deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-41025
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: fastrpc: Fix memory leak in audio daemon attach operation

Audio PD daemon send the name as part of the init IOCTL call. This
name needs to be copied to kernel for which memory is allocated.
This memory is never freed which might result in memory leak. Free
the memory when it is not needed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/8b8b82dcf393ceaca8c88939338fd4c30b5b11b2; https://git.kernel.org/stable/c/ad0bd973a033003ca578c42a760d1dc77aeea15e; https://git.kernel.org/stable/c/dbf4c31c9b039fd9734da156036492a2a7f78f64
CVE: CVE-2024-41026
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: davinci_mmc: Prevent transmitted data size from exceeding sgm's length

No check is done on the size of the data to be transmiited. This causes
a kernel panic when this size exceeds the sg_miter's length.

Limit the number of transmitted bytes to sgm->length.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16198eef11c[PII_REDACTED]d7f6271b4bf6aa44615; https://git.kernel.org/stable/c/c561c4ecce712f94b442db5960e281f13b28df2e; https://git.kernel.org/stable/c/16198eef11c[PII_REDACTED]d7f6271b4bf6aa44615
CVE: CVE-2024-41027
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

Fix userfaultfd_api to return EINVAL as expected

Currently if we request a feature that is not set in the Kernel config we
fail silently and return all the available features.  However, the man
page indicates we should return an EINVAL.

We need to fix this issue since we can end up with a Kernel warning should
a program request the feature UFFD_FEATURE_WP_UNPOPULATED on a kernel with
the config not set with this feature.

 [  200.812896] WARNING: CPU: 91 PID: 13634 at mm/memory.c:1660 zap_pte_range+0x43d/0x660
 [  200.820738] Modules linked in:
 [  200.869387] CPU: 91 PID: 13634 Comm: userfaultfd Kdump: loaded Not tainted 6.9.0-rc5+ #8
 [  200.877477] Hardware name: Dell Inc. PowerEdge R6525/0N7YGH, BIOS 2.7.3 03/30/2022
 [  200.885052] RIP: 0010:zap_pte_range+0x43d/0x660
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/14875fd5f9bcf60ac5518c63bfb676ade44aa7c6; https://git.kernel.org/stable/c/1723f04caacb32cadc4e063725d836a0c4450694; https://git.kernel.org/stable/c/519547760f16eae7803d2658d9524bc5ba7a20a7
CVE: CVE-2024-41028
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/x86: toshiba_acpi: Fix array out-of-bounds access

In order to use toshiba_dmi_quirks[] together with the standard DMI
matching functions, it must be terminated by a empty entry.

Since this entry is missing, an array out-of-bounds access occurs
every time the quirk list is processed.

Fix this by adding the terminating empty entry.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/0d71da43d6b7916d36cf1953d793da80433c50bf; https://git.kernel.org/stable/c/639868f1cb87b683cf830353bbee0c[PII_REDACTED]; https://git.kernel.org/stable/c/b6e02c6b0377d4339986e07aeb696c632cd392aa
CVE: CVE-2024-41029
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nvmem: core: limit cell sysfs permissions to main attribute ones

The cell sysfs attribute should not provide more access to the nvmem
data than the main attribute itself.
For example if nvme_config::root_only was set, the cell attribute
would still provide read access to everybody.

Mask out permissions not available on the main attribute.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6bef98bafd82903a8d461463f9594f19f1fd6a85; https://git.kernel.org/stable/c/aa066afaaac32caf2160d58d4e3010ee04421c62; https://git.kernel.org/stable/c/6bef98bafd82903a8d461463f9594f19f1fd6a85
CVE: CVE-2024-41030
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ksmbd: discard write access to the directory open

may_open() does not allow a directory to be opened with the write access.
However, some writing flags set by client result in adding write access
on server, making ksmbd incompatible with FUSE file system. Simply, let's
discard the write access when opening a directory.

list_add corruption. next is NULL.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:26!
pc : __list_add_valid+0x88/0xbc
lr : __list_add_valid+0x88/0xbc
Call trace:
__list_add_valid+0x88/0xbc
fuse_finish_open+0x11c/0x170
fuse_open_common+0x284/0x5e8
fuse_dir_open+0x14/0x24
do_dentry_open+0x2a4/0x4e0
dentry_open+0x50/0x80
smb2_open+0xbe4/0x15a4
handle_ksmbd_work+0x478/0x5ec
process_one_work+0x1b4/0x448
worker_thread+0x25c/0x430
kthread+0x104/0x1d4
ret_from_fork+0x10/0x20
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/198498b2049c0f11f7670be6974570e02b0cc035; https://git.kernel.org/stable/c/66cf853e1c7a2407f15d9f7aaa3e47d61745e361; https://git.kernel.org/stable/c/9e84b1ba5c98fb5c9f869c85db1d870354613baa
CVE: CVE-2024-41031
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/filemap: skip to create PMD-sized page cache if needed

On ARM64, HPAGE_PMD_ORDER is 13 when the base page size is 64KB.  The
PMD-sized page cache can't be supported by xarray as the following error
messages indicate.

------------[ cut here ]------------
WARNING: CPU: 35 PID: 7484 at lib/xarray.c:1025 xas_split_alloc+0xf8/0x128
Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib  \
nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct    \
nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4    \
ip_set rfkill nf_tables nfnetlink vfat fat virtio_balloon drm      \
fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64      \
sha1_ce virtio_net net_failover virtio_console virtio_blk failover \
dimlib virtio_mmio
CPU: 35 PID: 7484 Comm: test Kdump: loaded Tainted: G W 6.10.0-rc5-gavin+ #9
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20240524-1.el9 05/24/2024
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : xas_split_alloc+0xf8/0x128
lr : split_huge_page_to_list_to_order+0x1c4/0x720
sp : ffff800087a4f6c0
x29: ffff800087a4f6c0 x28: ffff800087a4f720 x27: 000000001fffffff
x26:[PII_REDACTED]000c40 x25:[PII_REDACTED]00000d x24: ffff00010625b858
x23: ffff800087a4f720 x22: ffffffdfc0780000 x21: [PII_REDACTED]
x20: [PII_REDACTED] x19: ffffffdfc0780000 x18: 000000001ff40000
x17: 00000000ffffffff x16: [PII_REDACTED] x15: 51ec[PII_REDACTED]00
x14: 0000e[PII_REDACTED]0 x13: [PII_REDACTED] x12: [PII_REDACTED]
x11: 51ec[PII_REDACTED]00 x10: 51ece1c0ffff8000 x9 : ffffbeb961a44d28
x8 : [PII_REDACTED] x7 : ffffffdfc0456420 x6 : ffff0000e1aa6eb8
x5 : 20bf08b4fe778fca x4 : ffffffdfc0456420 x3 :[PII_REDACTED]000c40
x2 :[PII_REDACTED]00000d x1 :[PII_REDACTED]00000c x0 : [PII_REDACTED]
Call trace:
 xas_split_alloc+0xf8/0x128
 split_huge_page_to_list_to_order+0x1c4/0x720
 truncate_inode_partial_folio+0xdc/0x160
 truncate_inode_pages_range+0x1b4/0x4a8
 truncate_pagecache_range+0x84/0xa0
 xfs_flush_unmap_range+0x70/0x90 [xfs]
 xfs_file_fallocate+0xfc/0x4d8 [xfs]
 vfs_fallocate+0x124/0x2e8
 ksys_fallocate+0x4c/0xa0
 __arm64_sys_fallocate+0x24/0x38
 invoke_syscall.constprop.0+0x7c/0xd8
 do_el0_svc+0xb4/0xd0
 el0_svc+0x44/0x1d8
 el0t_64_sync_handler+0x134/0x150
 el0t_64_sync+0x17c/0x180

Fix it by skipping to allocate PMD-sized page cache when its size is
larger than MAX_PAGECACHE_ORDER.  For this specific case, we will fall to
regular path where the readahead window is determined by BDI's sysfs file
(read_ahead_kb).
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/06b5a69c27ec405a3c3f2da8520ff1ee70b94a21; https://git.kernel.org/stable/c/1ef650d3b1b2a16473981b447f38705fe9b93972; https://git.kernel.org/stable/c/3390916aca7af1893ed2ebcdfee1d6fdb65bb058
CVE: CVE-2024-41032
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: vmalloc: check if a hash-index is in cpu_possible_mask

The problem is that there are systems where cpu_possible_mask has gaps
between set CPUs, for example SPARC.  In this scenario addr_to_vb_xa()
hash function can return an index which accesses to not-possible and not
setup CPU area using per_cpu() macro.  This results in an oops on SPARC.

A per-cpu vmap_block_queue is also used as hash table, incorrectly
assuming the cpu_possible_mask has no gaps.  Fix it by adjusting an index
to a next possible CPU.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/28acd531c9a365dac01b32e6bc54aed8c1429bcb; https://git.kernel.org/stable/c/47f9b6e49b422392fb0e348a65eb925103ba1882; https://git.kernel.org/stable/c/a34acf30b19bc4ee3ba2f1082756ea2604c19138
CVE: CVE-2024-41033
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

cachestat: do not flush stats in recency check

syzbot detects that cachestat() is flushing stats, which can sleep, in its
RCU read section (see [1]).  This is done in the workingset_test_recent()
step (which checks if the folio's eviction is recent).

Move the stat flushing step to before the RCU read section of cachestat,
and skip stat flushing during the recency check.

[1]: https://lore.kernel.org/cgroups/[PII_REDACTED]00f71227061bdf97e0@google.com/
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1d1ba14e00d290b1ed616ed78c8c49bf897ce390; https://git.kernel.org/stable/c/5a4d8944d6b1e1aaaa83ea42c116b520b4ed0394; https://git.kernel.org/stable/c/e2f7c76758be16f1dc32c5a82270d4f6649eedab
CVE: CVE-2024-41034
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix kernel bug on rename operation of broken directory

Syzbot reported that in rename directory operation on broken directory on
nilfs2, __block_write_begin_int() called to prepare block write may fail
BUG_ON check for access exceeding the folio/page size.

This is because nilfs_dotdot(), which gets parent directory reference
entry ("..") of the directory to be moved or renamed, does not check
consistency enough, and may return location exceeding folio/page size for
broken directories.

Fix this issue by checking required directory entries ("." and "..") in
the first chunk of the directory in nilfs_dotdot().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231; https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e; https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5
CVE: CVE-2024-41035
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

Syzbot has identified a bug in usbcore (see the Closes: tag below)
caused by our assumption that the reserved bits in an endpoint
descriptor's bEndpointAddress field will always be 0.  As a result of
the bug, the endpoint_is_duplicate() routine in config.c (and possibly
other routines as well) may believe that two descriptors are for
distinct endpoints, even though they have the same direction and
endpoint number.  This can lead to confusion, including the bug
identified by syzbot (two descriptors with matching endpoint numbers
and directions, where one was interrupt and the other was bulk).

To fix the bug, we will clear the reserved bits in bEndpointAddress
when we parse the descriptor.  (Note that both the USB-2.0 and USB-3.1
specs say these bits are "Reserved, reset to zero".)  This requires us
to make a copy of the descriptor earlier in usb_parse_endpoint() and
use the copy instead of the original when checking for duplicates.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2bd8534a1b83c65702aec3cab164170f8e584188; https://git.kernel.org/stable/c/37514a5c1251a8c5c95c323f55050736e7069ac7; https://git.kernel.org/stable/c/60abea505b726b38232a0ef410d2bd1994a77f78
CVE: CVE-2024-41036
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ks8851: Fix deadlock with the SPI chip variant

When SMP is enabled and spinlocks are actually functional then there is
a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi
and ks8851_irq:

    watchdog: BUG: soft lockup - CPU#0 stuck for 27s!
    call trace:
      queued_spin_lock_slowpath+0x100/0x284
      do_raw_spin_lock+0x34/0x44
      ks8851_start_xmit_spi+0x30/0xb8
      ks8851_start_xmit+0x14/0x20
      netdev_start_xmit+0x40/0x6c
      dev_hard_start_xmit+0x6c/0xbc
      sch_direct_xmit+0xa4/0x22c
      __qdisc_run+0x138/0x3fc
      qdisc_run+0x24/0x3c
      net_tx_action+0xf8/0x130
      handle_softirqs+0x1ac/0x1f0
      __do_softirq+0x14/0x20
      ____do_softirq+0x10/0x1c
      call_on_irq_stack+0x3c/0x58
      do_softirq_own_stack+0x1c/0x28
      __irq_exit_rcu+0x54/0x9c
      irq_exit_rcu+0x10/0x1c
      el1_interrupt+0x38/0x50
      el1h_64_irq_handler+0x18/0x24
      el1h_64_irq+0x64/0x68
      __netif_schedule+0x6c/0x80
      netif_tx_wake_queue+0x38/0x48
      ks8851_irq+0xb8/0x2c8
      irq_thread_fn+0x2c/0x74
      irq_thread+0x10c/0x1b0
      kthread+0xc8/0xd8
      ret_from_fork+0x10/0x20

This issue has not been identified earlier because tests were done on
a device with SMP disabled and so spinlocks were actually NOPs.

Now use spin_(un)lock_bh for TX queue related locking to avoid execution
of softirq work synchronously that would lead to a deadlock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/0913ec336a6c0c4a2b296bd9f74f8e41c4c83c8c; https://git.kernel.org/stable/c/10fec0cd0e8f56ff06c46bb24254c7d8f8f2bbf0; https://git.kernel.org/stable/c/80ece00137300d74642f2038c8fe5440deaf9f05
CVE: CVE-2024-41037
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: Intel: hda: fix null deref on system suspend entry

When system enters suspend with an active stream, SOF core
calls hw_params_upon_resume(). On Intel platforms with HDA DMA used
to manage the link DMA, this leads to call chain of

   hda_dsp_set_hw_params_upon_resume()
 -> hda_dsp_dais_suspend()
 -> hda_dai_suspend()
 -> hda_ipc4_post_trigger()

A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first,
which clears hext_stream->link_substream, and then hda_ipc4_post_trigger()
is called with a NULL snd_pcm_substream pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450; https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd; https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61
CVE: CVE-2024-41038
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

Check that all fields of a V2 algorithm header fit into the available
firmware data buffer.

The wmfw V2 format introduced variable-length strings in the algorithm
block header. This means the overall header length is variable, and the
position of most fields varies depending on the length of the string
fields. Each field must be checked to ensure that it does not overflow
the firmware data buffer.

As this ia bugfix patch, the fixes avoid making any significant change to
the existing code. This makes it easier to review and less likely to
introduce new bugs.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/014239b9971d79421a0ba652579e1ca1b7b57b6d; https://git.kernel.org/stable/c/2163aff6bebbb752edf73f79700f5e2095f3559e; https://git.kernel.org/stable/c/6619aa48a011364e9f29083cc76368e6acfe5b11
CVE: CVE-2024-41039
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Fix overflow checking of wmfw header

Fix the checking that firmware file buffer is large enough for the
wmfw header, to prevent overrunning the buffer.

The original code tested that the firmware data buffer contained
enough bytes for the sums of the size of the structs

	wmfw_header + wmfw_adsp1_sizes + wmfw_footer

But wmfw_adsp1_sizes is only used on ADSP1 firmware. For ADSP2 and
Halo Core the equivalent struct is wmfw_adsp2_sizes, which is
4 bytes longer. So the length check didn't guarantee that there
are enough bytes in the firmware buffer for a header with
wmfw_adsp2_sizes.

This patch splits the length check into three separate parts. Each
of the wmfw_header, wmfw_adsp?_sizes and wmfw_footer are checked
separately before they are used.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/3019b86bce16fbb5bc1964f3544d0ce7d0137278; https://git.kernel.org/stable/c/49a79f344d0a17c6a5eef53716cc76fcdbfca9ba; https://git.kernel.org/stable/c/9c9877a96e033bf6c6470b3b4f06106d91ace11e
CVE: CVE-2024-41042
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: prefer nft_chain_validate

nft_chain_validate already performs loop detection because a cycle will
result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE).

It also follows maps via ->validate callback in nft_lookup, so there
appears no reason to iterate the maps again.

nf_tables_check_loops() and all its helper functions can be removed.
This improves ruleset load time significantly, from 23s down to 12s.

This also fixes a crash bug. Old loop detection code can result in
unbounded recursion:

BUG: TASK stack guard page was hit at ....
Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN
CPU: 4 PID: 1539 Comm: nft Not tainted 6.10.0-rc5+ #1
[..]

with a suitable ruleset during validation of register stores.

I can't see any actual reason to attempt to check for this from
nft_validate_register_store(), at this point the transaction is still in
progress, so we don't have a full picture of the rule graph.

For nf-next it might make sense to either remove it or make this depend
on table->validate_state in case we could catch an error earlier
(for improved error reporting to userspace).
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1947e4c3346faa8ac7e343652c0fd3b3e394202f; https://git.kernel.org/stable/c/31c35f9f89ef585f1edb53e17ac73a0ca4a9712b; https://git.kernel.org/stable/c/717c91c6ed73e248de6a15bc53adefb81446c9d0
CVE: CVE-2024-41043
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: drop bogus WARN_ON

Happens when rules get flushed/deleted while packet is out, so remove
this WARN_ON.

This WARN exists in one form or another since v4.14, no need to backport
this to older releases, hence use a more recent fixes tag.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/631a4b3ddc7831b20442c59c28b0476d0704c9af; https://git.kernel.org/stable/c/86858da8335db48bde9be02abd7156a69d622e86; https://git.kernel.org/stable/c/631a4b3ddc7831b20442c59c28b0476d0704c9af
CVE: CVE-2024-41044
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

ppp: reject claimed-as-LCP but actually malformed packets

Since 'ppp_async_encode()' assumes valid LCP packets (with code
from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that
LCP packet has an actual body beyond PPP_LCP header bytes, and
reject claimed-as-LCP but actually malformed data otherwise.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/099502ca410922b56353ccef2749bc0de669da78; https://git.kernel.org/stable/c/3134bdf7356ed952dcecb480861d2afcc1e40492; https://git.kernel.org/stable/c/3ba12c2afd933fc1bf800f6d3f6c7ec8f602ce56
CVE: CVE-2024-41045
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Defer work in bpf_timer_cancel_and_free

Currently, the same case as previous patch (two timer callbacks trying
to cancel each other) can be invoked through bpf_map_update_elem as
well, or more precisely, freeing map elements containing timers. Since
this relies on hrtimer_cancel as well, it is prone to the same deadlock
situation as the previous patch.

It would be sufficient to use hrtimer_try_to_cancel to fix this problem,
as the timer cannot be enqueued after async_cancel_and_free. Once
async_cancel_and_free has been done, the timer must be reinitialized
before it can be armed again. The callback running in parallel trying to
arm the timer will fail, and freeing bpf_hrtimer without waiting is
sufficient (given kfree_rcu), and bpf_timer_cb will return
HRTIMER_NORESTART, preventing the timer from being rearmed again.

However, there exists a UAF scenario where the callback arms the timer
before entering this function, such that if cancellation fails (due to
timer callback invoking this routine, or the target timer callback
running concurrently). In such a case, if the timer expiration is
significantly far in the future, the RCU grace period expiration
happening before it will free the bpf_hrtimer state and along with it
the struct hrtimer, that is enqueued.

Hence, it is clear cancellation needs to occur after
async_cancel_and_free, and yet it cannot be done inline due to deadlock
issues. We thus modify bpf_timer_cancel_and_free to defer work to the
global workqueue, adding a work_struct alongside rcu_head (both used at
_different_ points of time, so can share space).

Update existing code comments to reflect the new state of affairs.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1; https://git.kernel.org/stable/c/a6fcd19d7eac1335eb76bc16b6a66b7f574d1d69; https://git.kernel.org/stable/c/7aa5a19279c3639ae8b758b63f05d0c616a39fa1
CVE: CVE-2024-41046
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: lantiq_etop: fix double free in detach

The number of the currently released descriptor is never incremented
which results in the same skb being released multiple times.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/1a2db00a554cfda57c397cce79b2804bf9633fec; https://git.kernel.org/stable/c/22b16618a80858b3a9d[PII_REDACTED]26948cc4ae1; https://git.kernel.org/stable/c/69ad5fa0ce7c548262e0770fc2b726fe7ab4f156
CVE: CVE-2024-41049
Published: 2024-07-29
Description: In the Linux kernel, the following vulnerability has been resolved:

filelock: fix potential use-after-free in posix_lock_inode

Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode().
The request pointer had been changed earlier to point to a lock entry
that was added to the inode's list. However, before the tracepoint could
fire, another task raced in and freed that lock.

Fix this by moving the tracepoint inside the spinlock, which should
ensure that this doesn't happen.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/02a[PII_REDACTED]c70b20393ad[PII_REDACTED]ac9967; https://git.kernel.org/stable/c/116599f6a26906cf33f67975c59f0692ecf7e9b2; https://git.kernel.org/stable/c/1b3ec4f7c03d4b07bad70697d7e2f4088d2cfe92