huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-40977: kernel: wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's mt76 driver for the mt7921s chip, where a potential deadlock could occur during chip recovery. This situation arises when the kernel worker reset_work holds a lock while waiting for the stat_worker thread, which is simultaneously waiting for the same lock to be released, which leads to hung tasks and may even result in device reboots.


Affected upstream versions: 4.16
Fixed upstream versions: 0, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b81faa05b0b9feb3ae2d69be1d21f0d126ecb08
CVE-2024-40978: kernel: scsi: qedi: Fix crash while reading debugfs attribute
Component: kernel
Severity: Low
CWE: CWE-822 (Untrusted Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qedi: Fix crash while reading debugfs attribute

The qedi_dbg_do_not_recover_cmd_read() function invokes sprintf() directly
on a __user pointer, which results into the crash.

To fix this issue, use a small local stack buffer for sprintf() and then
call simple_read_from_buffer(), which in turns make the copy_to_user()
call.

BUG: unable to handle page fault for address: 00007f4801111000
PGD 8000000864df6067 P4D 8000000864df6067 PUD 864df7067 PMD 846028067 PTE 0
Oops: 0002 [#1] PREEMPT SMP PTI
Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 06/15/2023
RIP: 0010:memcpy_orig+0xcd/0x130
RSP: 0018:ffffb7a18c3ffc40 EFLAGS: 00010202
RAX: 00007f4801111000 RBX: 00007f4801111000 RCX: 000000000000000f
RDX: 000000000000000f RSI: ffffffffc0bfd7a0 RDI: 00007f4801111000
RBP: ffffffffc0bfd7a0 R08: 725f746f6e5f6f64 R09: 3d7265766f636572
R10: ffffb7a18c3ffd08 R11: 0000000000000000 R12: 00007f4881110fff
R13: 000000007fffffff R14: ffffb7a18c3ffca0 R15: ffffffffc0bfd7af
FS:  00007f480118a740(0000) GS:ffff98e38af00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4801111000 CR3: 0000000864b8e001 CR4: 00000000007706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 ? __die_body+0x1a/0x60
 ? page_fault_oops+0x183/0x510
 ? exc_page_fault+0x69/0x150
 ? asm_exc_page_fault+0x22/0x30
 ? memcpy_orig+0xcd/0x130
 vsnprintf+0x102/0x4c0
 sprintf+0x51/0x80
 qedi_dbg_do_not_recover_cmd_read+0x2f/0x50 [qedi 6bcfdeeecdea037da47069eca2ba717c84a77324]
 full_proxy_read+0x50/0x80
 vfs_read+0xa5/0x2e0
 ? folio_add_new_anon_rmap+0x44/0xa0
 ? set_pte_at+0x15/0x30
 ? do_pte_missing+0x426/0x7f0
 ksys_read+0xa5/0xe0
 do_syscall_64+0x58/0x80
 ? __count_memcg_events+0x46/0x90
 ? count_memcg_event_mm+0x3d/0x60
 ? handle_mm_fault+0x196/0x2f0
 ? do_user_addr_fault+0x267/0x890
 ? exc_page_fault+0x69/0x150
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f4800f20b4d


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 56bec63a7fc87ad50b3373a87517dc9770eef9e0
CVE-2024-40983: kernel: tipc: force a dst refcount before doing decryption
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's TIPC module, where a reference count on the destination entry was not enforced before decryption. This issue arises due to potential asynchronous returns from crypto requests, which could lead to crash.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3eb1b39627892c4e26cb0162b75725aa5fcc60c8
CVE-2024-40984: kernel: ACPICA: Revert &#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&#34;
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ACPICA component, where improper handling of memory mappings can lead to a NULL pointer dereference. This issue arises when mapping requests exceed page boundaries, resulting in attempts to access unmapped memory.


Affected upstream versions: 2.6.32
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 435ecc978c3d5d0c4e172ec5b956dc1904061d98
CVE-2024-40988: kernel: drm/radeon: fix UBSAN warning in kv_dpm.c
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's DRM/Radeon driver, specifically in the sumo_vid_mapping_entry within the kv_dpm.c file. Insufficient bounds checking can lead to memory corruption.


Affected upstream versions: 3.11
Fixed upstream versions: 0, 4.19.317, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 07e8f15fa16695cf4c90e89854e59af4a760055b
CVE-2024-40989: kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's KVM for ARM64 within the vgic-init.c, vgic-mmio-v3.c, and vgic.h files. The virtual vCPUs may retain dangling pointers in a redistributor region after they have been torn down, leading to potential memory corruption.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 68df4fc449fcc24347209e500ce26d5816705a77
CVE-2024-40995: kernel: net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's networking subsystem in the act_api implementation within the tcf_idr_check_alloc() function, which lead to a possible infinite loop when multiple actions with the same index are added, causing the second request to block indefinitely while holding the rtnl_lock.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.221, 5.15.162, 5.4.279, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0d8a2d287c8a394c0d4653f0c6c7be4c688e5a74
CVE-2024-40997: kernel: cpufreq: amd-pstate: fix memory leak on CPU EPP exit
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: amd-pstate: fix memory leak on CPU EPP exit

The cpudata memory from kzalloc() in amd_pstate_epp_cpu_init() is
not freed in the analogous exit function, so fix that.

[ rjw: Subject and changelog edits ]


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 448efb7ea0bfa2c4e27c5a2eb5684fd225cd12cd
CVE-2024-40998: kernel: ext4: fix uninitialized ratelimit_state-&gt;lock access in __ext4_fill_super()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A vulnerability was found in the Linux kernel's ext4 filesystem within the __ext4_fill_super() function, where uninitialized access to ratelimit_state->lock can occur, where the sysfs interface is registered before properly initializing rs->lock, potentially allowing other processes to modify rs->interval to a non-zero value.


Affected upstream versions: 3.13
Fixed upstream versions: 0, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 23afcd52af06880c6c913a0ad99022b8937b575c
CVE-2024-41001: kernel: io_uring/sqpoll: work around a potential audit memory leak
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L)
Public date: 2024-07-12T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

io_uring/sqpoll: work around a potential audit memory leak

kmemleak complains that there's a memory leak related to connect
handling:

unreferenced object 0xffff0001093bdf00 (size 128):
comm "iou-sqp-455", pid 457, jiffies 4294894164
hex dump (first 32 bytes):
02 00 fa ea 7f 00 00 01 00 00 00 00 00 00 00 00  ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
backtrace (crc 2e481b1a):
[<00000000c0a26af4>] kmemleak_alloc+0x30/0x38
[<000000009c30bb45>] kmalloc_trace+0x228/0x358
[<000000009da9d39f>] __audit_sockaddr+0xd0/0x138
[<0000000089a93e34>] move_addr_to_kernel+0x1a0/0x1f8
[<000000000b4e80e6>] io_connect_prep+0x1ec/0x2d4
[<00000000abfbcd99>] io_submit_sqes+0x588/0x1e48
[<00000000e7c25e07>] io_sq_thread+0x8a4/0x10e4
[<00000000d999b491>] ret_from_fork+0x10/0x20

which can can happen if:

1) The command type does something on the prep side that triggers an
   audit call.
2) The thread hasn't done any operations before this that triggered
   an audit call inside ->issue(), where we have audit_uring_entry()
   and audit_uring_exit().

Work around this by issuing a blanket NOP operation before the SQPOLL
does anything.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 55c22375cbaa24f77dd13f9ae0642915444a1227
CVE-2024-41005: kernel: netpoll: Fix race condition in netpoll_owner_active
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-12T00:00:00+00:00

A flaw was found in the Linux kernel in which a privileged user on a multiprocessor system might be able to cause a denial of service due to a race condition in network-related functions.


Affected upstream versions: 4.10
Fixed upstream versions: 0, 5.10.221, 5.15.162, 6.1.96, 6.10, 6.6.36, 6.9.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 43c0ca793a18578a0f5b305dd77fcf7ed99f1265
CVE-2024-41007: kernel: tcp: avoid too many retransmit packets
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-15T00:00:00+00:00

A vulnerability was found in the tcp_retransmit_timer function in the Linux kernel's TCP implementation. This issue occurs when a TCP socket uses TCP_USER_TIMEOUT and the peer's window retracts to zero, leading to excessive retransmission of packets every two milliseconds for up to four minutes after the timeout, which can result in network congestion and performance degradation.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.318, 5.10.222, 5.15.163, 5.4.280, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7bb7670f92bfbd05fc41a8f9a8f358b7ffed65f4
CVE-2024-41008: kernel: drm/amdgpu: change vm-&gt;task_info handling
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: change vm->task_info handling

This patch changes the handling and lifecycle of vm->task_info object.
The major changes are:
- vm->task_info is a dynamically allocated ptr now, and its uasge is
  reference counted.
- introducing two new helper funcs for task_info lifecycle management
    - amdgpu_vm_get_task_info: reference counts up task_info before
      returning this info
    - amdgpu_vm_put_task_info: reference counts down task_info
- last put to task_info() frees task_info from the vm.

This patch also does logistical changes required for existing usage
of vm->task_info.

V2: Do not block all the prints when task_info not found (Felix)

V3: Fixed review comments from Felix
   - Fix wrong indentation
   - No debug message for -ENOMEM
   - Add NULL check for task_info
   - Do not duplicate the debug messages (ti vs no ti)
   - Get first reference of task_info in vm_init(), put last
     in vm_fini()

V4: Fixed review comments from Felix
   - fix double reference increment in create_task_info
   - change amdgpu_vm_get_task_info_pasid
   - additional changes in amdgpu_gem.c while porting


Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b8f67b9ddf4f8fe6dd536590712b5912ad78f99c
CVE-2024-41009: kernel: bpf: Fix overrunning reservations in ringbuf
Component: kernel
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-17T00:00:00+00:00

An out-of-bounds memory access flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to crash the system.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.223, 5.15.164, 6.1.97, 6.10, 6.6.37, 6.9.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: be35504b959f2749bab280f4671e8df96dcf836f
CVE-2024-41010: kernel: bpf: Fix too early release of tcx_entry
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-17T00:00:00+00:00

A flaw was found in the Linux kernel in which certain sequences of network namespace activity can cause a use-after-free, resulting in a denial of service.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 230bb13650b0f186f540500fd5f5f7096a822a2a
CVE-2024-41012: kernel: filelock: Remove locks reliably when fcntl/close race is detected
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

filelock: Remove locks reliably when fcntl/close race is detected

When fcntl_setlk() races with close(), it removes the created lock with
do_lock_file_wait().
However, LSMs can allow the first do_lock_file_wait() that created the lock
while denying the second do_lock_file_wait() that tries to remove the lock.
Separately, posix_lock_file() could also fail to
remove a lock due to GFP_KERNEL allocation failure (when splitting a range
in the middle).

After the bug has been triggered, use-after-free reads will occur in
lock_get_status() when userspace reads /proc/locks. This can likely be used
to read arbitrary kernel memory, but can't corrupt kernel memory.

Fix it by calling locks_remove_posix() instead, which is designed to
reliably get rid of POSIX locks associated with the given file and
files_struct and is also used by filp_flush().


Affected upstream versions: 2.6.13
Fixed upstream versions: 0, 4.19.319, 5.10.223, 5.15.164, 5.4.281, 6.1.101, 6.10, 6.6.42, 6.9.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d30ff33040834c3b9eee29740acd92f9c7ba2250
CVE-2024-41013: kernel: xfs: don&#39;t walk off the end of a directory data block
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel in the xfs_dir2_data_unused() and xfs_dir2_data_entry() functions where a lack of proper sanity checks while handling directory data blocks can lead to out-of-bounds memory access. This can result in undefined system behavior or crashes.


Affected upstream versions: 3.8
Fixed upstream versions: 0, 6.1.142, 6.11, 6.6.68
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b0932e4f9da85349d1c8f2a77d2a7a7163b8511d
CVE-2024-41014: kernel: xfs: add bounds checking to xlog_recover_process_data
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability has been identified within the Linux kernel's xlog_recover_process_data() function. Specifically, the function lacks proper bounds checking on the space allocated for the fixed members of the xlog_op_header structure during log record processing. This omission can lead to an out-of-bounds memory access.

The potential impact of this flaw includes unpredictable system behavior and kernel-level crashes. Successful exploitation could disrupt system availability and potentially be leveraged for further malicious activities, depending on the context and any subsequent vulnerabilities exposed by the undefined behavior.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 6.1.120, 6.11, 6.6.64
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d1e3efe783365db59da88f08a2e0bfe1cc95b143
CVE-2024-41020: kernel: filelock: Fix fcntl/close race recovery compat path
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel in the fcntl_setlk64() function where a potential race condition can be triggered when a file descriptor is closed during a fcntl operation's execution. This can lead to system instability or crashes.


Affected upstream versions: 2.6.13
Fixed upstream versions: 0, 4.19.319, 5.10.223, 5.15.164, 5.4.281, 6.1.102, 6.10.2, 6.11, 6.6.43, 6.9.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a561145f3ae973ebf3e0aee41624e92a6c5cb38d
CVE-2024-41023: kernel: sched/deadline: Fix task_struct reference leak
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel's deadline scheduler in the enqueue_task_dl() function, where the reference count is improperly decremented in certain situations, potentially causing a memory leak. This issue can lead to memory exhaustion over time.


Affected upstream versions: 4.19.257 < 4.20, 5.4.212 < 5.5, 5.10
Fixed upstream versions: 0, 4.20, 5.5, 6.10, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7a54d31face626f62de415ebe77b43f76c3ffaf4
CVE-2024-41031: kernel: mm/filemap: skip to create PMD-sized page cache if needed
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel related to how large page caching is handled, particularly for AMD64 architectures. The issue stems from the xarray data structure's inability to support PMD-sized page caches when the base page size is larger than MAX_PAGECACHE_ORDER. The particular configuration on ARM64 architectures can potentially lead to untenable resource allocation and system crashes when large pages are manipulated.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 06b5a69c27ec405a3c3f2da8520ff1ee70b94a21
CVE-2024-41032: kernel: mm: vmalloc: check if a hash-index is in cpu_possible_mask
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel that involves improper handling of per-CPU data in systems where cpu_possible_mask has gaps between CPUs. This can lead to an index which accesses non-existent or unset CPU areas and potentially causes kernel crashes.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 28acd531c9a365dac01b32e6bc54aed8c1429bcb
CVE-2024-41035: kernel: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the usb_parse_endpoint() function in the Linux kernel's usb drivers, where improper handling of the reserved bits in an endpoint descriptor's bEndpointAddress field can lead to confusion in the endpoint_is_duplicate() routine in config.c. This will erroneously treat the same endpoint descriptors as distinct, given that the reserved bits are not properly cleared. This can potentially lead to unexpected behavior from connected USB devices.


Affected upstream versions: 3.2.87 < 3.3, 3.10.106 < 3.11, 3.12.70 < 3.13, 3.16.42 < 3.17, 4.1.39 < 4.2, 4.4.42 < 4.5, 4.9.3 < 4.10, 4.10
Fixed upstream versions: 0, 3.11, 3.13, 3.17, 3.3, 4.10, 4.19.318, 4.2, 4.5, 5.10.222, 5.15.163, 5.4.280, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d8418fd083d1b90a6c007cf8dcf81aeae274727b
CVE-2024-41038: kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-07-29T00:00:00+00:00

A vulnerability was found in the Linux kernel in the cs_dsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an overflow of the firmware data buffer, leading to memory overwrite and potential system instability.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.100, 6.10, 6.6.41, 6.9.10
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6619aa48a011364e9f29083cc76368e6acfe5b11