huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-40922: kernel: io_uring/rsrc: don&#39;t lock while !TASK_RUNNING
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/rsrc: don't lock while !TASK_RUNNING

There is a report of io_rsrc_ref_quiesce() locking a mutex while not
TASK_RUNNING, which is due to forgetting restoring the state back after
io_run_task_work_sig() and attempts to break out of the waiting loop.

do not call blocking ops when !TASK_RUNNING; state=1 set at
[<ffffffff815d2494>] prepare_to_wait+0xa4/0x380
kernel/sched/wait.c:237
WARNING: CPU: 2 PID: 397056 at kernel/sched/core.c:10099
__might_sleep+0x114/0x160 kernel/sched/core.c:10099
RIP: 0010:__might_sleep+0x114/0x160 kernel/sched/core.c:10099
Call Trace:
 <TASK>
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xb4/0x940 kernel/locking/mutex.c:752
 io_rsrc_ref_quiesce+0x590/0x940 io_uring/rsrc.c:253
 io_sqe_buffers_unregister+0xa2/0x340 io_uring/rsrc.c:799
 __io_uring_register io_uring/register.c:424 [inline]
 __do_sys_io_uring_register+0x5b9/0x2400 io_uring/register.c:613
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd8/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0c9df3df0c888d9ec8d11a68474a4aa04d371cff
CVE-2024-40923: kernel: vmxnet3: disable rx data ring on dma allocation failure
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's vmxnet3 driver in the vmxnet3_rq_create() function, where this issue occurs when memory allocation fails for the RX data ring, leading to an improper reference size that may cause the hypervisor to access invalid memory during packet reception, which can result in kernel crashes.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9ee14af24e67ef170108db547f7d1f701b3f2bc5
CVE-2024-40924: kernel: drm/i915/dpt: Make DPT object unshrinkable
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/dpt: Make DPT object unshrinkable

In some scenarios, the DPT object gets shrunk but
the actual framebuffer did not and thus its still
there on the DPT's vm->bound_list. Then it tries to
rewrite the PTEs via a stale CPU mapping. This causes panic.

[vsyrjala: Add TODO comment]
(cherry picked from commit 51064d471c53dcc8eddd2333c3f1c1d9131ba36c)


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 327280149066f0e5f2e50356b5823f76dabfe86e
CVE-2024-40925: kernel: block: fix request.queuelist usage in flush
Component: kernel
Severity: Moderate
CWE: CWE-665 (Improper Initialization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's block subsystem, where the issue arises when the request queue list is not properly initialized for the first request in the PREFLUSH/POSTFLUSH sequences, leading to potential kernel crashes due to improper list manipulation.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe1e395563ccb051e9dbd8fa99859f5caaad2e71
CVE-2024-40927: kernel: xhci: Handle TD clearing for multiple streams case
Component: kernel
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's xHCI driver, related to the handling of TD when multiple streams are active, where the issue occurs when the endpoint is stopped, causing TD to remain uncleared, which can lead to system crashes and memory corruption due to stale TD references.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 5.15.162, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 26460c1afa311524f588e288a4941432f0de6228
CVE-2024-40928: kernel: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ethtool implementation in the ethtool_get_phy_stats_ethtool() function, where the issue arises when a null function pointer is dereferenced if the 'ops->get_ethtool_phy_stats' is NULL, potentially leading to a crash.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 25504f7fe60058b2a9553a9e424fb7dd9683843e
CVE-2024-40929: kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: check n_ssids before accessing the ssids

In some versions of cfg80211, the ssids poinet might be a valid one even
though n_ssids is 0. Accessing the pointer in this case will cuase an
out-of-bound access. Fix this by checking n_ssids first.


Affected upstream versions: 4.17
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3c4771091ea8016c8601399078916f722dd8833b
CVE-2024-40930: kernel: wifi: cfg80211: validate HE operation element parsing
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's cfg80211 component, related to the parsing of HE operation elements, where the issue occurs when the length of the HE operation element is not validated before parsing, potentially leading to buffer overflows or undefined behavior.


Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.10, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f15e3e13e14cc5ae8f950c16efe706add18ac8e2
CVE-2024-40931: kernel: mptcp: ensure snd_una is properly initialized on connect
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's match component in the initialization of the snd_una variable while establishing a connection. The issue arises when retransmission occurs after a fallback, leaving the snd_una sequence number uninitialized, leading to unpredictable behavior and potential denial of service.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 208cd22ef5e57f82d38ec11c1a1703f9401d6dde
CVE-2024-40936: kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region()
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Fix memregion leaks in devm_cxl_add_region()

Move the mode verification to __create_region() before allocating the
memregion to avoid the memregion leaks.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d8316838aa0686da63a8be4194b7a17b0103ae4a
CVE-2024-40939: kernel: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: iosm: Fix tainted pointer delete is case of region creation fail

In case of region creation fail in ipc_devlink_create_region(), previously
created regions delete process starts from tainted pointer which actually
holds error code value.
Fix this bug by decreasing region index before delete.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe394d59cdae81389dbf995e87c83c1acd120597
CVE-2024-40940: kernel: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Fix tainted pointer delete is case of flow rules creation fail

In case of flow rule creation fail in mlx5_lag_create_port_sel_table(),
instead of previously created rules, the tainted pointer is deleted
deveral times.
Fix this bug by using correct flow rules pointers.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 531eab2da27dd42d68dfb841d82e987f4a6738b8
CVE-2024-40941: kernel: wifi: iwlwifi: mvm: don&#39;t read past the mfuart notifcation
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: don't read past the mfuart notifcation

In case the firmware sends a notification that claims it has more data
than it has, we will read past that was allocated for the notification.
Remove the print of the buffer, we won't see it by default. If needed,
we can see the content with tracing.

This was reported by KFENCE.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.95, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 15b37c6fab9d5e40ac399fa1c725118588ed649c
CVE-2024-40945: kernel: iommu: Return right value in iommu_sva_bind_device()
Component: kernel
Severity: Low
CWE: CWE-393 (Return of Wrong Status Code)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu: Return right value in iommu_sva_bind_device()

iommu_sva_bind_device() should return either a sva bond handle or an
ERR_PTR value in error cases. Existing drivers (idxd and uacce) only
check the return value with IS_ERR(). This could potentially lead to
a kernel NULL pointer dereference issue if the function returns NULL
instead of an error pointer.

In reality, this doesn't cause any problems because iommu_sva_bind_device()
only returns NULL when the kernel is not configured with CONFIG_IOMMU_SVA.
In this case, iommu_dev_enable_feature(dev, IOMMU_DEV_FEAT_SVA) will
return an error, and the device drivers won't call iommu_sva_bind_device()
at all.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.129, 6.10, 6.6.35, 6.9.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 700f564758882db7c039dfba9443fe762561a3f8
CVE-2024-40948: kernel: mm/page_table_check: fix crash on ZONE_DEVICE
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's mm/page_table_check component, specifically related to ZONE_DEVICE pages. When page-table-check is enabled, attempting to map DAX memory can lead to a kernel crash due to invalid checks on these pages, which do not allocate page_ext.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 51897f99351fff7b57f4f141940fa93b4e90fd2b
CVE-2024-40954: kernel: net: do not leave a dangling sk pointer, when socket creation fails
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's networking component in the __sock_release() function, where a dangling pointer can occur when socket creation fails. This happens when a reference to the socket is not cleared, leading to a use-after-free condition.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 78e4aa528a7b1204219d808310524344f627d069
CVE-2024-40956: kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's DMA engine component in the irq_process_work_list() function. A possible use-after-free condition can occur during list iteration, which is because a descriptor may be freed while another thread is reusing it, potentially leading to access to freed memory.

Statement: This vulnerability is rated as a Moderate severity because, although it allows use-after-free during list processing with a low attack complexity and local access, exploitation remains limited to localized impact. The risk of descriptor reuse could affect stability but does not broadly compromise system security.

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1b08bf5a17c66ab7dbb628df5344da53c8e7ab33
CVE-2024-40957: kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's segment routing (seg6) component in the input_action_end_dx4() and input_action_end_dx6() functions, where improper parameter passing to the NF_HOOK() can occur, which leads to a NULL pointer dereference when a NULL input device is provided, resulting in a kernel crash.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: af90e3d73dc45778767b2fb6e7edd57ebe34380d
CVE-2024-40958: kernel: netns: Make get_net_ns() handle zero refcount net
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's netns in the get_net_ns() function. This vulnerability occurs when a network namespace reference count is zero, leading to a use-after-free condition that can trigger a kernel panic.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3a6cd326ead7c8bb1f64486789a01974a9f1ad55
CVE-2024-40959: kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's IPv6 handling in the xfrm6_get_saddr() function, where the issue occurs when ip6_dst_idev() returns NULL, leading to a null pointer dereference and resulting in a general protection fault.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c71761292d4d002a8eccb57b86792c4e3b3eb3c7
CVE-2024-40960: kernel: ipv6: prevent possible NULL dereference in rt6_probe()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's IPv6 routing component, where a NULL dereference occurs in the rt6_probe() function. This issue happens when the function attempts to access a resource without confirming its availability, leading to potential crashes.


Affected upstream versions: 2.6.17
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f0cda984e4e634b221dbf9642b8ecc5b4806b41e
CVE-2024-40961: kernel: ipv6: prevent possible NULL deref in fib6_nh_init()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's IPv6 routing component, where a NULL dereference occurs in the fib6_nh_init() function, this issue arises when the function attempts to initialize a network interface without verifying its availability, potentially leading to a DoS.


Affected upstream versions: 4.17
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3200ffeec4d59aad5bc9ca75d2c1fae47c0aeade
CVE-2024-40965: kernel: i2c: lpi2c: Avoid calling clk_get_rate during transfer
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the lpi2c driver in the Linux kernel's i2c subsystem, where the clk_get_rate function is called during data transfers, which can lead to a deadlock situation when an audio codec attempts to access the i2c bus while holding the clock mutex, resulting in a denial of service.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 6.10, 6.6.64, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d038693e08adf9c162c6377800495e4f5a2df045
CVE-2024-40966: kernel: tty: add the option to have a tty reject a new ldisc
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's TTY subsystem, where the option to reject a new ldisc was improperly implemented, which can lead to a situation where the con_write() routine is called while holding a spinlock, potentially causing a sleep operation in an invalid context.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3c6332f3bb1578b5b10ac2561247b1d6272ae937
CVE-2024-40967: kernel: serial: imx: Introduce timeout when waiting on transmitter empty
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's imx serial driver, where the system could experience DoS while waiting for the transmitter to become empty, without a timeout mechanism, the code risks entering a deadlock situation if the USR2_TXDC signal is not set.


Affected upstream versions: 3.2.30 < 3.3, 3.4.12 < 3.5, 3.5.5 < 3.6, 3.6
Fixed upstream versions: 0, 3.3, 3.5, 3.6, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f2b9ab6d0b26f16cd38dd9fd91d51899635f7c7
CVE-2024-40972: kernel: ext4: do not create EA inode under buffer lock
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ext4 filesystem, where the system could create EA inodes while holding a buffer lock, this approach can lead to deadlocks, especially if the filesystem is corrupted.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 6.1.107, 6.10, 6.6.47, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0752e7fb549d90c33b4d4186f11cfd25a556d1dd
CVE-2024-40974: kernel: powerpc/pseries: Enforce hcall result buffer validity and size
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's powerpc/pseries architecture, where certain hypercall functions did not properly enforce the validity and size of result buffers provided by callers, lead to stack corruption if the buffer is too small, as the lack of compiler checks allows for potential runtime errors.


Affected upstream versions: 2.6.19
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: acf2b80c31c37acab040baa3cf5f19fbd5140b18