deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-46738
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

When removing a resource from vmci_resource_table in
vmci_resource_remove(), the search is performed using the resource
handle by comparing context and resource fields.

It is possible though to create two resources with different types
but same handle (same context and resource fields).

When trying to remove one of the resources, vmci_resource_remove()
may not remove the intended one, but the object will still be freed
as in the case of the datagram type in vmci_datagram_destroy_handle().
vmci_resource_table will still hold a pointer to this freed resource
leading to a use-after-free vulnerability.

BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106
 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425
 kasan_report+0x38/0x51 mm/kasan/report.c:442
 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
 vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182
 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline]
 vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195
 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
 __fput+0x261/0xa34 fs/file_table.c:282
 task_work_run+0xf0/0x194 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187
 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline]
 syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313
 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x6e/0x0

This change ensures the type is also checked when removing
the resource from vmci_resource_table in vmci_resource_remove().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/00fe5292f081f8d773e572df8e03bf6e1855fe49; https://git.kernel.org/stable/c/39e7e593418ccdbd151f2925fa6be1a616d16c96; https://git.kernel.org/stable/c/48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7
CVE: CVE-2024-46739
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind

For primary VM Bus channels, primary_channel pointer is always NULL. This
pointer is valid only for the secondary channels. Also, rescind callback
is meant for primary channels only.

Fix NULL pointer dereference by retrieving the device_obj from the parent
for the primary channel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1d8e020e51ab07e40f9dd00b52f1da7d96fec04c; https://git.kernel.org/stable/c/2be373469be1774bbe03b0fa7e2854e65005b1cc; https://git.kernel.org/stable/c/3005091cd537ef8cdb7530dcb2ecfba8d2ef475c
CVE: CVE-2024-46740
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

binder: fix UAF caused by offsets overwrite

Binder objects are processed and copied individually into the target
buffer during transactions. Any raw data in-between these objects is
copied as well. However, this raw data copy lacks an out-of-bounds
check. If the raw data exceeds the data section size then the copy
overwrites the offsets section. This eventually triggers an error that
attempts to unwind the processed objects. However, at this point the
offsets used to index these objects are now corrupted.

Unwinding with corrupted offsets can result in decrements of arbitrary
nodes and lead to their premature release. Other users of such nodes are
left with a dangling pointer triggering a use-after-free. This issue is
made evident by the following KASAN report (trimmed):

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff47fc91598f04 by task binder-util/743

  CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_free_buf+0x128/0x434
   binder_thread_write+0x8a4/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Allocated by task 743:
   __kmalloc_cache_noprof+0x110/0x270
   binder_new_node+0x50/0x700
   binder_transaction+0x413c/0x6da8
   binder_thread_write+0x978/0x3260
   binder_ioctl+0x18f0/0x258c
  [...]

  Freed by task 745:
   kfree+0xbc/0x208
   binder_thread_read+0x1c5c/0x37d4
   binder_ioctl+0x16d8/0x258c
  [...]
  ==================================================================

To avoid this issue, let's check that the raw data copy is within the
boundaries of the data section.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792; https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f[PII_REDACTED]900c2fe5bb0; https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4
CVE: CVE-2024-46741
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix double free of 'buf' in error path

smatch warning:
drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf'

In fastrpc_req_mmap() error path, the fastrpc buffer is freed in
fastrpc_req_munmap_impl() if unmap is successful.

But in the end, there is an unconditional call to fastrpc_buf_free().
So the above case triggers the double free of fastrpc buf.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/bfc1704d909dc9911a558b1a5833d3d61a43a1f2; https://git.kernel.org/stable/c/e8c276d4dc0e19ee48385f74426aebc855b49aaf; https://git.kernel.org/stable/c/f77dc8a75859e559f3238a6d[PII_REDACTED]27985e
CVE: CVE-2024-46742
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open()

null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE)
and parse_lease_state() return NULL.

Fix this by check if 'lease_ctx_info' is NULL.

Additionally, remove the redundant parentheses in
parse_durable_handle_context().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/07f384c5be1f8633b13f0a22616e227570450bc6; https://git.kernel.org/stable/c/3b692794b81f2ecad69a4adbba687f3836824ada; https://git.kernel.org/stable/c/4e8771a3666c8f216eefd6bd2fd50121c6c437db
CVE: CVE-2024-46744
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

Squashfs: sanity check symbolic link size

Syzkiller reports a "KMSAN: uninit-value in pick_link" bug.

This is caused by an uninitialised page, which is ultimately caused
by a corrupted symbolic link size read from disk.

The reason why the corrupted symlink size causes an uninitialised
page is due to the following sequence of events:

1. squashfs_read_inode() is called to read the symbolic
   link from disk.  This assigns the corrupted value
  [PII_REDACTED] to inode->i_size.

2. Later squashfs_symlink_read_folio() is called, which assigns
   this corrupted value to the length variable, which being a
   signed int, overflows producing a negative number.

3. The following loop that fills in the page contents checks that
   the copied bytes is less than length, which being negative means
   the loop is skipped, producing an uninitialised page.

This patch adds a sanity check which checks that the symbolic
link size is not larger than expected.

--

V2: fix spelling mistake.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://git.kernel.org/stable/c/087f25b2d36adae19951114ffcbb7106ed405ebb; https://git.kernel.org/stable/c/1b9451ba6f21478a75288ea3e3fca4be35e2a438; https://git.kernel.org/stable/c/5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4
CVE: CVE-2024-46745
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: uinput - reject requests with unreasonable number of slots


When exercising uinput interface syzkaller may try setting up device
with a really large number of slots, which causes memory allocation
failure in input_mt_init_slots(). While this allocation failure is
handled properly and request is rejected, it results in syzkaller
reports. Additionally, such request may put undue burden on the
system which will try to free a lot of memory for a bogus request.

Fix it by limiting allowed number of slots to 100. This can easily
be extended if we see devices that can track more than 100 contacts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://git.kernel.org/stable/c/206f533a0a7c683982af473079c4111f4a0f9f5e; https://git.kernel.org/stable/c/51fa08edd80003db700bdaa099385c5900d27f4b; https://git.kernel.org/stable/c/597ff930296c4c8fc6b6a536884d4f1a7187ec70
CVE: CVE-2024-46747
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup

report_fixup for the Cougar 500k Gaming Keyboard was not verifying
that the report descriptor size was correct before accessing it
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/30e9ce7cd5591be639b53595c95812f1a2afdfdc; https://git.kernel.org/stable/c/34185de73d74fdc90e8651cfc472bfea6073a13f; https://git.kernel.org/stable/c/48b2108efa205f4579052c27fba2b22cc6ad8aa0
CVE: CVE-2024-46748
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Set the max subreq size for cache writes to MAX_RW_COUNT

Set the maximum size of a subrequest that writes to cachefiles to be
MAX_RW_COUNT so that we don't overrun the maximum write we can make to the
backing filesystem.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/51d37982bbac3ea0ca21b2797a9cb0044272b3aa; https://git.kernel.org/stable/c/cec226f9b1fd6cf55bc157873aec61b523083e96
CVE: CVE-2024-46750
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: Add missing bridge lock to pci_bus_lock()

One of the true positives that the cfg_access_lock lockdep effort
identified is this sequence:

  WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pci_bridge_secondary_bus_reset+0x5d/0x70
  RIP: 0010:pci_bridge_secondary_bus_reset+0x5d/0x70
  Call Trace:
   <TASK>
   ? __warn+0x8c/0x190
   ? pci_bridge_secondary_bus_reset+0x5d/0x70
   ? report_bug+0x1f8/0x200
   ? handle_bug+0x3c/0x70
   ? exc_invalid_op+0x18/0x70
   ? asm_exc_invalid_op+0x1a/0x20
   ? pci_bridge_secondary_bus_reset+0x5d/0x70
   pci_reset_bus+0x1d8/0x270
   vmd_probe+0x778/0xa10
   pci_device_probe+0x95/0x120

Where pci_reset_bus() users are triggering unlocked secondary bus resets.
Ironically pci_bus_reset(), several calls down from pci_reset_bus(), uses
pci_bus_lock() before issuing the reset which locks everything *but* the
bridge itself.

For the same motivation as adding:

  bridge = pci_upstream_bridge(dev);
  if (bridge)
    pci_dev_lock(bridge);

to pci_reset_function() for the "bus" and "cxl_bus" reset cases, add
pci_dev_lock() for @bus->self to pci_bus_lock().

[bhelgaas: squash in recursive locking deadlock fix from Keith Busch:
https://lore.kernel.org/r/[PII_REDACTED]3650.701834-1-kbusch@meta.com]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945; https://git.kernel.org/stable/c/0790b89c7e911003b8c50ae50e3ac7645de1fae9; https://git.kernel.org/stable/c/7253b4fed46471cc247c6cacefac890a8472c083
CVE: CVE-2024-46751
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: don't BUG_ON() when 0 reference count at btrfs_lookup_extent_info()

Instead of doing a BUG_ON() handle the error by returning -EUCLEAN,
aborting the transaction and logging an error message.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18eb53a2734ff61b9a72c4fef5db7b38cb48ae16; https://git.kernel.org/stable/c/28cb13f29faf6290597b24b728dc3100c019356f; https://git.kernel.org/stable/c/3cfec712a439c5c5f5c718c5c669ee41a898f776
CVE: CVE-2024-46752
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: replace BUG_ON() with error handling at update_ref_for_cow()

Instead of a BUG_ON() just return an error, log an error message and
abort the transaction in case we find an extent buffer belonging to the
relocation tree that doesn't have the full backref flag set. This is
unexpected and should never happen (save for bugs or a potential bad
memory).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://git.kernel.org/stable/c/0fbac73a97286a7ec72229cb9b42d760a2c717ac; https://git.kernel.org/stable/c/41a0f85e268d72fe04f731b8ceea4748c2d65491; https://git.kernel.org/stable/c/b50857b96429a09fd3beed9f7f21b7bb7c433688
CVE: CVE-2024-46753
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle errors from btrfs_dec_ref() properly

In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is
incorrect, we have proper error handling here, return the error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/0e4840ae09f[PII_REDACTED]00ce47424818fcbcc7c; https://git.kernel.org/stable/c/2c4fe45351e544da4b8f10c74b277117a4fa7869; https://git.kernel.org/stable/c/5eb178f373b4f16f3b42d55ff88fc94dd95b93b1
CVE: CVE-2024-46754
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Remove tst_run from lwt_seg6local_prog_ops.

The syzbot reported that the lwt_seg6 related BPF ops can be invoked
via bpf_test_run() without without entering input_action_end_bpf()
first.

Martin KaFai Lau said that self test for BPF_PROG_TYPE_LWT_SEG6LOCAL
probably didn't work since it was introduced in commit 04d4b274e2a
("ipv6: sr: Add seg6local action End.BPF"). The reason is that the
per-CPU variable seg6_bpf_srh_states::srh is never assigned in the self
test case but each BPF function expects it.

Remove test_run for BPF_PROG_TYPE_LWT_SEG6LOCAL.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/9cd15511de7c619bbd0f54bb3f28e6e720ded5d6; https://git.kernel.org/stable/c/c13fda93aca118b8e5cd202e339046728ee7dddb
CVE: CVE-2024-46756
Published: 2024-09-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-46757
Published: 2024-09-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-46758
Published: 2024-09-18
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-46759
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large
negative number such as [PII_REDACTED]854775808 is provided by the user.
Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-191
References: https://git.kernel.org/stable/c/019ef2d396363ecddc46e826153a842f8603799b; https://git.kernel.org/stable/c/05419d0056dcf7088687e561bb583cc06deba777; https://git.kernel.org/stable/c/2a3add62f183459a057336381ef3a896da01ce38
CVE: CVE-2024-46760
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw88: usb: schedule rx work after everything is set up

Right now it's possible to hit NULL pointer dereference in
rtw_rx_fill_rx_status on hw object and/or its fields because
initialization routine can start getting USB replies before
rtw_dev is fully setup.

The stack trace looks like this:

rtw_rx_fill_rx_status
rtw8821c_query_rx_desc
rtw_usb_rx_handler
...
queue_work
rtw_usb_read_port_complete
...
usb_submit_urb
rtw_usb_rx_resubmit
rtw_usb_init_rx
rtw_usb_probe

So while we do the async stuff rtw_usb_probe continues and calls
rtw_register_hw, which does all kinds of initialization (e.g.
via ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.

Fix this by moving the first usb_submit_urb after everything
is set up.

For me, this bug manifested as:
[    8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped
[    8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status
because I'm using Larry's backport of rtw88 driver with the NULL
checks in rtw_rx_fill_rx_status.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/25eaef533bf3ccc6fee5067aac16f41f280e343e; https://git.kernel.org/stable/c/adc539784c98a7cc602cbf557debfc2e7b9be8b3; https://git.kernel.org/stable/c/c83d464b82a8ad62ec9077637f75d73fe955635a
CVE: CVE-2024-46761
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv

The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel
crash when we try to hot-unplug/disable the PCIe switch/bridge from
the PHB.

The crash occurs because although the MSI data structure has been
released during disable/hot-unplug path and it has been assigned
with NULL, still during unregistration the code was again trying to
explicitly disable the MSI which causes the NULL pointer dereference and
kernel crash.

The patch fixes the check during unregistration path to prevent invoking
pci_disable_msi/msix() since its data structure is already freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/335e35b748527f0c06ded9eebb65387f60647fda; https://git.kernel.org/stable/c/438d[PII_REDACTED]42b5c8798f8ce83bbe479dca4d; https://git.kernel.org/stable/c/4eb4085c1346d19d4a05c55246eb93e74e671048
CVE: CVE-2024-46762
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

xen: privcmd: Fix possible access to a freed kirqfd instance

Nothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and
privcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd
created and added to the irqfds_list by privcmd_irqfd_assign() may get
removed by another thread executing privcmd_irqfd_deassign(), while the
former is still using it after dropping the locks.

This can lead to a situation where an already freed kirqfd instance may
be accessed and cause kernel oops.

Use SRCU locking to prevent the same, as is done for the KVM
implementation for irqfds.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/112fd2f02b308564724b8e81006c254d20945c4b; https://git.kernel.org/stable/c/611ff1b1ae989a7bcce3e2a8e132ee30e968c557; https://git.kernel.org/stable/c/e997b357b13a7d95de31681fc54fcc34235fa527
CVE: CVE-2024-46764
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: add check for invalid name in btf_name_valid_section()

If the length of the name string is 1 and the value of name[0] is NULL
byte, an OOB vulnerability occurs in btf_name_valid_section() and the
return value is true, so the invalid name passes the check.

To solve this, you need to check if the first position is NULL byte and
if the first character is printable.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/bb6705c3f93bed2af03d43691743d4c43e3c8e6f; https://git.kernel.org/stable/c/c8ffe2d4d37a05ce18c71b87421443c16f8475e5
CVE: CVE-2024-46767
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

net: phy: Fix missing of_node_put() for leds

The call of of_get_child_by_name() will cause refcount incremented
for leds, if it succeeds, it should call of_node_put() to decrease
it, fix it.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2560db6ede1aaf162a73b2df43e0b6c5ed8819f7; https://git.kernel.org/stable/c/26928c8f00f6bb0e194f3957fe51c69d36838eb2; https://git.kernel.org/stable/c/d9c8dbbc236cdc6231ee91cdede2fc97b430cfff
CVE: CVE-2024-46768
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: (hp-wmi-sensors) Check if WMI event data exists

The BIOS can choose to return no event data in response to a
WMI event, so the ACPI object passed to the WMI notify handler
can be NULL.

Check for such a situation and ignore the event in such a case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/217539e994e53206bbf3fb330261cc78c480d311; https://git.kernel.org/stable/c/4b19c83ba108aa66226da5b79810e4d19e005f12; https://git.kernel.org/stable/c/a54da9df75cd1b4b5028f6c60f9a[PII_REDACTED]85
CVE: CVE-2024-46769
Published: 2024-09-18
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: intel: Add check devm_kasprintf() returned value

intel_spi_populate_chip() use devm_kasprintf() to set pdata->name.
This can return a NULL pointer on failure but this returned value
is not checked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]ec[PII_REDACTED]8f3ec386dfd3d784a6; https://git.kernel.org/stable/c/6e68abdc5d674f9f4185bf1e1956368d05df4838