huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-26662: kernel: drm/amd/display: 'panel_cntl' could be null in 'dcn21_set_backlight_level()'
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

'panel_cntl' structure used to control the display panel could be null,
dereferencing it could lead to a null pointer access.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../display/dc/hwss/dcn21/dcn21_hwseq.c:269 dcn21_set_backlight_level() error: we previously assumed 'panel_cntl' could be null (see line 250)


Affected upstream versions: 5.9
Fixed upstream versions: 0, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2e150ccea13129eb048679114808eb9770443e4d
CVE-2024-26663: kernel: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

syzbot reported the following general protection fault [1]:

general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087]
...
RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291
...
Call Trace:
 <TASK>
 tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646
 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089
 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
 genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xd5/0x180 net/socket.c:745
 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

The cause of this issue is that when tipc_nl_bearer_add() is called with
the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called
even if the bearer is not UDP.

tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that
the media_ptr field of the tipc_bearer has an udp_bearer type object, so
the function goes crazy for non-UDP bearers.

This patch fixes the issue by checking the bearer type before calling
tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().


Affected upstream versions: 4.9
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 24ec8f0da93b8a9fba11600be8a90f0d73fb46f1
CVE-2024-26664: kernel: hwmon: (coretemp) Fix out-of-bounds memory access
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) Fix out-of-bounds memory access

Fix a bug that pdata->cpu_map[] is set before out-of-bounds check.
The problem might be triggered on systems with more than 128 cores per
package.


Affected upstream versions: 4.19.264 < 4.19.307, 5.4.221 < 5.4.269, 5.10.152 < 5.10.210, 5.15.76 < 5.15.149, 6.0.6 < 6.1, 6.1
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a
CVE-2024-26665: kernel: tunnels: fix out of bounds access when building IPv6 PMTU error
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A flaw was found in the Linux kernel. This issue occurs due to the improper handling of non-linear skbs (socket buffers) when calculating checksums for ICMPv6 PMTU error messages. This vulnerability can lead to out-of-bounds access, potentially causing memory corruption or crashes.

Statement: Red Hat Enterprise Linux 9 is not affected by this vulnerability, as it was already patched in the 9.4.0 release.

Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e77bf828f1ca1c47fcff58bdc26b60a9d3dfbe1d
CVE-2024-26668: kernel: netfilter: nft_limit: reject configurations that cause integer overflow
Component: kernel
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_limit: reject configurations that cause integer overflow

Reject bogus configs where internal token counter wraps around.
This only occurs with very very large requests, such as 17gbyte/s.

Its better to reject this rather than having incorrect ratelimit.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.15.149, 6.1.76, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 79d4efd75e7dbecd855a3b8a63e65f7265f466e1
CVE-2024-26669: kernel: net/sched: flower: Fix chain template offload
Component: kernel
Severity: Low
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: flower: Fix chain template offload

The Linux kernel CVE team has assigned CVE-2024-26669 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040237-CVE-2024-26669-ca3c@gregkh/T


Affected upstream versions: 5.1
Fixed upstream versions: 0, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9ed46144cff3598a5cf79955630e795ff9af5b97
CVE-2024-26670: kernel: arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD
Component: kernel
Severity: Moderate
CWE: CWE-1300 (Improper Protection of Physical Side Channels)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A vulnerability was found in the Linux kernel. This issue occurs due to the incorrect placement of the TLBI and DSB instructions, which are not placed after all explicit memory accesses, creating the potential for speculative unprivileged loads.


Affected upstream versions: 6.1.57 < 6.2, 6.5.7 < 6.6, 6.6
Fixed upstream versions: 0, 6.2, 6.6, 6.6.15, 6.7.3, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 58eb5c07f41704464b9acc09ab0707b6769db6c0
CVE-2024-26671: kernel: blk-mq: fix IO hang from sbitmap wakeup race
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

A possible IO hang from sbitmap wakeup race was found in the Linux kernel. This may lead to compromised Availability.

Statement: This issue is fixed in RHEL-9.4 and above (including RHEL 8.10)
~~~
a7f97b4cae32 (in rhel-9.4, rhel-9.5) blk-mq: fix IO hang from sbitmap wakeup race 
098ab94a5112 (in rhel-8.10) blk-mq: fix IO hang from sbitmap wakeup race
~~~

Please note that while RHEL-9 kernel-rt still appears as affected, it has been fixed in the same RHSA as RHEL-9 kernel. This is because from RHEL-9.3 onwards, the kernel and kernel-rt fixes are bundled together in a single errata.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9525b38180e2753f0daa1a522b7767a2aa969676
CVE-2024-26672: kernel: drm/amdgpu: variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'

Fixes the below:

drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_entry() warn: variable dereferenced before check 'mca_funcs' (see line 368)

357 int amdgpu_mca_smu_get_mca_entry(struct amdgpu_device *adev,
				     enum amdgpu_mca_error_type type,
358                                  int idx, struct mca_bank_entry *entry)
359 {
360         const struct amdgpu_mca_smu_funcs *mca_funcs =
						adev->mca.mca_funcs;
361         int count;
362
363         switch (type) {
364         case AMDGPU_MCA_ERROR_TYPE_UE:
365                 count = mca_funcs->max_ue_count;

mca_funcs is dereferenced here.

366                 break;
367         case AMDGPU_MCA_ERROR_TYPE_CE:
368                 count = mca_funcs->max_ce_count;

mca_funcs is dereferenced here.

369                 break;
370         default:
371                 return -EINVAL;
372         }
373
374         if (idx >= count)
375                 return -EINVAL;
376
377         if (mca_funcs && mca_funcs->mca_get_mca_entry)
	        ^^^^^^^^^

Checked too late!


Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7b5d58c07024516c0e81b95e98f37710cf402c53
CVE-2024-26673: kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

The Linux kernel CVE team has assigned CVE-2024-26673 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024040212-CVE-2024-26673-b2d3@gregkh/T


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.210, 5.15.149, 5.4.269, 6.1.77, 6.6.16, 6.7.4, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f549f340c91f08b938d60266e792ff7748dae483
CVE-2024-26674: kernel: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups

During memory error injection test on kernels >= v6.4, the kernel panics
like below. However, this issue couldn't be reproduced on kernels <= v6.3.

  mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134
  mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20}
  mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86
  mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490
  mce: [Hardware Error]: Run the above through 'mcelog --ascii'
  mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel
  Kernel panic - not syncing: Fatal local machine check

The MCA code can recover from an in-kernel #MC if the fixup type is
EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to
access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT
the only thing that is raised for an in-kernel #MC is a panic.

ex_handler_uaccess() would warn if users gave a non-canonical addresses
(with bit 63 clear) to {get, put}_user(), which was unexpected.

Therefore, commit

  b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()")

replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user()
fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic.

Commit

  6014bc27561f ("x86-64: make access_ok() independent of LAM")

added the check gp_fault_address_ok() right before the WARN_ONCE() in
ex_handler_uaccess() to not warn about non-canonical user addresses due
to LAM.

With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user()
exception fixups in order to be able to handle in-kernel MCEs correctly
again.

  [ bp: Massage commit message. ]


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2aed1b6c33afd8599d01c6532bbecb829480a674
CVE-2024-26678: kernel: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section

The .compat section is a dummy PE section that contains the address of
the 32-bit entrypoint of the 64-bit kernel image if it is bootable from
32-bit firmware (i.e., CONFIG_EFI_MIXED=y)

This section is only 8 bytes in size and is only referenced from the
loader, and so it is placed at the end of the memory view of the image,
to avoid the need for padding it to 4k, which is required for sections
appearing in the middle of the image.

Unfortunately, this violates the PE/COFF spec, and even if most EFI
loaders will work correctly (including the Tianocore reference
implementation), PE loaders do exist that reject such images, on the
basis that both the file and memory views of the file contents should be
described by the section headers in a monotonically increasing manner
without leaving any gaps.

So reorganize the sections to avoid this issue. This results in a slight
padding overhead (< 4k) which can be avoided if desired by disabling
CONFIG_EFI_MIXED (which is only needed in rare cases these days)


Affected upstream versions: 6.7
Fixed upstream versions: 0, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d327e961573fc335af0ae8a160302205327e1f4e
CVE-2024-26679: kernel: inet: read sk-&gt;sk_family once in inet_recv_error()
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

inet: read sk->sk_family once in inet_recv_error()

inet_recv_error() is called without holding the socket lock.

IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM
socket option and trigger a KCSAN warning.


Affected upstream versions: 3.17.7 < 3.18, 3.18
Fixed upstream versions: 0, 3.18, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: caa064c3c2394d03e289ebd6b0be5102eb8a5b40
CVE-2024-26680: kernel: net: atlantic: Fix DMA mapping for PTP hwts ring
Component: kernel
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-02T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: Fix DMA mapping for PTP hwts ring

Function aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes
for PTP HWTS ring but then generic aq_ring_free() does not take this
into account.
Create and use a specific function to free HWTS ring to fix this
issue.

Trace:
[  215.351607] ------------[ cut here ]------------
[  215.351612] DMA-API: atlantic 0000:4b:00.0: device driver frees DMA memory with different size [device address=0x00000000fbdd0000] [map size=34816 bytes] [unmap size=32768 bytes]
[  215.351635] WARNING: CPU: 33 PID: 10759 at kernel/dma/debug.c:988 check_unmap+0xa6f/0x2360
...
[  215.581176] Call Trace:
[  215.583632]  <TASK>
[  215.585745]  ? show_trace_log_lvl+0x1c4/0x2df
[  215.590114]  ? show_trace_log_lvl+0x1c4/0x2df
[  215.594497]  ? debug_dma_free_coherent+0x196/0x210
[  215.599305]  ? check_unmap+0xa6f/0x2360
[  215.603147]  ? __warn+0xca/0x1d0
[  215.606391]  ? check_unmap+0xa6f/0x2360
[  215.610237]  ? report_bug+0x1ef/0x370
[  215.613921]  ? handle_bug+0x3c/0x70
[  215.617423]  ? exc_invalid_op+0x14/0x50
[  215.621269]  ? asm_exc_invalid_op+0x16/0x20
[  215.625480]  ? check_unmap+0xa6f/0x2360
[  215.629331]  ? mark_lock.part.0+0xca/0xa40
[  215.633445]  debug_dma_free_coherent+0x196/0x210
[  215.638079]  ? __pfx_debug_dma_free_coherent+0x10/0x10
[  215.643242]  ? slab_free_freelist_hook+0x11d/0x1d0
[  215.648060]  dma_free_attrs+0x6d/0x130
[  215.651834]  aq_ring_free+0x193/0x290 [atlantic]
[  215.656487]  aq_ptp_ring_free+0x67/0x110 [atlantic]
...
[  216.127540] ---[ end trace 6467e5964dd2640b ]---
[  216.132160] DMA-API: Mapped at:
[  216.132162]  debug_dma_alloc_coherent+0x66/0x2f0
[  216.132165]  dma_alloc_attrs+0xf5/0x1b0
[  216.132168]  aq_ring_hwts_rx_alloc+0x150/0x1f0 [atlantic]
[  216.132193]  aq_ptp_ring_alloc+0x1bb/0x540 [atlantic]
[  216.132213]  aq_nic_init+0x4a1/0x760 [atlantic]


Affected upstream versions: 5.5
Fixed upstream versions: 0, 6.1.78, 6.6.17, 6.7.5, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 466ceebe48cbba3f4506f165fca7111f9eb8bb12
CVE-2024-26686: kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the do_task_stat() function in the Linux kernel, where due to excessive lock contention, a potential hard lockup could be created. This can create a performance bottleneck and lead to kernel unresponsiveness.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.237, 5.15.181, 6.1.82, 6.6.64, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4fe85bdaabd63f8f8579b24a10ed597c9c482164
CVE-2024-26691: kernel: KVM: arm64: Fix circular locking dependency
Component: kernel
Severity: Low
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Fix circular locking dependency

The rule inside kvm enforces that the vcpu->mutex is taken *inside*
kvm->lock. The rule is violated by the pkvm_create_hyp_vm() which acquires
the kvm->lock while already holding the vcpu->mutex lock from
kvm_vcpu_ioctl(). Avoid the circular locking dependency altogether by
protecting the hyp vm handle with the config_lock, much like we already
do for other forms of VM-scoped data.


Affected upstream versions: 3.11
Fixed upstream versions: 0, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3d16cebf01127f459dcfeb79ed77bd68b124c228
CVE-2024-26693: kernel: wifi: iwlwifi: mvm: fix a crash when we run out of stations
Component: kernel
Severity: Moderate
CWE: CWE-99 (Improper Control of Resource Identifiers ('Resource Injection'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel's iwlwifi driver, which can result in a crash due to improper handling of station data (STA) when the system runs out of available stations in the firmware. This could lead to a denial of service (Dos) which crashes the Access Point (AP).

Statement: Red Hat Enterprise Linux 8 and 9 are not affected by this vulnerability.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 00f4eb31b8193f6070ce24df636883f9c104ca95
CVE-2024-26694: kernel: wifi: iwlwifi: fix double-free bug
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel's iwlwifi driver, where the TLV PC register data being freed is not properly marked as NULL afterwards, resulting in a double-free issue. This could lead to memory corruption or crashes.


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ab9d4bb9a1892439b3123fc52b19e32b9cdf80ad
CVE-2024-26698: kernel: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the hv_netvsc driver in the Linux kernel, where a race condition is present between the netvsc_probe() and netvsc_remove() functions. This race condition could lead to system hangs during network device removal.

Statement: Red Hat Enterprise Linux 8 Real Time (RT) kernel is not affected by this vulnerability due to the following configuration: "# CONFIG_HYPERV is not set".

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9ec807e7b6f5fcf9499f3baa69f254bb239a847f
CVE-2024-26704: kernel: ext4: fix double-free of blocks due to wrong extents moved_len
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-04-03T00:00:00+00:00

A vulnerability was found in the Linux kernel. This issue occurs in the ext4 function, in ext4_move_extents(), where an error in updating the moved_len variable can lead to double-free of blocks and corrupt block accounting. This could lead to crashes or undefined behavior.

Statement: This vulnerability is rated as moderate because this issue could lead to ext4 file system crashes or undefined behavior on the system.

Affected upstream versions: 3.18
Fixed upstream versions: 0, 4.19.307, 5.10.210, 5.15.149, 5.4.269, 6.1.79, 6.6.18, 6.7.6, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b4fbb89d722cbb16beaaea234b7230faaaf68c71