bfe ("scsi: core: Fix a procfs host
directory removal regression"). The fix just dropped the hostdir_rm() call
from dev_release().

But it happens that this proc directory is created on scsi_host_alloc(),
and that function "pairs" with scsi_host_dev_release(), while
scsi_remove_host() pairs with scsi_add_host(). In other words, it seems the
reason for removing the proc directory on dev_release() was meant to cover
cases in which a SCSI host structure was allocated, but the call to
scsi_add_host() didn't happen. And that pattern happens to exist in some
error paths, for example.

Syzkaller causes that by using USB raw gadget device, error'ing on
usb-storage driver, at usb_stor_probe2(). By checking that path, we can see
that the BadDevice label leads to a scsi_host_put() after a SCSI host
allocation, but there's no call to scsi_add_host() in such path. That leads
to messages like this in dmesg (and a leak of the SCSI host proc
structure):

usb-storage 4-1:87.51: USB Mass Storage device detected
proc_dir_entry 'scsi/usb-storage' already registered
WARNING: CPU: 1 PID: 3519 at fs/proc/generic.c:377 proc_register+0x347/0x4e0 fs/proc/generic.c:376

The proper fix seems to still call scsi_proc_hostdir_rm() on dev_release(),
but guard that with the state check for SHOST_CREATED; there is even a
comment in scsi_host_dev_release() detailing that: such conditional is
meant for cases where the SCSI host was allocated but there was no calls to
{add,remove}_host(), like the usb-storage case.

This is what we propose here and with that, the error path of usb-storage
does not trigger the warning anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0053f15d50d50c9312d8ab9c11e2e405812dfcac; https://git.kernel.org/stable/c/3678cf67ff7136db1dd3bf63c361650db5d92889; https://git.kernel.org/stable/c/5c2386ba80e779a92ec3bb64ccadbedd88f779b1
CVE: CVE-2024-26936
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: validate request buffer size in smb2_allocate_rsp_buf()

The response buffer should be allocated in smb2_allocate_rsp_buf
before validating request. But the fields in payload as well as smb2 header
is used in smb2_allocate_rsp_buf(). This patch add simple buffer size
validation to avoid potencial out-of-bounds in request buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/17cf0c2794bdb6f39671265aa18aea5c22ee8c4a; https://git.kernel.org/stable/c/21ff9d7d223c5c19cb4334009e4c0c83a2f4d674; https://git.kernel.org/stable/c/2c27a64a2bc47d9bfc7c3cf8be14be53b1ee7cb6
CVE: CVE-2024-26938
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()

If we have no VBT, or the VBT didn't declare the encoder
in question, we won't have the 'devdata' for the encoder.
Instead of oopsing just bail early.

We won't be able to tell whether the port is DP++ or not,
but so be it.

(cherry picked from commit[PII_REDACTED]6342c8a80d2b027923e9ee7d33b733)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/32e39bab59934bfd3f37097d4dd85ac5eb0fd549; https://git.kernel.org/stable/c/94cf2fb6feccd625e5b4e23e1b70f39a206f82ac; https://git.kernel.org/stable/c/a891add409e3bc381f4f68c2ce9d953f1865cb1f
CVE: CVE-2024-26940
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed

The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the
corresponding ttm_resource_manager is not allocated.
This leads to a crash when trying to read from this file.

Add a check to create mob_ttm, system_mob_ttm, and gmr_ttm debug file
only when the corresponding ttm_resource_manager is allocated.

crash> bt
PID: 3133409  TASK: ffff8fe4834a5000  CPU: 3    COMMAND: "grep"
 #0 [ffffb954506b3b20] machine_kexec at ffffffffb2a6bec3
 #1 [ffffb954506b3b78] __crash_kexec at ffffffffb2bb598a
 #2 [ffffb954506b3c38] crash_kexec at ffffffffb2bb68c1
 #3 [ffffb954506b3c50] oops_end at ffffffffb2a2a9b1
 #4 [ffffb954506b3c70] no_context at ffffffffb2a7e913
 #5 [ffffb954506b3cc8] __bad_area_nosemaphore at ffffffffb2a7ec8c
 #6 [ffffb954506b3d10] do_page_fault at ffffffffb2a7f887
 #7 [ffffb954506b3d40] page_fault at ffffffffb360116e
    [exception RIP: ttm_resource_manager_debug+0x11]
    RIP: ffffffffc04afd11  RSP: ffffb954506b3df0  RFLAGS: 00010246
    RAX: ffff8fe41a6d1200  RBX: [PII_REDACTED]  RCX: [PII_REDACTED]
    RDX: [PII_REDACTED]  RSI: ffffffffc04b4338  RDI: [PII_REDACTED]
    RBP: ffffb954506b3e08   R8: ffff8fee3ffad000   R9: [PII_REDACTED]
    R10: ffff8fe41a76a000  R11: [PII_REDACTED]  R12: 00000000ffffffff
    R13: [PII_REDACTED]  R14: ffff8fe5bb6f3900  R15: ffff8fe41a6d1200
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #8 [ffffb954506b3e00] ttm_resource_manager_show at ffffffffc04afde7 [ttm]
 #9 [ffffb954506b3e30] seq_read at ffffffffb2d8f9f3
    RIP: 00007f4c4eda8985  RSP: 00007ffdbba9e9f8  RFLAGS: 00000246
    RAX: ffffffffffffffda  RBX:[PII_REDACTED]37e000  RCX: 00007f4c4eda8985
    RDX:[PII_REDACTED]37e000  RSI: 00007f4c41573000  RDI: [PII_REDACTED]
    RBP:[PII_REDACTED]37e000   R8: [PII_REDACTED]   R9:[PII_REDACTED]37fe30
    R10: [PII_REDACTED]  R11: [PII_REDACTED]  R12: 00007f4c41573000
    R13: [PII_REDACTED]  R14: 00007f4c41572010  R15: [PII_REDACTED]
    ORIG_RAX: [PII_REDACTED]  CS: 0033  SS: 002b
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]81d81c9e8f2ea3f56b9e2b4ea14500; https://git.kernel.org/stable/c/042ef0afc40fa1a22b3608f22915b91ce39d128f; https://git.kernel.org/stable/c/25e3ce59c1200f1f0563e39de151f34962ab0fe1
CVE: CVE-2024-26942
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net: phy: qcom: at803x: fix kernel panic with at8031_probe

On reworking and splitting the at803x driver, in splitting function of
at803x PHYs it was added a NULL dereference bug where priv is referenced
before it's actually allocated and then is tried to write to for the
is_1000basex and is_fiber variables in the case of at8031, writing on
the wrong address.

Fix this by correctly setting priv local variable only after
at803x_probe is called and actually allocates priv in the phydev struct.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-362
References: https://git.kernel.org/stable/c/6a4aee277740d04ac0fd54cfa17cc28261932ddc; https://git.kernel.org/stable/c/a8a296ad9957b845b89bcf48be1cf8c74875ecc3; https://git.kernel.org/stable/c/6a4aee277740d04ac0fd54cfa17cc28261932ddc
CVE: CVE-2024-26943
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

nouveau/dmem: handle kcalloc() allocation failure

The kcalloc() in nouveau_dmem_evict_chunk() will return null if
the physical memory has run out. As a result, if we dereference
src_pfns, dst_pfns or dma_addrs, the null pointer dereference bugs
will happen.

Moreover, the GPU is going away. If the kcalloc() fails, we could not
evict all pages mapping a chunk. So this patch adds a __GFP_NOFAIL
flag in kcalloc().

Finally, as there is no need to have physically contiguous memory,
this patch switches kcalloc() to kvcalloc() in order to avoid
failing allocations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/16e87fe23d4af6df920406494ced5c0f4354567b; https://git.kernel.org/stable/c/2a84744a037b8a511d6a9055f3defddc28ff4a4d; https://git.kernel.org/stable/c/3e82f7383e0b82a835e6b6b06a348b2bc4e2c2ee
CVE: CVE-2024-26945
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix nr_cpus < nr_iaa case

If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which
causes a divide-by-0 in rebalance_wq_table().

Make sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0
case, even though cpus_per_iaa is never used if nr_iaa == 0, for
paranoia.
CVSS Score: 8.4 (HIGH)
CWE: CWE-369
References: https://git.kernel.org/stable/c/5a7e89d3315d1be86aff8a8bf849023cda6547f7; https://git.kernel.org/stable/c/a5ca1be7f9817de4e93085778b3ee2219bdc2664; https://git.kernel.org/stable/c/5a7e89d3315d1be86aff8a8bf849023cda6547f7
CVE: CVE-2024-26946
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address

Read from an unsafe address with copy_from_kernel_nofault() in
arch_adjust_kprobe_addr() because this function is used before checking
the address is in text or not. Syzcaller bot found a bug and reported
the case if user specifies inaccessible data area,
arch_adjust_kprobe_addr() will cause a kernel panic.

[ mingo: Clarified the comment. ]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/20fdb21eabaeb8f78f8f701f56d14ea0836ec861; https://git.kernel.org/stable/c/4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b; https://git.kernel.org/stable/c/[PII_REDACTED]087904fffe8966d27ca74398c57dd6
CVE: CVE-2024-26947
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account
freed memory map alignment") changes the semantics of pfn_valid() to check
presence of the memory map for a PFN. A valid page for an address which
is reserved but not mapped by the kernel[1], the system crashed during
some uio test with the following memory layout:

 node   0: [mem 0x00000000c0a00000-0x00000000cc8fffff]
 node   0: [mem 0x00000000d0000000-0x00000000da1fffff]
 the uio layout is：0xc0900000, 0x100000

the crash backtrace like:

  Unable to handle kernel paging request at virtual address bff00000
  [...]
  CPU: 1 PID: 465 Comm: startapp.bin Tainted: G           O      5.10.0 #1
  Hardware name: Generic DT based system
  PC is at b15_flush_kern_dcache_area+0x24/0x3c
  LR is at __sync_icache_dcache+0x6c/0x98
  [...]
   (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98)
   (__sync_icache_dcache) from (set_pte_at+0x28/0x54)
   (set_pte_at) from (remap_pfn_range+0x1a0/0x274)
   (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio])
   (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4)
   (__mmap_region) from (__do_mmap_mm+0x3ec/0x440)
   (__do_mmap_mm) from (do_mmap+0x50/0x58)
   (do_mmap) from (vm_mmap_pgoff+0xfc/0x188)
   (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4)
   (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c)
  Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e)
  ---[ end trace 09cf0734c3805d52 ]---
  Kernel panic - not syncing: Fatal exception

So check if PG_reserved was set to solve this issue.

[1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c027c2bad7f5111c51a358b5d392e1a695dabff; https://git.kernel.org/stable/c/0c66c6f4e21cb22220cbd8821c5c73fc157d20dc; https://git.kernel.org/stable/c/9f7ddc222cae8254e93d5c169a8ae11a49d912a7
CVE: CVE-2024-26948
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Add a dc_state NULL check in dc_state_release

[How]
Check wheather state is NULL before releasing it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98; https://git.kernel.org/stable/c/d37a08f840485995e3fb91dad95e441b9d28a269; https://git.kernel.org/stable/c/334b56cea5d9df5989be6cf1a5898114fa70ad98
CVE: CVE-2024-26949
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/pm: Fix NULL pointer dereference when get power limit

Because powerplay_table initialization is skipped under
sriov case, We check and set default lower and upper OD
value if powerplay_table is NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/08ae9ef829b8055c2fdc8cfee37510c1f4721a07; https://git.kernel.org/stable/c/99c2f1563b1400cc8331fc79d19ada1bb95bb388; https://git.kernel.org/stable/c/b8eaa8ef1f1157a9f330e36e66bdd7a693309948
CVE: CVE-2024-26950
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being
dereferenced. It's actually easier and faster performance-wise to
instead get the device from ctx->wg. This semantically makes more sense
too, since ctx->wg->peer_allowedips.seq is compared with
ctx->allowedips_seq, basing them both in ctx. This also acts as a
defence in depth provision against freed peers.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/09c3fa70f65175861ca948cb2f0f791e666c90e5; https://git.kernel.org/stable/c/493aa6bdcffd90a4f82aa614fe4f4db0641b4068; https://git.kernel.org/stable/c/4be453271a882c8ebc28df3dbf9e4d95e6ac42f5
CVE: CVE-2024-26951
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: check for dangling peer via is_dead instead of empty list

If all peers are removed via wg_peer_remove_all(), rather than setting
peer_list to empty, the peer is added to a temporary list with a head on
the stack of wg_peer_remove_all(). If a netlink dump is resumed and the
cursored peer is one that has been removed via wg_peer_remove_all(), it
will iterate from that peer and then attempt to dump freed peers.

Fix this by instead checking peer->is_dead, which was explictly created
for this purpose. Also move up the device_update_lock lockdep assertion,
since reading is_dead relies on that.

It can be reproduced by a small script like:

    echo "Setting config..."
    ip link add dev wg0 type wireguard
    wg setconf wg0 /big-config
    (
            while true; do
                    echo "Showing config..."
                    wg showconf wg0 > /dev/null
            done
    ) &
    sleep 4
    wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n")

Resulting in:

    BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
    Read of size 8 at addr ffff88811956ec70 by task wg/59
    CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
    Call Trace:
     <TASK>
     dump_stack_lvl+0x47/0x70
     print_address_description.constprop.0+0x2c/0x380
     print_report+0xab/0x250
     kasan_report+0xba/0xf0
     __lock_acquire+0x182a/0x1b20
     lock_acquire+0x191/0x4b0
     down_read+0x80/0x440
     get_peer+0x140/0xcb0
     wg_get_device_dump+0x471/0x1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/13d[PII_REDACTED]6164481d31ce33f8fdb25a9c04; https://git.kernel.org/stable/c/302b2dfc013baca3dea7ceda383930d9297d231d; https://git.kernel.org/stable/c/55b6c738673871c9b0edae05d0c97995c1ff08c4
CVE: CVE-2024-26952
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix potencial out-of-bounds when buffer offset is invalid

I found potencial out-of-bounds when buffer offset fields of a few requests
is invalid. This patch set the minimum value of buffer offset field to
->Buffer offset to validate buffer length.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-125
References: https://git.kernel.org/stable/c/0c5541b4c980626fa3cab16ba1a451757778bbb5; https://git.kernel.org/stable/c/2dcda336b6e80b72d58d30d40f2fad9724e5fe63; https://git.kernel.org/stable/c/39bdc4197acf2ed13269167ccf093ee28cfa2a4e
CVE: CVE-2024-26954
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()

If ->NameOffset of smb2_create_req is smaller than Buffer offset of
smb2_create_req, slab-out-of-bounds read can happen from smb2_open.
This patch set the minimum value of the name offset to the buffer offset
to validate name length of smb2_create_req().
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/3b8da67191e938a63d2736dabb4ac5d337e5de57; https://git.kernel.org/stable/c/4f97e6a9d62cb1fce82fbf4baff44b83221bc178; https://git.kernel.org/stable/c/9e4937cbc150f9d5a9b5576e1922ef0b5ed2eb72
CVE: CVE-2024-26955
Published: 2024-05-01
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: prevent kernel bug at submit_bh_wbc()

Fix a bug where nilfs_get_block() returns a successful status when
searching and inserting the specified block both fail inconsistently.  If
this inconsistent behavior is not due to a previously fixed bug, then an
unexpected race is occurring, so return a temporary error -EAGAIN instead.

This prevents callers such as __block_write_begin_int() from requesting a
read into a buffer that is not mapped, which would cause the BUG_ON check
for the BH_Mapped flag in submit_bh_wbc() to fail.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/0c8aa4cfda4e4adb15d5b6536d155eca9c9cd44c; https://git.kernel.org/stable/c/192e9f9078c96be30b31c4b44d6294b24520fce5; https://git.kernel.org/stable/c/269cdf353b5bdd15f1a079671b0f889113865f20