huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-35900: kernel: netfilter: nf_tables: reject new basechain after table flag update
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: reject new basechain after table flag update

The Linux kernel CVE team has assigned CVE-2024-35900 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051952-CVE-2024-35900-c2c9@gregkh/T


Affected upstream versions: 5.4.262 < 5.4.274, 5.10.202 < 5.10.215, 5.13
Fixed upstream versions: 0, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6d12f21f8bbe23fde25b77c2bf5973c136b8bef8
CVE-2024-35904: kernel: selinux: avoid dereference of garbage after mount failure
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

selinux: avoid dereference of garbage after mount failure

The Linux kernel CVE team has assigned CVE-2024-35904 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051953-CVE-2024-35904-7f85@gregkh/T


Affected upstream versions: 4.17
Fixed upstream versions: 0, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 477ed6789eb9f3f4d3568bb977f90c863c12724e
CVE-2024-35905: kernel: bpf: Protect against int overflow for stack access size
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A flaw was found in the Linux kernel. An integer overflow vulnerability exists in the access size of a stack, such that the size of the access stack can appear negative as a result of overflowing its signed int representation. This issue can result in denial of service.


Affected upstream versions: 5.10.209 < 5.10.215, 5.15.148 < 5.15.154, 6.1.75 < 6.1.85, 6.6.14 < 6.6.26, 6.7.2 < 6.8, 6.8
Fixed upstream versions: 0, 5.10.215, 5.15.154, 6.1.85, 6.6.26, 6.8, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9970e059af471478455f9534e8c3db82f8c5496d
CVE-2024-35907: kernel: mlxbf_gige: call request_irq() after NAPI initialized
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

CVE-2024-35907 is a vulnerability in the Linux kernel's mlxbf_gige driver, which supports Mellanox BlueField devices. The issue occurs during kdump operations when a receive (RX) interrupt is triggered before the driver fully initializes. This leads to a race condition that can result in a NULL pointer dereference, causing the system to crash.

A pending RX interrupt before the driver requests the IRQ can lead to an improper sequence of operations, resulting in the crash.

This flaw affects system stability during kdump operations, potentially causing kernel panics.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a583117668ddb86e98f2e11c7caa3db0e6df52a3
CVE-2024-35908: kernel: tls: get psock ref after taking rxlock to avoid leak
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tls: get psock ref after taking rxlock to avoid leak

At the start of tls_sw_recvmsg, we take a reference on the psock, and
then call tls_rx_reader_lock. If that fails, we return directly
without releasing the reference.

Instead of adding a new label, just take the reference after locking
has succeeded, since we don't need it before.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 30fabe50a7ace3e9d57cf7f9288f33ea408491c8
CVE-2024-35910: kernel: tcp: properly terminate timers for kernel sockets
Component: kernel
Severity: Moderate
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to 'stop' the timers.

inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.

For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.

Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.

It is very possible we can revert in the future commit
3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)

We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.154, 5.4.274, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 93f0133b9d589cc6e865f254ad9be3e9d8133f50
CVE-2024-35911: kernel: ice: fix memory corruption bug with suspend and rebuild
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

This is a flaw in the Linux kernel's ICE driver for Intel Ethernet controllers. The problem arises when the system enters a suspended state, and the driver frees queue vectors without resetting the num_q_vectors variable. This oversight causes the ice_rebuild() function to allocate an incorrectly sized buffer, leading to memory corruption and potential system crashes.

During suspension, the driver fails to restore the num_q_vectors value after freeing queue vectors, resulting in invalid memory operations during system rebuilds.

Kernel crashes or instability can occur, especially when resuming from suspension, due to buffer mismanagement.


Affected upstream versions: 6.4.7 < 6.5, 6.5
Fixed upstream versions: 0, 6.5, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e40a02f06ceb0e0b0183e0b973ac5dbf8f75edec
CVE-2024-35912: kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: rfi: fix potential response leaks

The Linux kernel CVE team has assigned CVE-2024-35912 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35912-b093@gregkh/T


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.154, 6.1.85, 6.6.26, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 28db0ae86cb91a4ab0e855cff779daead936b7d5
CVE-2024-35913: kernel: wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF

The Linux kernel CVE team has assigned CVE-2024-35913 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051956-CVE-2024-35913-72a4@gregkh/T


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.8.5, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 222abd95f503e28c0404e596291fe472fe90929c
CVE-2024-35924: kernel: usb: typec: ucsi: Limit read size on v1.2
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Limit read size on v1.2

The Linux kernel CVE team has assigned CVE-2024-35924 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35924-90f6@gregkh/T


Affected upstream versions: 5.5
Fixed upstream versions: 0, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 266f403ec47573046dee4bcebda82777ce702c40
CVE-2024-35925: kernel: block: prevent division by zero in blk_rq_stat_sum()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: prevent division by zero in blk_rq_stat_sum()

The Linux kernel CVE team has assigned CVE-2024-35925 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35925-fa17@gregkh/T


Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.155, 5.4.274, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6a55dab4ac956deb23690eedd74e70b892a378e7
CVE-2024-35927: kernel: drm: Check output polling initialized before disabling
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm: Check output polling initialized before disabling

The Linux kernel CVE team has assigned CVE-2024-35927 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051915-CVE-2024-35927-2100@gregkh/T


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3d1b47e3a935abd4f258a945db87e7267ff4079c
CVE-2024-35930: kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()

The Linux kernel CVE team has assigned CVE-2024-35930 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051916-CVE-2024-35930-5571@gregkh/T


Affected upstream versions: 3.4
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.155, 5.4.274, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: edf82aa7e9eb864a09229392054d131b34a5c9e8
CVE-2024-35931: kernel: drm/amdgpu: Skip do PCI error slot reset during RAS recovery
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Skip do PCI error slot reset during RAS recovery

The Linux kernel CVE team has assigned CVE-2024-35931 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051916-CVE-2024-35931-430d@gregkh/T


Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 395ca1031acf89d8ecb26127c544a71688d96f35
CVE-2024-35933: kernel: Bluetooth: btintel: Fix null ptr deref in btintel_read_version
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

A NULL pointer dereference flaw was found in btintel_read_version in the Linux kernel. This issue may result in a crash.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b19fe5eea619d54eea59bb8a37c0f8d00ef0e912
CVE-2024-35937: kernel: wifi: cfg80211: check A-MSDU format more carefully
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check A-MSDU format more carefully

If it looks like there's another subframe in the A-MSDU
but the header isn't fully there, we can end up reading
data out of bounds, only to discard later. Make this a
bit more careful and check if the subframe header can
even be present.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9eb3bc0973d084423a6df21cf2c74692ff05647e
CVE-2024-35938: kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: decrease MHI channel buffer length to 8KB

The Linux kernel CVE team has assigned CVE-2024-35938 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051918-CVE-2024-35938-0100@gregkh/T


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.15.155, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 805a1cdde82fec00c7471a393f4bb437b2741559
CVE-2024-35939: kernel: dma-direct: Leak pages on dma_set_decrypted() failure
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dma-direct: Leak pages on dma_set_decrypted() failure

The Linux kernel CVE team has assigned CVE-2024-35939 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051919-CVE-2024-35939-f877@gregkh/T


Affected upstream versions: 5.7.7 < 5.8, 5.8
Fixed upstream versions: 0, 5.8, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4e0cfb25d49da2e6261ad582f58ffa5b5dd8c8e9
CVE-2024-35942: kernel: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain

The Linux kernel CVE team has assigned CVE-2024-35942 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051919-CVE-2024-35942-af72@gregkh/T


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9d3f959b426635c4da50dfc7b1306afd84d23e7c
CVE-2024-35944: kernel: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()

The Linux kernel CVE team has assigned CVE-2024-35944 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051920-CVE-2024-35944-a860@gregkh/T


Affected upstream versions: 3.9
Fixed upstream versions: 0, 4.19.312, 5.10.215, 5.15.155, 5.4.274, 6.1.86, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e87bb99d2df6512d8ee37a5d63d2ca9a39a8c051
CVE-2024-35946: kernel: wifi: rtw89: fix null pointer access when abort scan
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix null pointer access when abort scan

The Linux kernel CVE team has assigned CVE-2024-35946 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051921-CVE-2024-35946-c2c2@gregkh/T


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.6.27, 6.8.6, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b34d64e9aa5505e3c84570aed5c757f1839573e8
CVE-2024-35947: kernel: dyndbg: fix old BUG_ON in &gt;control parser
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dyndbg: fix old BUG_ON in &gt;control parser

The Linux kernel CVE team has assigned CVE-2024-35947 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051952-CVE-2024-35947-09bb@gregkh/T


Affected upstream versions: 2.6.30
Fixed upstream versions: 0, 4.19.314, 5.10.217, 5.15.159, 5.4.276, 6.1.91, 6.6.31, 6.8.10, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3c718bddddca9cbef177ac475b94c5c91147fb38
CVE-2024-35950: kernel: drm/client: Fully protect modes[] with dev-&gt;mode_config.mutex
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

A flaw in the Linux kernel's Direct Rendering Manager (DRM) client could cause system instability. The problem occurs because the modes[] array, used to store display mode pointers, wasn’t adequately protected by a mutex lock. This allows the array to reference memory that has already been freed or reused, leading to potential crashes or unpredictable behavior.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.216, 5.15.156, 5.4.275, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5a2f957e3c4553bbb100504a1acfeaeb33f4ca4e
CVE-2024-35952: kernel: drm/ast: Fix soft lockup
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-35952 describes an issue in the Linux kernel's AST graphics driver. The problem occurs in the ast_dp_set_on_off() function, where a lack of proper synchronization with the DisplayPort Microcontroller Unit (DPMCU) can result in an infinite loop. This can cause a "soft lockup" in the host system, impacting its availability.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8a6fea3fcb577a543ef67683ca7105bde49a38fb
CVE-2024-35954: kernel: scsi: sg: Avoid sg device teardown race
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

The bug is about a race condition in the Linux kernel's SCSI generic (sg) driver. The problem occurs during the removal of devices when the driver accesses a resource (request_queue) that may have already been freed, leading to a NULL pointer dereference. This issue can result in system crashes, impacting availability.


Affected upstream versions: 6.4.7 < 6.5, 6.5
Fixed upstream versions: 0, 6.5, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 46af9047523e2517712ae8e71d984286c626e022
CVE-2024-35957: kernel: iommu/vt-d: Fix WARN_ON in iommu probe path
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

CVE-2024-35957 is a vulnerability in the Linux kernel's Intel Virtualization Technology for Directed I/O (VT-d) subsystem. The issue stems from an incorrect assumption that each device has a unique source ID, leading to potential conflicts and system warnings during the IOMMU probe process. This flaw has been addressed by modifying the tracking mechanism to include only devices with PCI Address Translation Services (ATS) capabilities, thereby preventing unnecessary warnings and ensuring system stability. Users are advised to update their Linux kernel to a version that includes this fix to maintain optimal system performance.


Affected upstream versions: 6.8.2 < 6.8.7
Fixed upstream versions: 6.8.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fba8ca3e6f608b92e54271fdbd3ce569361939fc
CVE-2024-35958: kernel: net: ena: Fix incorrect descriptor free behavior
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

This is a vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver, which manages network interfaces on certain platforms. The driver utilizes two types of transmit (TX) queues: one for packets from the network stack and another for packets directed by XDP (eXpress Data Path) operations. The function ena_free_tx_bufs() is responsible for unmapping and freeing descriptors of uncompleted TX transactions. However, it incorrectly assumes that all TX queues handle packets from the network stack, leading to improper handling of descriptors in XDP-specific queues. This mismanagement can result in descriptors not being freed correctly, potentially causing system crashes, especially during a Virtual Function (VF) reset. The issue has been resolved by updating the driver to correctly differentiate between the two types of TX queues, ensuring proper descriptor management. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability.


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b26aa765f7437e1bbe8db4c1641b12bd5dd378f0
CVE-2024-35959: kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix mlx5e_priv_init() cleanup flow

The Linux kernel CVE team has assigned CVE-2024-35959 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024052019-CVE-2024-35959-6e06@gregkh/T


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.87, 6.6.28, 6.8.7, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad26f26abd353113dea4e8d5ebadccdab9b61e76