huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-26603: kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever
Component: kernel
Severity: Low
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-24T00:00:00+00:00

A flaw was found in the Linux kernel's x86/fpu module, which revolves around an issue with relying on user space for critical information regarding the xsave buffer. In the affected scenario, the expected size of the user space buffer is derived from user-controlled data, specifically, fx_sw->xstate_size. By manipulating this value, an attacker could construct a malicious sigreturn frame where the indicated size is smaller than required by valid bits in fx_sw->xfeatures. Furthermore, the attacker could unmap portions of the fpu buffer in the user space, rendering them inaccessible to xrstor.

This manipulation leads to a situation where xrstor repeatedly attempts to restore and access an unmapped area, causing a fault. However, the fault_in_readable function erroneously succeeds because the accessed region, buf + fx_sw->xstate_size, remains within the mapped area. Consequently, the system enters a perpetual loop as xrstor continually retries the operation.

Statement: This vulnerability, while technically significant due to its potential for exploitation, is classified as Low severity for several reasons. First, successful exploitation requires a precise set of conditions, including the ability to manipulate the fx_sw->xstate_size parameter, which may not always be feasible. Additionally, the exploit's impact is limited to a specific subsystem (x86/fpu) within the Linux kernel, thereby reducing its overall scope and potential for widespread harm. Moreover, the loop resulting from the fault condition does not result in a system compromise or escalation of privileges but rather leads to a denial-of-service situation, which can be mitigated through a system reboot or other administrative actions.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.150, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8bd3eee7720c14b59a206bd05b98d7586bccf99a
CVE-2024-26605: kernel: PCI/ASPM: Fix deadlock when enabling ASPM
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-24T00:00:00+00:00

A flaw was found in the Linux kernel, where a deadlock scenario was triggered when enabling Active State Power Management (ASPM) during the probe of Qualcomm PCIe controllers. This deadlock was identified by lockdep and stemmed from a recursive locking scenario. This issue occurred when a task attempted to acquire a lock already held by another task, leading to a deadlock situation. The deadlock could be reproduced on certain machines, such as the Lenovo ThinkPad X13s, by intentionally delaying operations to increase the race window during asynchronous probes, allowing another thread to take a write lock.

Statement: The identified vulnerability, while significant in terms of potential system instability, is categorized as Low severity due to several factors. First, the deadlock scenario is triggered under specific conditions during the probe of Qualcomm PCIe controllers, limiting its impact to a subset of hardware configurations. Additionally, the deadlock can be reliably reproduced only with deliberate manipulation, such as introducing delays to increase the race window during asynchronous probe operations. Furthermore, the issue does not pose a direct security threat or enable unauthorized access or privilege escalation. Last, the timely identification and resolution of the problem by introducing a targeted fix demonstrate the robustness of the Linux kernel development process in addressing such issues efficiently.

Affected upstream versions: 6.1.72 < 6.1.88, 6.6.11 < 6.6.29, 5.15.147 < 5.16, 6.7
Fixed upstream versions: 0, 5.16, 6.1.88, 6.6.29, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f7908a016c092cfdaa16d785fa5099d867bc1a3
CVE-2024-26610: kernel: wifi: iwlwifi: fix a memory corruption
Component: kernel
Severity: Moderate
CWE: CWE-680 (Integer Overflow to Buffer Overflow)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-02-29T00:00:00+00:00

A memory corruption flaw was found in the Linux kernel Intel Wireless WiFi Next Gen AGN module. This issue could allow a local user to crash the system.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 05dd9facfb9a1e056752c0901c6e86416037d15a
CVE-2024-26612: kernel: netfs, fscache: Prevent Oops in fscache_put_cache()
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-02-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfs, fscache: Prevent Oops in fscache_put_cache()

This function dereferences "cache" and then checks if it's
IS_ERR_OR_NULL().  Check first, then dereference.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82a9bc343ba019665d3ddc1d9a180bf0e0390cf3
CVE-2024-26615: kernel: net/smc: fix illegal rmb_desc access in SMC-D connection dump
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-02-29T00:00:00+00:00

A flaw was found in the Linux kernel in which functions providing information about SMC-D connections caused a NULL pointer dereference. This flaw allows an attacker with permission to read this information to cause a denial of service.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 27aea64838914c6122db5b8bd4bed865c9736f22
CVE-2024-26618: hw: arm64/sme: Always exit sme_alloc() early with existing storage
Component: hw
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-02-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64/sme: Always exit sme_alloc() early with existing storage

When sme_alloc() is called with existing storage and we are not flushing we
will always allocate new storage, both leaking the existing storage and
corrupting the state. Fix this by separating the checks for flushing and
for existing storage as we do for SVE.

Callers that reallocate (eg, due to changing the vector length) should
call sme_free() themselves.


Affected upstream versions: 6.1.47 < 6.1.140, 6.4.12 < 6.5, 6.5
Fixed upstream versions: 0, 6.1.140, 6.5, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f6421555dbd7cb3d4d70b69f33f998aaeca1e3b5
CVE-2024-26630: kernel: mm: cachestat: fix folio read-after-free in cache walk
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-03-13T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: cachestat: fix folio read-after-free in cache walk

In cachestat, we access the folio from the page cache's xarray to compute
its page offset, and check for its dirty and writeback flags.  However, we
do not hold a reference to the folio before performing these actions,
which means the folio can concurrently be released and reused as another
folio/page/slab.

Get around this altogether by just using xarray's existing machinery for
the folio page offsets and dirty/writeback states.

This changes behavior for tmpfs files to now always report zeroes in their
dirty and writeback counters.  This is okay as tmpfs doesn't follow
conventional writeback cache behavior: its pages get "cleaned" during
swapout, after which they're no longer resident etc.


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba60fdf75e89ea762bb617be578dc47f27655117
CVE-2024-26631: kernel: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
Component: kernel
Severity: Low
CWE: CWE-414 (Missing Lock Check)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-03-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work

idev->mc_ifc_count can be written over without proper locking.

Originally found by syzbot [1], fix this issue by encapsulating calls
to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with
mutex_lock() and mutex_unlock() accordingly as these functions
should only be called with mc_lock per their declarations.

[1]
BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work

write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:
 mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]
 ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725
 addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949
 addrconf_notify+0x310/0x980
 notifier_call_chain kernel/notifier.c:93 [inline]
 raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
 __dev_notify_flags+0x205/0x3d0
 dev_change_flags+0xab/0xd0 net/core/dev.c:8685
 do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916
 rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3717 [inline]
 rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754
 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558
 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576
 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
 netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368
 netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910
 ...

write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:
 mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653
 process_one_work kernel/workqueue.c:2627 [inline]
 process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700
 worker_thread+0x525/0x730 kernel/workqueue.c:2781
 ...


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 75ddcd741d2a30696f5893bc71a9d28f4ef22311
CVE-2024-26638: kernel: nbd: always initialize struct msghdr completely
Component: kernel
Severity: Low
CWE: CWE-456 (Missing Initialization of a Variable)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nbd: always initialize struct msghdr completely

syzbot complains that msg->msg_get_inq value can be uninitialized [1]

struct msghdr got many new fields recently, we should always make
sure their values is zero by default.

[1]
 BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571
  inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879
  sock_recvmsg_nosec net/socket.c:1044 [inline]
  sock_recvmsg+0x12b/0x1e0 net/socket.c:1066
  __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863
  process_one_work kernel/workqueue.c:2627 [inline]
  process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700
  worker_thread+0xf45/0x1490 kernel/workqueue.c:2781
  kthread+0x3ed/0x540 kernel/kthread.c:388
  ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147
  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242

Local variable msg created at:
  __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513
  nbd_read_reply drivers/block/nbd.c:732 [inline]
  recv_work+0x262/0x3100 drivers/block/nbd.c:863

CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: nbd5-recv recv_work


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d9c54763e5cdbbd3f81868597fe8aca3c96e6387
CVE-2024-26640: kernel: tcp: add sanity checks to rx zerocopy
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

A vulnerability was found in Linux Kernel where rx zerocopy feature allowed mapping of pages owned by the filesystem, leading to potential system panic which is caused by the lack of sanity checks to rx zerocopy. A local authenticated attacker could exploit this vulnerability to cause a denial of service.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f48bf9a83b1666d934247cb58a9887d7b3127b6f
CVE-2024-26641: kernel: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()

The Linux kernel CVE team has assigned CVE-2024-26641 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/20240318102117.2839904-12-lee@kernel.org/T


Affected upstream versions: 4.7
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a9bc32879a08f23cdb80a48c738017e39aea1080
CVE-2024-26642: kernel: netfilter: nf_tables: disallow anonymous set with timeout flag
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-21T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: disallow anonymous set with timeout flag

Anonymous sets are never used with timeout from userspace, reject this.
Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e4988d8415bd0294d6f9f4a1e7095f8b50a97ca9
CVE-2024-26643: kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-21T00:00:00+00:00

A vulnerability was found in the netfilter/nf_tables subsystem of Linux Kernel, where a race condition caused where the garbage collector could prematurely collect elements from anonymous sets with timeouts while they were being released.


Affected upstream versions: 5.4.262 < 5.4.274, 5.10.198 < 5.10.215, 5.15.134 < 5.15.154, 6.1.56 < 6.1.84, 6.4.11 < 6.5, 6.5
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.5, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d75a589bb92af1abf3b779cfcd1977ca11b27033
CVE-2024-26645: kernel: tracing: Ensure visibility when inserting an element into tracing_map
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tracing: Ensure visibility when inserting an element into tracing_map

The Linux kernel CVE team has assigned CVE-2024-26645 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/20240326151722.1258576-4-lee@kernel.org/T


Affected upstream versions: 4.17
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5022b331c041e8c54b9a6a3251579bd1e8c0fc0b
CVE-2024-26646: kernel: thermal: intel: hfi: Add syscore callbacks for system-wide PM
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-26T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

thermal: intel: hfi: Add syscore callbacks for system-wide PM

The kernel allocates a memory buffer and provides its location to the
hardware, which uses it to update the HFI table. This allocation occurs
during boot and remains constant throughout runtime.

When resuming from hibernation, the restore kernel allocates a second
memory buffer and reprograms the HFI hardware with the new location as
part of a normal boot. The location of the second memory buffer may
differ from the one allocated by the image kernel.

When the restore kernel transfers control to the image kernel, its HFI
buffer becomes invalid, potentially leading to memory corruption if the
hardware writes to it (the hardware continues to use the buffer from the
restore kernel).

It is also possible that the hardware "forgets" the address of the memory
buffer when resuming from "deep" suspend. Memory corruption may also occur
in such a scenario.

To prevent the described memory corruption, disable HFI when preparing to
suspend or hibernate. Enable it when resuming.

Add syscore callbacks to handle the package of the boot CPU (packages of
non-boot CPUs are handled via CPU offline). Syscore ops always run on the
boot CPU. Additionally, HFI only needs to be disabled during "deep" suspend
and hibernation. Syscore ops only run in these cases.

[ rjw: Comment adjustment, subject and changelog edits ]


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 28f010dc50df0f7987c04112114fcfa7e0803566
CVE-2024-26649: kernel: null pointer when load rlc firmware
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-26T00:00:00+00:00

A vulnerability was found in the drm/amdgpu driver of Linux Kernel, causing null pointer dereference when attempting to load RLC (Run-Length Coding) firmware. This issue arises if the firmware has an incorrect header size, causing premature release of the firmware pointer in amdgpu_ucode_request(), subsequently attempts to use the nullified pointer result in errors.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8b5bacce2d13dbe648f0bfd3f738ecce8db4978c
CVE-2024-26656: kernel: drm/amdgpu: use-after-free vulnerability
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A failure flaw was found in the Linux kernel’s AMDGPU driver in how a user sends ioctl with an invalid address and size when using the AMD GPU. This flaw allows a local user to crash the system.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.1.132, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2e13f88e01ae7e28a7e831bf5c2409c4748e0a60
CVE-2024-26659: kernel: xhci: handle isoc Babble and Buffer Overrun events properly
Component: kernel
Severity: Low
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A flaw was found in the Linux kernel related to the Extensible Host Controller Interface (xHCI) subsystem, specifically how it handles certain events. The issue arises when the xHCI driver improperly handles isochronous (isoc) Babble and Buffer Overrun events. The vulnerability occurs because the xHCI driver incorrectly assumes that the xHC (host controller) has released its ownership of a multi-TRB (Transfer Request Block) TD (Transfer Descriptor) after reporting an error on an early TRB. This assumption leads to the premature release of the TD, allowing remaining TRBs to be freed or overwritten, which can cause system instability or crashes.

Statement: Red Hat Product Security has classified the severity of this vulnerability as Moderate due to the specific prerequisites required for exploitation. Successful exploitation generally necessitates local access to the system with elevated permissions to interact with the Extensible Host Controller Interface (xHCI) driver, which effectively translates to root-level access.

Affected upstream versions: 2.6.36
Fixed upstream versions: 0, 5.10.213, 5.15.152, 6.1.82, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 696e4112e5c1ee61996198f0ebb6ca3fab55166e
CVE-2024-26660: kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN301
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A vulnerability was found in the DRM/AMD/Display module of the Linux Kernel. An out-of-bounds access exists in the 'stream_enc_regs' array within DCN301, while accessing the array with 'eng_id,’ could lead to an out-of-bounds access beyond its four-element size, which can cause a system crash.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.149, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 42442f74314d41ddc68227047036fa3e78940054
CVE-2024-26661: kernel: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel in dcn21_set_pipe(). This issue may lead to a crash.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f3c237a706580326d3b7a1b97697e5031ca4667