huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-26919: kernel: usb: ulpi: Fix debugfs directory leak
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: ulpi: Fix debugfs directory leak

The ULPI per-device debugfs root is named after the ulpi device's
parent, but ulpi_unregister_interface tries to remove a debugfs
directory named after the ulpi device itself. This results in the
directory sticking around and preventing subsequent (deferred) probes
from succeeding. Change the directory name to match the ulpi device.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d31b886ed6a5095214062ee4fb55037eb930adb6
CVE-2024-26920: kernel: tracing/trigger: Fix to return error if failed to alloc snapshot
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tracing/trigger: Fix to return error if failed to alloc snapshot

Fix register_snapshot_trigger() to return error code if it failed to
allocate a snapshot instead of 0 (success). Unless that, it will register
snapshot trigger without an error.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 4.4.220 < 4.5, 4.9.220 < 4.10, 4.14.177 < 4.15, 4.19.117 < 4.20, 5.4.34 < 5.5, 5.5.19 < 5.6, 5.6.6 < 5.7, 5.7
Fixed upstream versions: 0, 4.10, 4.15, 4.20, 4.5, 5.5, 5.6, 5.7, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 36be97e9eb535fe3008a5cb040b1e56f29f2e398
CVE-2024-26921: kernel: inet: inet_defrag: prevent sk release while still in use
Component: kernel
Severity: Low
CWE: CWE-124 (Buffer Underwrite ('Buffer Underflow'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

inet: inet_defrag: prevent sk release while still in use

ip_local_out() and other functions can pass skb->sk as function argument.

If the skb is a fragment and reassembly happens before such function call
returns, the sk must not be released.

This affects skb fragments reassembled via netfilter or similar
modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline.

Eric Dumazet made an initial analysis of this bug.  Quoting Eric:
  Calling ip_defrag() in output path is also implying skb_orphan(),
  which is buggy because output path relies on sk not disappearing.

  A relevant old patch about the issue was :
  8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()")

  [..]

  net/ipv4/ip_output.c depends on skb->sk being set, and probably to an
  inet socket, not an arbitrary one.

  If we orphan the packet in ipvlan, then downstream things like FQ
  packet scheduler will not work properly.

  We need to change ip_defrag() to only use skb_orphan() when really
  needed, ie whenever frag_list is going to be used.

Eric suggested to stash sk in fragment queue and made an initial patch.
However there is a problem with this:

If skb is refragmented again right after, ip_do_fragment() will copy
head->sk to the new fragments, and sets up destructor to sock_wfree.
IOW, we have no choice but to fix up sk_wmem accouting to reflect the
fully reassembled skb, else wmem will underflow.

This change moves the orphan down into the core, to last possible moment.
As ip_defrag_offset is aliased with sk_buff->sk member, we must move the
offset into the FRAG_CB, else skb->sk gets clobbered.

This allows to delay the orphaning long enough to learn if the skb has
to be queued or if the skb is completing the reasm queue.

In the former case, things work as before, skb is orphaned.  This is
safe because skb gets queued/stolen and won't continue past reasm engine.

In the latter case, we will steal the skb->sk reference, reattach it to
the head skb, and fix up wmem accouting when inet_frag inflates truesize.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 5.10.227, 5.15.168, 5.4.285, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1b6de5e6575b56502665c65cf93b0ae6aa0f51ab
CVE-2024-26922: kernel: drm/amdgpu: validate the parameters of bo mapping operations more clearly
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate the parameters of bo mapping operations more clearly

Verify the parameters of
amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.15.157, 5.4.275, 6.1.88, 6.6.29, 6.8.8, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d4da6b084f1c5625937d49bb6722c5b4aef11b8d
CVE-2024-26923: kernel: af_unix: Fix garbage collector racing against connect()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-04-24T00:00:00+00:00

A flaw was found in the Linux kernel, where the management of inter-process communication uses AF_UNIX sockets. The issue arises from a race condition where a partially initialized socket with specific permissions carrying SCM_RIGHTS is improperly handled during garbage collection. This situation leads to an incorrect count of active sockets, potentially causing resources to remain unaccounted for and never released.

Statement: Red Hat rates the security impact of this vulnerability as Moderate due to the worst-case scenario resulting in a resource consumption attack. Considering this is a timing attack and is hard to replicate outside of very controlled environments, the vulnerability is not rated higher.

Affected upstream versions: 2.6.23
Fixed upstream versions: 0, 4.19.314, 5.10.216, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a36ae0ec2353015f0f6762e59f4c2dbc0c906423
CVE-2024-26924: kernel: netfilter: nft_set_pipapo: do not free live element
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: do not free live element

The Linux kernel CVE team has assigned CVE-2024-26924 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024042420-CVE-2024-26924-4d1e@gregkh/T


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.216, 5.15.157, 6.1.88, 6.6.29, 6.8.8, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e3b887a9c11caf8357a821260e095f2a694a34f2
CVE-2024-26925: kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-04-24T00:00:00+00:00

A flaw was found in the Linux kernel’s Netfilter nf_tables module. The issue arises from improper mutex handling during the garbage collection (GC) process. The problem occurs between the critical functions nft_gc_seq_begin() and nft_gc_seq_end(), where a mutex lock is incorrectly released too early, leading to potential race conditions. This issue could allow an asynchronous GC worker to collect expired objects and improperly obtain the released commit lock within the same sequence, potentially causing system instability or data corruption.
This vulnerability can be exploited by attackers with local access, leading to unexpected behavior or even privilege escalation under certain conditions. The kernel patch for this issue moves the mutex release to the correct point, ensuring the sequence completes safely before releasing any locks.


Affected upstream versions: 5.4.262 < 5.4.274, 5.10.198 < 5.10.215, 5.15.134 < 5.15.155, 6.1.56 < 6.1.86, 4.19.316 < 4.20, 6.4.13 < 6.5, 6.5
Fixed upstream versions: 0, 4.20, 5.10.215, 5.15.155, 5.4.274, 6.1.86, 6.5, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 61ac7284346c32f9a8c8ceac56102f7914060428
CVE-2024-26927: kernel: ASoC: SOF: Add some bounds checking to firmware data
Component: kernel
Severity: Low
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-28T00:00:00+00:00

A flaw was found in the Linux kernel. The following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d133d67e7e724102d1e53009c4f88afaaf3e167c
CVE-2024-26928: kernel: smb: client: potential use-after-free in cifs_debug_files_proc_show()
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-04-28T00:00:00+00:00

A flaw was found in the Linux kernel. The following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show().


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.237, 5.15.180, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8f8718afd446cd4ea3b62bacc3eec09f8aae85ee
CVE-2024-26930: kernel: scsi: qla2xxx: Fix double free of the ha-&gt;vp_map pointer
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux kernel. A potential double-free in the pointer ha->vp_map exists in the Linux kernel in drivers/scsi/qla2xxx/qla_os.c.

Statement: Red Hat has protection mechanisms in place against buffer overflow. This vulnerability may result in compromised availability.

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f14cee7a882cb79528f17a2335f53e9fd1848467
CVE-2024-26931: kernel: scsi: qla2xxx: Fix command flush on cable pull
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the qla2xxx module in the Linux kernel. A NULL pointer dereference can be triggered when the system is under memory stress and the driver cannot allocate memory to handle the error recovery of cable pull, causing a system crash and a denial of service.

Statement: This vulnerability can only be triggered in out-of-memory conditions. For this reason, it was rated with a Moderate severity.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b73377124f56d2fec154737c2f8d2e839c237d5a
CVE-2024-26933: kernel: USB: core: Fix deadlock in port &#34;disable&#34; sysfs attribute
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix deadlock in port &#34;disable&#34; sysfs attribute

The Linux kernel CVE team has assigned CVE-2024-26933 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26933-c18d@gregkh/T


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9dac54f08198147f5ec0ec52fcf1bc8ac899ac05
CVE-2024-26934: kernel: USB: core: Fix deadlock in usb_deauthorize_interface()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix deadlock in usb_deauthorize_interface()

The Linux kernel CVE team has assigned CVE-2024-26934 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26934-e2fc@gregkh/T


Affected upstream versions: 4.4
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8cbdd324b41528994027128207fae8100dff094f
CVE-2024-26935: kernel: scsi: core: Fix unremoved procfs host directory regression
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix unremoved procfs host directory regression

The Linux kernel CVE team has assigned CVE-2024-26935 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26935-8b4e@gregkh/T


Affected upstream versions: 5.4.238 < 5.4.274, 5.10.176 < 5.10.215, 5.15.104 < 5.15.154, 6.1.21 < 6.1.84, 6.2.8 < 6.3, 6.3
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.3, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0053f15d50d50c9312d8ab9c11e2e405812dfcac
CVE-2024-26937: kernel: drm/i915/gt: Reset queue_priority_hint on parking
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the i915 module in the Linux kernel. Under some conditions, an assertion failure can be triggered and cause a denial of service.

Statement: The i915 module in the Linux kernel as shipped in Red Hat Enterprise Linux 8 is not affected by this vulnerability because the vulnerable code was introduced in a newer version of the Linux kernel.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 67944e6db656bf1e986aa2a359f866f851091f8a
CVE-2024-26938: kernel: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()

The Linux kernel CVE team has assigned CVE-2024-26938 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26938-b3f9@gregkh/T


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a891add409e3bc381f4f68c2ce9d953f1865cb1f
CVE-2024-26939: kernel: drm/i915/vma: Fix UAF on destroy against retire race
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A use-after-free flaw was found in drivers/gpu/drm/i915/i915_vma.c in the Linux kernel that may lead to a crash.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.88, 6.6.29, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 704edc9252f4988ae1ad7dafa23d0db8d90d7190
CVE-2024-26940: kernel: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the vmwgfx module in the Linux kernel. Trying to read the /sys/kernel/debug/dri/0/mob_ttm file when the ttm_resource_manager is not allocated will cause a crash, resulting in a denial of service.

Statement: This issue can allow a local attacker to cause a system crash, resulting in a denial of service.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 016119154981d81c9e8f2ea3f56b9e2b4ea14500
CVE-2024-26946: kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

An unsafe read function was found in arch/x86/kernel/kprobes/core.c in the Linux kernel .

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6417684315087904fffe8966d27ca74398c57dd6
CVE-2024-26947: kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
Component: kernel
Severity: Moderate
CWE: CWE-439 (Behavioral Change in New Version or Environment)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the Linux kernel’s ARM memory management functionality, where certain memory layouts cause a kernel panic. This flaw allows an attacker who can specify or alter memory layouts to cause a denial of service.


Affected upstream versions: 5.4.167 < 5.5, 5.10.87 < 5.11, 5.14
Fixed upstream versions: 0, 5.11, 5.5, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0c027c2bad7f5111c51a358b5d392e1a695dabff
CVE-2024-26950: kernel: wireguard: netlink: access device through ctx instead of peer
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being
dereferenced. It's actually easier and faster performance-wise to
instead get the device from ctx->wg. This semantically makes more sense
too, since ctx->wg->peer_allowedips.seq is compared with
ctx->allowedips_seq, basing them both in ctx. This also acts as a
defence in depth provision against freed peers.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 493aa6bdcffd90a4f82aa614fe4f4db0641b4068
CVE-2024-26951: kernel: wireguard: netlink: check for dangling peer via is_dead instead of empty list
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: check for dangling peer via is_dead instead of empty list

If all peers are removed via wg_peer_remove_all(), rather than setting
peer_list to empty, the peer is added to a temporary list with a head on
the stack of wg_peer_remove_all(). If a netlink dump is resumed and the
cursored peer is one that has been removed via wg_peer_remove_all(), it
will iterate from that peer and then attempt to dump freed peers.

Fix this by instead checking peer->is_dead, which was explictly created
for this purpose. Also move up the device_update_lock lockdep assertion,
since reading is_dead relies on that.

It can be reproduced by a small script like:

    echo "Setting config..."
    ip link add dev wg0 type wireguard
    wg setconf wg0 /big-config
    (
            while true; do
                    echo "Showing config..."
                    wg showconf wg0 > /dev/null
            done
    ) &
    sleep 4
    wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n")

Resulting in:

    BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
    Read of size 8 at addr ffff88811956ec70 by task wg/59
    CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
    Call Trace:
     <TASK>
     dump_stack_lvl+0x47/0x70
     print_address_description.constprop.0+0x2c/0x380
     print_report+0xab/0x250
     kasan_report+0xba/0xf0
     __lock_acquire+0x182a/0x1b20
     lock_acquire+0x191/0x4b0
     down_read+0x80/0x440
     get_peer+0x140/0xcb0
     wg_get_device_dump+0x471/0x1130


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f52be46e3e6ecefc2539119784324f0cbc09620a
CVE-2024-26958: kernel: nfs: fix UAF in direct writes
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A use-after-free flaw was found in fs/nfs/direct.c in the Linux kernel. This may lead to a crash.


Affected upstream versions: 4.5
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.297, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6cd3f13aaa62970b5169d990e936b2e96943bc6a
CVE-2024-26960: kernel: mm: swap: fix race between free_swap_and_cache() and swapoff()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: swap: fix race between free_swap_and_cache() and swapoff()

The Linux kernel CVE team has assigned CVE-2024-26960 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26960-ad6b@gregkh/T


Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d85c11c97ecf92d47a4b29e3faca714dc1f18d0d
CVE-2024-26961: kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the Linux Kernel where resources are improperly managed in IEEE 802.15.4 networking, leading to a potential use-after-free issue, resulting in a denial of service.


Affected upstream versions: 3.16
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 068ab2759bc0b4daf0b964de61b2731449c86531