huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-26802: kernel: stmmac: Clear variable when destroying workqueue
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-04T00:00:00+00:00

A vulnerability was found in the `stmmac` ethernet driver of the Linux kernel, where a workqueue variable was not cleared after being destroyed. This issue could lead to kernel panics if the code later attempted to access or destroy the already-freed workqueue.

Statement: Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8e99556301172465c8fe33c7f78c39a3d4ce8462
CVE-2024-26803: kernel: net: veth: clear GRO when clearing XDP even when down
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: veth: clear GRO when clearing XDP even when down

The Linux kernel CVE team has assigned CVE-2024-26803 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040404-CVE-2024-26803-9985@gregkh/T


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f011c103e654d83dc85f057a7d1bd0960d02831c
CVE-2024-26804: kernel: net: ip_tunnel: prevent perpetual headroom growth
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-04T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s ip_tunnel functionality when a user uses the ip_tunnel infrastructure. This flaw allows a local user to crash the system.


Affected upstream versions: 2.6.33.2 < 2.6.34, 2.6.34
Fixed upstream versions: 0, 2.6.34, 5.10.212, 5.15.151, 5.4.271, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f81e94d2dcd2397137edcb8b85f4c5bed5d22383
CVE-2024-26808: kernel: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Public date: 2024-04-04T00:00:00+00:00

A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nft_chain_filter feature. This issue occurs when a NETDEV_UNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale reference could result in lingering issues with network device handling.

Statement: The vulnerability has been fixed by ensuring that network devices are correctly removed from the basechain when these events occur. It affects multiple Linux kernel versions and is rated as a medium-severity issue with a CVSS v3 base score of 5.5, indicating it could lead to a denial of service under certain conditions.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9489e214ea8f2a90345516016aa51f2db3a8cc2f
CVE-2024-26810: kernel: vfio/pci: Lock external INTx masking ops
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Lock external INTx masking ops

Mask operations through config space changes to DisINTx may race INTx
configuration changes via ioctl.  Create wrappers that add locking for
paths outside of the core interrupt code.

In particular, irq_type is updated holding igate, therefore testing
is_intx() requires holding igate.  For example clearing DisINTx from
config space can otherwise race changes of the interrupt configuration.

This aligns interfaces which may trigger the INTx eventfd into two
camps, one side serialized by igate and the other only enabled while
INTx is configured.  A subsequent patch introduces synchronization for
the latter flows.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1e71b6449d55179170efc8dee8664510bb813b42
CVE-2024-26812: kernel: vfio/pci: Create persistent INTx handler
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-05T00:00:00+00:00

An interrupt handling flaw was found in the Linux kernel’s PCI core device driver. This flaw allows a local user to potentially crash the system.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b18fa894d615c8527e15d96b76c7448800e13899
CVE-2024-26815: kernel: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-10T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check

The Linux kernel CVE team has assigned CVE-2024-26815 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024041006-CVE-2024-26815-7f4e@gregkh/T


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bd2474a45df7c11412c2587de3d4e43760531418
CVE-2024-26826: kernel: mptcp: fix data re-injection from stale subflow
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A flaw was found in the Linux kernel. A logical error in the Multipath TCP packet manager causes some packets intended for retransmission to be lost, resulting in a potential denial of service.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6f95120f898b40d13fd441225ef511307853c9c2
CVE-2024-26828: kernel: cifs: fix underflow in parse_server_interfaces()
Component: kernel
Severity: Low
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 6.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix underflow in parse_server_interfaces()

In this loop, we step through the buffer and after each item we check
if the size_left is greater than the minimum size we need.  However,
the problem is that "bytes_left" is type ssize_t while sizeof() is type
size_t.  That means that because of type promotion, the comparison is
done as an unsigned and if we have negative bytes left the loop
continues instead of ending.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7190353835b4a219abb70f90b06cdcae97f11512
CVE-2024-26830: kernel: i40e: Do not allow untrusted VF to remove administratively set MAC
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A flaw was found in Intel network adapters in the Linux kernel, where untrusted virtualized network interfaces can remove MAC addresses set by the system. This flaw allows an attacker with sufficient privileges to cause a denial of service.


Affected upstream versions: 3.14
Fixed upstream versions: 0, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1c981792e4ccbc134b468797acdd7781959e6893
CVE-2024-26835: kernel: netfilter: nf_tables: set dormant flag on hook register failure
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: set dormant flag on hook register failure

We need to set the dormant flag again if we fail to register
the hooks.

During memory pressure hook registration can fail and we end up
with a table marked as active but no registered hooks.

On table/base chain deletion, nf_tables will attempt to unregister
the hook again which yields a warn splat from the nftables core.


Affected upstream versions: 5.4.262 < 5.4.270, 5.10.202 < 5.10.211, 5.13
Fixed upstream versions: 0, 5.10.211, 5.15.150, 5.4.270, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a6411f3c48f991c19aaf9a24fce36865fbba28d7
CVE-2024-26837: kernel: net: bridge: switchdev: Skip MDB replays of deferred events on offload
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition in network bridge management could lead to a denial of service.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2d5b4b3376fa146a23917b8577064906d643925f
CVE-2024-26838: kernel: RDMA/irdma: Fix KASAN issue with tasklet
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix KASAN issue with tasklet

KASAN testing revealed the following issue assocated with freeing an IRQ.

[50006.466686] Call Trace:
[50006.466691]  <IRQ>
[50006.489538]  dump_stack+0x5c/0x80
[50006.493475]  print_address_description.constprop.6+0x1a/0x150
[50006.499872]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.505742]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.511644]  kasan_report.cold.11+0x7f/0x118
[50006.516572]  ? irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.522473]  irdma_sc_process_ceq+0x483/0x790 [irdma]
[50006.528232]  irdma_process_ceq+0xb2/0x400 [irdma]
[50006.533601]  ? irdma_hw_flush_wqes_callback+0x370/0x370 [irdma]
[50006.540298]  irdma_ceq_dpc+0x44/0x100 [irdma]
[50006.545306]  tasklet_action_common.isra.14+0x148/0x2c0
[50006.551096]  __do_softirq+0x1d0/0xaf8
[50006.555396]  irq_exit_rcu+0x219/0x260
[50006.559670]  irq_exit+0xa/0x20
[50006.563320]  smp_apic_timer_interrupt+0x1bf/0x690
[50006.568645]  apic_timer_interrupt+0xf/0x20
[50006.573341]  </IRQ>

The issue is that a tasklet could be pending on another core racing
the delete of the irq.

Fix by insuring any scheduled tasklet is killed after deleting the
irq.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 635d79aa477f9912e602feb5498bdd51fb9cb824
CVE-2024-26840: kernel: cachefiles: fix memory leak in cachefiles_add_cache()
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cachefiles: fix memory leak in cachefiles_add_cache()

The Linux kernel CVE team has assigned CVE-2024-26840 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024041715-CVE-2024-26840-057d@gregkh/T


Affected upstream versions: 2.6.30
Fixed upstream versions: 0, 4.19.309, 5.10.212, 5.15.151, 5.4.271, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cb5466783793e66272624cf71925ae1d1ba32083
CVE-2024-26843: kernel: efi: runtime: Fix potential overflow of soft-reserved region size
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A flaw was found in the Linux kernel. Due to an integer overflow, certain EFI-related memory reservations might receive a size other than expected, leading to a denial of service.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4fff3d735baea104017f2e3c245e27cdc79f2426
CVE-2024-26846: kernel: nvme-fc: do not wait in vain when unloading module
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: do not wait in vain when unloading module

The module exit path has race between deleting all controllers and
freeing 'left over IDs'. To prevent double free a synchronization
between nvme_delete_ctrl and ida_destroy has been added by the initial
commit.

There is some logic around trying to prevent from hanging forever in
wait_for_completion, though it does not handling all cases. E.g.
blktests is able to reproduce the situation where the module unload
hangs forever.

If we completely rely on the cleanup code executed from the
nvme_delete_ctrl path, all IDs will be freed eventually. This makes
calling ida_destroy unnecessary. We only have to ensure that all
nvme_delete_ctrl code has been executed before we leave
nvme_fc_exit_module. This is done by flushing the nvme_delete_wq
workqueue.

While at it, remove the unused nvme_fc_wq workqueue too.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.211, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4f2c95015ec2a1899161be6c0bdaecedd5a7bfb2
CVE-2024-26851: kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A vulnerability was found in the netfilter subsystem of the Linux kernel, specifically in the `nf_conntrack_h323` module. This issue involves inadequate protection for BMP length values, potentially leading to out-of-range conditions.


Affected upstream versions: 2.6.17
Fixed upstream versions: 0, 4.19.310, 5.10.213, 5.15.152, 5.4.272, 6.1.82, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 98db42191329c679f4ca52bec0b319689e1ad8cb
CVE-2024-26852: kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-04-17T00:00:00+00:00

A use-after-free flaw was found in ip6_route_mpath_notify() in the Linux kernel. This may lead to a crash.


Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.310, 5.10.213, 5.15.152, 5.4.272, 6.1.82, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 31ea5bcc7d4cd1423de6be327a2c034725704136
CVE-2024-26853: kernel: igc: avoid returning frame twice in XDP_REDIRECT
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A memory corruption flaw was found in the Linux kernel’s Intel(R) Ethernet Controller I225-LM/I225-V driver in how a user generates a high amount of packets. This flaw allows a local user to crash the system.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.82, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 63a3c1f3c9ecc654d851e7906d05334cd0c236e2
CVE-2024-26855: kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
Component: kernel
Severity: Moderate
CWE: CWE-690 (Unchecked Return Value to NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A vulnerability was found in the ice_bridge_setlink() function in the Linux kernel. A missing check to verify whether the nlmsg_find_attr() function returns NULL or not could lead to a NULL pointer dereference, system instability, or crashes.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.213, 5.15.152, 5.4.272, 6.1.82, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d9fefc51133107e59d192d773be86c1150cfeebb
CVE-2024-26858: kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

A vulnerability was found in the mlx5e_txwqe_complete() function in the Linux kernel. The CPU or compiler may reorder two of the functions: mlx5e_ptp_metadata_map_put() and mlx5e_ptpsq_track_metadata(), and a situation could arise where metadata tracking occurs before the metadata map is fully populated. This could lead to a NULL pointer dereference which can cause crashes.


Affected upstream versions: 6.6.3 < 6.6.22, 6.5.13 < 6.6, 6.7
Fixed upstream versions: 0, 6.6, 6.6.22, 6.7.10, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d1f71615dbb305f14f3b756cce015d70d8667549
CVE-2024-26859: kernel: net/bnx2x: Prevent access to a freed page in page_pool
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/bnx2x: Prevent access to a freed page in page_pool

Fix race condition leading to system crash during EEH error handling

During EEH error recovery, the bnx2x driver's transmit timeout logic
could cause a race condition when handling reset tasks. The
bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(),
which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload()
SGEs are freed using bnx2x_free_rx_sge_range(). However, this could
overlap with the EEH driver's attempt to reset the device using
bnx2x_io_slot_reset(), which also tries to free SGEs. This race
condition can result in system crashes due to accessing freed memory
locations in bnx2x_free_rx_sge()

799  static inline void bnx2x_free_rx_sge(struct bnx2x *bp,
800				struct bnx2x_fastpath *fp, u16 index)
801  {
802	struct sw_rx_page *sw_buf = &fp->rx_page_ring[index];
803     struct page *page = sw_buf->page;
....
where sw_buf was set to NULL after the call to dma_unmap_page()
by the preceding thread.

    EEH: Beginning: 'slot_reset'
    PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset()
    bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing...
    bnx2x 0011:01:00.0: enabling device (0140 -> 0142)
    bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload
    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
    BUG: Kernel NULL pointer dereference on read at 0x00000000
    Faulting instruction address: 0xc0080000025065fc
    Oops: Kernel access of bad area, sig: 11 [#1]
    .....
    Call Trace:
    [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable)
    [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0
    [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550
    [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60
    [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170
    [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0
    [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64

To solve this issue, we need to verify page pool allocations before
freeing.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7bcc090c81116c66936a7415f2c6b1483a4bcfd9
CVE-2024-26861: kernel: wireguard: receive: annotate data-race around receiving_counter.counter
Component: kernel
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wireguard: receive: annotate data-race around receiving_counter.counter

Syzkaller with KCSAN identified a data-race issue when accessing
keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE()
annotations to mark the data race as intentional.

    BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll

    write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0:
     counter_validate drivers/net/wireguard/receive.c:321 [inline]
     wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461
     __napi_poll+0x60/0x3b0 net/core/dev.c:6536
     napi_poll net/core/dev.c:6605 [inline]
     net_rx_action+0x32b/0x750 net/core/dev.c:6738
     __do_softirq+0xc4/0x279 kernel/softirq.c:553
     do_softirq+0x5e/0x90 kernel/softirq.c:454
     __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381
     __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
     _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
     spin_unlock_bh include/linux/spinlock.h:396 [inline]
     ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
     wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499
     process_one_work kernel/workqueue.c:2633 [inline]
     ...

    read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1:
     decrypt_packet drivers/net/wireguard/receive.c:252 [inline]
     wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501
     process_one_work kernel/workqueue.c:2633 [inline]
     process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706
     worker_thread+0x525/0x730 kernel/workqueue.c:2787
     ...


Affected upstream versions: 5.6.16 < 5.7, 5.7
Fixed upstream versions: 0, 5.10.214, 5.15.153, 5.7, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f87884e0dffd61b47e58bc6e1e2f6843c212b0cc