huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-27030: kernel: octeontx2-af: race condition on interupts
Component: kernel
Severity: Moderate
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-05-01T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel. When AF and PF interrupts are raised at the same time in the CPU, two cores serve same event, corrupting the data.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 94cb17e5cf3a3c484063abc0ce4b8a2b2e8c1cb2
CVE-2024-27038: kernel: clk: Fix clk_core_get NULL dereference
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: Fix clk_core_get NULL dereference

It is possible for clk_core_get to dereference a NULL in the following
sequence:

clk_core_get()
    of_clk_get_hw_from_clkspec()
        __of_clk_get_hw_from_provider()
            __clk_get_hw()

__clk_get_hw() can return NULL which is dereferenced by clk_core_get() at
hw->core.

Prior to commit dde4eff47c82 ("clk: Look for parents with clkdev based
clk_lookups") the check IS_ERR_OR_NULL() was performed which would have
caught the NULL.

Reading the description of this function it talks about returning NULL but
that cannot be so at the moment.

Update the function to check for hw before dereferencing it and return NULL
if hw is NULL.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d7ae7d1265686b55832a445b1db8cdd69738ac07
CVE-2024-27043: kernel: media: edia: dvbdev: fix a use-after-free
Component: kernel
Severity: Low
CVSS v3: 5.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: edia: dvbdev: fix a use-after-free

In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed
in several error-handling paths. However, *pdvbdev is not set to NULL
after dvbdev's deallocation, causing use-after-frees in many places,
for example, in the following call chain:

budget_register
  |-> dvb_dmxdev_init
        |-> dvb_register_device
  |-> dvb_dmxdev_release
        |-> dvb_unregister_device
              |-> dvb_remove_device
                    |-> dvb_device_put
                          |-> kref_put

When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in
dvb_register_device) could point to memory that had been freed in
dvb_register_device. Thereafter, this pointer is transferred to
kref_put and triggering a use-after-free.


Affected upstream versions: 2.6.21
Fixed upstream versions: 0, 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d0f5c28333822f9baa5280d813124920720fd856
CVE-2024-27046: kernel: nfp: flower: handle acti_netdevs allocation failure
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's ethernet lag_conf.c driver in the nfp_fl_lag_do_work() function, where a NULL pointer dereference can occur due to a lack of proper checks. The scenario is caused when the function attempts to call kmalloc_array(), which returns as NULL because the physical memory has run out, and the corresponding value acti_netdevs is then used. This flaw can result in system instability.


Affected upstream versions: 4.18
Fixed upstream versions: 0, 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d746889db75a76aeee95fb705b8e1ac28c684a2e
CVE-2024-27048: kernel: wifi: brcm80211: handle pmk_op allocation failure
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's Wi-Fi cfg80211.c driver, where a lack of proper checks can result in a NULL pointer dereference. This issue occurs when the brcmf_pmksa_v3_op() function attempts to call malloc (), but the physical memory has run out. In this situation, kzalloc() will return NULL, which the function does not check before using it in the corresponding value pmk_op., possibly leading to system instability.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: df62e22c2e27420e8990a4f09e30d7bf56c2036f
CVE-2024-27049: kernel: wifi: mt76: mt7925e: fix use-after-free in free_irq()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A use-after-free flaw was found in free_irq() in the Linux kernel.

Statement: Red Hat Enterprise Linux 8 is not affected by this vulnerability.

Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 84470b48af03a818039d587478b415cbcb264ff5
CVE-2024-27052: kernel: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's net rtl8xxxu_core.c driver, where a race condition can lead to a use-after-free situation in the rtl8xxxu_stop() function. This occurs when the workqueue is still running but the driver has been stopped and can lead to c2hcmd_work attempting to access memory that has been freed. This issue can lead to memory corruption or crashes.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dddedfa3b29a63c2ca4336663806a6128b8545b4
CVE-2024-27056: kernel: wifi: iwlwifi: mvm: ensure offloading TID queue exists
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A vulnerability was found in the Linux kernel's iwlwifi driver for Intel wireless devices. This issue occurs when the system attempts to sync the TX queue for an offloading TID during resume, but the queue is not allocated if no packets have been sent on TID 0.


Affected upstream versions: 5.4
Fixed upstream versions: 0, 6.1.132, 6.6.85, 6.7.11, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4903303f25f48b5a1e34e6324c7fae9ccd6b959a
CVE-2024-27057: kernel: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend

The Linux kernel CVE team has assigned CVE-2024-27057 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050116-CVE-2024-27057-c0fb@gregkh/T


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.6.23, 6.7.11, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3cac6eebea9b4bc5f041e157e45c76e212ad6759
CVE-2024-27059: kernel: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command

The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values
in the ATA ID information to calculate cylinder and head values when
creating a CDB for READ or WRITE commands.  The calculation involves
division and modulus operations, which will cause a crash if either of
these values is 0.  While this never happens with a genuine device, it
could happen with a flawed or subversive emulation, as reported by the
syzbot fuzzer.

Protect against this possibility by refusing to bind to the device if
either the ATA_ID_HEADS or ATA_ID_SECTORS value in the device's ID
information is 0.  This requires isd200_Initialization() to return a
negative error code when initialization fails; currently it always
returns 0 (even when there is an error).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9968c701cba7eda42e5f0052b040349d6222ae34
CVE-2024-27062: kernel: nouveau: lock the client object tree.
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the nouveau module in the Linux kernel. A missing resource lock can cause a race condition and trigger a general protection fault, resulting in a denial of service.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6887314f5356389fc219b8152e951ac084a10ef7
CVE-2024-27065: kernel: netfilter: nf_tables: do not compare internal table flags on updates
Component: kernel
Severity: Low
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: do not compare internal table flags on updates

Restore skipping transaction if table update does not modify flags.


Affected upstream versions: 5.4.262 < 5.4.273, 5.10.202 < 5.10.214, 5.13
Fixed upstream versions: 0, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 845083249d6a392f3a88804e1669bdb936ee129f
CVE-2024-27079: kernel: iommu/vt-d: Fix NULL domain on device release
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Fix NULL domain on device release

The Linux kernel CVE team has assigned CVE-2024-27079 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050134-CVE-2024-27079-f478@gregkh/T


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 333fe86968482ca701c609af590003bcea450e8f
CVE-2024-27289: pgx: SQL Injection via Line Comment Creation
Component: pgx
Severity: Moderate
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-03-07T00:00:00+00:00

A flaw was found in pgx. SQL injection can occur when all of the following conditions are met in versions before 4.18.2 of pgx. 
- The non-default simple protocol is used
- A placeholder for a numeric value must be immediately preceded by a minus
- There must be a second placeholder for a string value after the first placeholder
- Both must be on the same line
- Both parameter values must be user-controlled


Affected upstream versions: < 4.18.2
Fixed upstream versions: v4.18.2
Upstream repository: https://github.com/jackc/pgx
Upstream fix commit: f94eb0e2f96782042c96801b5ac448f44f0a81df
CVE-2024-27304: pgx: SQL Injection via Protocol Message Size Overflow
Component: pgx
Severity: Moderate
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-03-06T00:00:00+00:00

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.


Affected upstream versions: < 4.18.2, >= 5.0.0, < 5.5.4
Fixed upstream versions: v2.3.3
Upstream repository: https://github.com/jackc/pgproto3
Upstream fix commit: 945c2126f6db8f3bea7eeebe307c01fe92bca007
CVE-2024-27306: aiohttp: XSS on index pages for static file handling
Component: aiohttp
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-04-18T00:00:00+00:00

A flaw was found in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. When using "web.static(..., show_index=True)", the resulting index pages do not escape file names. If users can upload files with arbitrary filenames to the static directory, the server is vulnerable to cross-site scripting (XSS) attacks.


Affected upstream versions: < 3.9.4
Fixed upstream versions: v3.9.4
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: 28335525d1eac015a7e7584137678cbb6ff19397
CVE-2024-27307: jsonata: malicious expression can pollute the "Object" prototype
Component: jsonata
Severity: Important
CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)
Public date: 2024-03-06T00:00:00+00:00

A vulnerability was found in JSONata. A malicious expression can exploit the transform operator to override properties on the Object constructor and prototype. This issue can result in denial of service, remote code execution, or other unforeseen behavior in applications that assess user-provided JSONata expressions.

Statement: This issue affects the @roadiehq/scaffolder-backend-module-utils plugin shipped in Red Hat Developer Hub. However, currently, this plugin is in technology preview. For more information, see the link below.

https://access.redhat.com/documentation/en-us/red_hat_developer_hub/1.0/html/release_notes_for_red_hat_developer_hub_1.0/con-relnotes-techpreview-features_release-notes-rhdh#plugins-available-in-red-hat-developer-hub

Affected upstream versions: >= 1.4.0, < 1.8.7, >= 2.0.0, < 2.0.4
Fixed upstream versions: v1.8.7
Upstream repository: https://github.com/jsonata-js/jsonata
Upstream fix commit: 1d579dbe99c19fbe509f5ba2c6db7959b0d456d1
CVE-2024-27351: python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
Component: python-django
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-04T09:00:00+00:00

An inefficient regular expression complexity flaw was found in the Truncator.words function and truncatewords_html filter of Django. This issue may allow an attacker to use a suitably crafted string to cause a denial of service.


Affected upstream versions: n/a
Fixed upstream versions: stable/5.0.x
Upstream repository: https://github.com/django/django
Upstream fix commit: 3394fc6132436eca89e997083bae9985fb7e761e
CVE-2024-27388: kernel: SUNRPC: fix some memleaks in gssx_dec_option_array
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

A flaw was found in the auth_rpcgss module in the Linux kernel. A memory leak can occur due to improper error handling, potentially impacting system performance and possibly resulting in a denial of service.

Statement: This vulnerability does not affect the auth_rpcgss module in the Linux kernel as shipped in Red Hat Enterprise Linux 9 because it already contains the fix for this issue.

Affected upstream versions: 3.10
Fixed upstream versions: 0, 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b97c37978ca825557d331c9012e0c1ddc0e42364
CVE-2024-27389: kernel: pstore: inode: Only d_invalidate() is needed
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pstore: inode: Only d_invalidate() is needed

The Linux kernel CVE team has assigned CVE-2024-27389 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050135-CVE-2024-27389-fb3a@gregkh/T


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.15.209, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d0ee2a8adb6673382cce8a4280e1ca0849b3b783
CVE-2024-27393: kernel: xen-netfront: Add missing skb_mark_for_recycle
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xen-netfront: Add missing skb_mark_for_recycle

Notice that skb_mark_for_recycle() is introduced later than fixes tag in
commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling").

It is believed that fixes tag were missing a call to page_pool_release_page()
between v5.9 to v5.14, after which is should have used skb_mark_for_recycle().
Since v6.6 the call page_pool_release_page() were removed (in
commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()")
and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch
'net-page_pool-remove-page_pool_release_page'")).

This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch
page_pool memory leaks").


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4143b9479caa29bb2380f3620dcbe16ea84eb3b1
CVE-2024-27395: kernel: net: openvswitch: Fix Use-After-Free in ovs_ct_exit
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: Fix Use-After-Free in ovs_ct_exit

The Linux kernel CVE team has assigned CVE-2024-27395 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050836-CVE-2024-27395-573e@gregkh/T


Affected upstream versions: 4.18
Fixed upstream versions: 0, 4.19.313, 5.10.216, 5.15.158, 5.4.275, 6.1.90, 6.6.30, 6.8.9, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2db9a8c0a01fa1c762c1e61a13c212c492752994
CVE-2024-27397: kernel: netfilter: nf_tables: use timestamp to check for set element timeout
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-05-08T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Statement: This vulnerability impact level between Moderate and High, and chosen Moderate.

Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.19.320, 5.10.224, 5.15.165, 5.4.282, 6.1.97, 6.6.84, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f8dfda798650241c1692058713ca4fef8e429061
CVE-2024-27403: kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_flow_offload: reset dst in route object after setting up flow

dst is transferred to the flow object, route object does not own it
anymore.  Reset dst in route object, otherwise if flow_offload_add()
fails, error path releases dst twice, leading to a refcount underflow.


Affected upstream versions: 4.16
Fixed upstream versions: 0, 5.15.150, 6.1.80, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4c167af9f6b5ae4a5dbc243d5983c295ccc2e43c
CVE-2024-27404: kernel: mptcp: fix data races on remote_id
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel remote_id function. Successful exploitation of the flaw can result in loss of system availability.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.81, 6.6.19, 6.7.7, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e64148635509bf13eea851986f5a0b150e5bd066
CVE-2024-27410: kernel: wifi: nl80211: reject iftype change with mesh ID change
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

CVE-2024-27410 is a vulnerability in the Linux kernel’s Wi-Fi subsystem, affecting the nl80211 interface. The issue occurs when a mesh ID is set while simultaneously switching the interface to mesh mode, which can overwrite critical data in the wireless device's configuration. This can lead to unexpected behavior or instability. The issue has been resolved by preventing interface type changes during mesh ID updates. Users should update their kernel to a patched version to address this issue and ensure proper system functionality.


Affected upstream versions: 5.19.2 < 5.20, 6.0
Fixed upstream versions: 0, 5.20, 6.1.81, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 930e826962d9f01dcd2220176134427358d112f2
CVE-2024-27414: kernel: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back

The Linux kernel CVE team has assigned CVE-2024-27414 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051702-CVE-2024-27414-5c5d@gregkh/T


Affected upstream versions: 5.4.253 < 5.4.271, 5.10.190 < 5.10.212, 5.15.126 < 5.15.151, 6.1.45 < 6.1.81, 6.4.10 < 6.5, 6.5
Fixed upstream versions: 0, 5.10.212, 5.15.151, 5.4.271, 6.1.81, 6.5, 6.6.21, 6.7.9, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b9fbc44159dfc3e9a7073032752d9e03f5194a6f