CVE-2023-52587

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: intel-sdw-acpi: harden detection of controller

The existing code currently sets a pointer to an ACPI handle before checking that it's actually a SoundWire controller. This can lead to issues where the graph walk continues and eventually fails, but the pointer was set already.

This patch changes the logic so that the information provided to the caller is set when a controller is found.(CVE-2021-46926)

In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix another memory leak in error handling paths

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.(CVE-2021-47070)

In the Linux kernel, the following vulnerability has been resolved:

asix: fix uninit-value in asix_mdio_read()

asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.

Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)

In the Linux kernel, the following vulnerability has been resolved:

EDAC/thunderx: Fix possible out-of-bounds string access

Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():

drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE);

...

Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.

Change it to strlcat().

bp: Trim compiler output, fixup commit message.

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.(CVE-2023-52500)

In the Linux kernel, the following vulnerability has been resolved: …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: img-scb: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36783)

In the Linux kernel, the following vulnerability has been resolved:

kyber: fix out of bounds access when preempted

__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx).

This manifested as this UBSAN array index out of bounds error reported by Jakub:

UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30

Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.(CVE-2021-46984)

In the Linux kernel, the following vulnerability has been resolved:

bus: qcom: Put child node before return

Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body.(CVE-2021-47054)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init

ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0.

[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 qat_dh895xccvf

In the Linux kernel, the following vulnerability has been…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: img-scb: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in functions img_i2c_xfer and img_i2c_init.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36783)

In the Linux kernel, the following vulnerability has been resolved:

kyber: fix out of bounds access when preempted

__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx for the current CPU again and uses that to get the corresponding Kyber context in the passed hctx. However, the thread may be preempted between the two calls to blk_mq_get_ctx(), and the ctx returned the second time may no longer correspond to the passed hctx. This "works" accidentally most of the time, but it can cause us to read garbage if the second ctx came from an hctx with more ctx's than the first one (i.e., if ctx->index_hw[hctx->type] > hctx->nr_ctx).

This manifested as this UBSAN array index out of bounds error reported by Jakub:

UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 index 13106 is out of range for type 'long unsigned int [128]' Call Trace: dump_stack+0xa4/0xe5 ubsan_epilogue+0x5/0x40 __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 queued_spin_lock_slowpath+0x476/0x480 do_raw_spin_lock+0x1c2/0x1d0 kyber_bio_merge+0x112/0x180 blk_mq_submit_bio+0x1f5/0x1100 submit_bio_noacct+0x7b0/0x870 submit_bio+0xc2/0x3a0 btrfs_map_bio+0x4f0/0x9d0 btrfs_submit_data_bio+0x24e/0x310 submit_one_bio+0x7f/0xb0 submit_extent_page+0xc4/0x440 __extent_writepage_io+0x2b8/0x5e0 __extent_writepage+0x28d/0x6e0 extent_write_cache_pages+0x4d7/0x7a0 extent_writepages+0xa2/0x110 do_writepages+0x8f/0x180 __writeback_single_inode+0x99/0x7f0 writeback_sb_inodes+0x34e/0x790 __writeback_inodes_wb+0x9e/0x120 wb_writeback+0x4d2/0x660 wb_workfn+0x64d/0xa10 process_one_work+0x53a/0xa80 worker_thread+0x69/0x5b0 kthread+0x20b/0x240 ret_from_fork+0x1f/0x30

Only Kyber uses the hctx, so fix it by passing the request_queue to ->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can map the queues itself to avoid the mismatch.(CVE-2021-46984)

In the Linux kernel, the following vulnerability has been resolved:

bus: qcom: Put child node before return

Put child node before return to fix potential reference count leak. Generally, the reference count of child is incremented and decremented automatically in the macro for_each_available_child_of_node() and should be decremented manually if the loop is broken in loop body.(CVE-2021-47054)

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init

ADF_STATUS_PF_RUNNING is (only) used and checked by adf_vf2pf_shutdown() before calling adf_iov_putmsg()->mutex_lock(vf2pf_lock), however the vf2pf_lock is initialized in adf_dev_init(), which can fail and when it fail, the vf2pf_lock is either not initialized or destroyed, a subsequent use of vf2pf_lock will cause issue. To fix this issue, only set this flag if adf_dev_init() returns 0.

[ 7.178404] BUG: KASAN: user-memory-access in __mutex_lock.isra.0+0x1ac/0x7c0 [ 7.180345] Call Trace: [ 7.182576] mutex_lock+0xc9/0xd0 [ 7.183257] adf_iov_putmsg+0x118/0x1a0 [intel_qat] [ 7.183541] adf_vf2pf_shutdown+0x4d/0x7b [intel_qat] [ 7.183834] adf_dev_shutdown+0x172/0x2b0 [intel_qat] [ 7.184127] adf_probe+0x5e9/0x600 qat_dh895xccvf

In the Linux kernel, the following vulnerability has been…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix another memory leak in error handling paths

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.(CVE-2021-47070)

In the Linux kernel, the following vulnerability has been resolved:

asix: fix uninit-value in asix_mdio_read()

asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.

Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)

In the Linux kernel, the following vulnerability has been resolved:

EDAC/thunderx: Fix possible out-of-bounds string access

Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():

drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE);

...

Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.

Change it to strlcat().

bp: Trim compiler output, fixup commit message.

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.(CVE-2023-52500)

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: assert requested protocol is valid

The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones.(CVE-2023-52507)

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: Fix a potential UAF in ca8210_probe

If of_clk_add_provider()…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix another memory leak in error handling paths

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.(CVE-2021-47070)

In the Linux kernel, the following vulnerability has been resolved:

asix: fix uninit-value in asix_mdio_read()

asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.

Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)

In the Linux kernel, the following vulnerability has been resolved:

EDAC/thunderx: Fix possible out-of-bounds string access

Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():

drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE);

...

Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.

Change it to strlcat().

bp: Trim compiler output, fixup commit message.

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.(CVE-2023-52500)

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: assert requested protocol is valid

The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones.(CVE-2023-52507)

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: Fix a potential UAF in ca8210_probe

If of_clk_add_provider()…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

uio_hv_generic: Fix another memory leak in error handling paths

Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe function is never freed in the error handling path.

Add the missing 'vmbus_free_ring()' call.

Note that it is already freed in the .remove function.(CVE-2021-47070)

In the Linux kernel, the following vulnerability has been resolved:

asix: fix uninit-value in asix_mdio_read()

asix_read_cmd() may read less than sizeof(smsr) bytes and in this case smsr will be uninitialized.

Fail log: BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] BUG: KMSAN: uninit-value in asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 BUG: KMSAN: uninit-value in asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497 asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] asix_check_host_enable drivers/net/usb/asix_common.c:82 [inline] drivers/net/usb/asix_common.c:497 asix_mdio_read+0x3c1/0xb00 drivers/net/usb/asix_common.c:497 drivers/net/usb/asix_common.c:497(CVE-2021-47101)

In the Linux kernel, the following vulnerability has been resolved:

EDAC/thunderx: Fix possible out-of-bounds string access

Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():

drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr': drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ... 1145 | strncat(msg, other, OCX_MESSAGE_SIZE); ... 1150 | strncat(msg, other, OCX_MESSAGE_SIZE);

...

Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.

Change it to strlcat().

bp: Trim compiler output, fixup commit message.

In the Linux kernel, the following vulnerability has been resolved:

Input: powermate - fix use-after-free in powermate_config_complete

syzbot has found a use-after-free bug [1] in the powermate driver. This happens when the device is disconnected, which leads to a memory free from the powermate_device struct. When an asynchronous control message completes after the kfree and its callback is invoked, the lock does not exist anymore and hence the bug.

Use usb_kill_urb() on pm->config to cancel any in-progress requests upon device disconnection.

[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e(CVE-2023-52475)

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command

Tags allocated for OPC_INB_SET_CONTROLLER_CONFIG command need to be freed when we receive the response.(CVE-2023-52500)

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: assert requested protocol is valid

The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones.(CVE-2023-52507)

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: Fix a potential UAF in ca8210_probe

If of_clk_add_provider()…

In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the priv->lock while iterating the priv->multicast_list in ipoib_mcast_join_task() opens a window for ipoib_mcast_dev_flush() to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel): Task A (kworker/u72:2 below) | Task B (kworker/u72:0 below) -----------------------------------+----------------------------------- ipoib_mcast_join_task(work) | ipoib_ib_dev_flush_light(work) spin_lock_irq(&priv->lock) | __ipoib_ib_dev_flush(priv, ...) list_for_each_entry(mcast, | ipoib_mcast_dev_flush(dev = priv->dev) &priv->multicast_list, list) | ipoib_mcast_join(dev, mcast) | spin_unlock_irq(&priv->lock) | | spin_lock_irqsave(&priv->lock, flags) | list_for_each_entry_safe(mcast, tmcast, | &priv->multicast_list, list) | list_del(&mcast->list); | list_add_tail(&mcast->list, &remove_list) | spin_unlock_irqrestore(&priv->lock, flags) spin_lock_irq(&priv->lock) | | ipoib_mcast_remove_list(&remove_list) (Here, mcast is no longer on the | list_for_each_entry_safe(mcast, tmcast, priv->multicast_list and we keep | remove_list, list) spinning on the remove_list of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.) Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps. Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups. crash> bc 31 PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2" -- [exception RIP: ipoib_mcast_join_task+0x1b1] RIP: ffffffffc0944ac1 RSP: ff646f199a8c7e00 RFLAGS: 00000002 RAX: 0000000000000000 RBX: ff1c6a1a04dc82f8 RCX: 0000000000000000 work (&priv->mcast_task{,.work}) RDX: ff1c6a192d60ac68 RSI: 0000000000000286 RDI: ff1c6a1a04dc8000 &mcast->list RBP: ff646f199a8c7e90 R8: ff1c699980019420 R9: ff1c6a1920c9a000 R10: ff646f199a8c7e00 R11: ff1c6a191a7d9800 R12: ff1c6a192d60ac00 mcast R13: ff1c6a1d82200000 R14: ff1c6a1a04dc8000 R15: ff1c6a1a04dc82d8 dev priv (&priv->lock) &priv->multicast_list (aka head) ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 --- <NMI exception stack> --- #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib] #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967 crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty) crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000 crash> b 8 PID: 8 TASK: ff1c69998efec000 CPU: 33 COMMAND: "kworker/u72:0" -- #3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646 #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib] #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib] #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib] #7 [ff ---truncated---

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix possible use-after-free in smsc75xx_bind
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix memory leak in smsc75xx_bind
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url: https://ubuntu.com/security/CVE-2024-26720
  • mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
• CVE-url: https://ubuntu.com/security/CVE-2024-26825
  • nfc: nci: free rx_data_reassembly skb on NCI device cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-26671
  • blk-mq: fix IO hang from sbitmap wakeup race
• CVE-url: https://ubuntu.com/security/CVE-2024-26675
  • ppp_async: limit MRU to 64K
• CVE-url: https://ubuntu.com/security/CVE-2023-52602
  • jfs: fix slab-out-of-bounds Read in dtSearch
• CVE-url: https://ubuntu.com/security/CVE-2024-26704
  • ext4: fix double-free of blocks due to wrong extents moved_len
• CVE-url: https://ubuntu.com/security/CVE-2023-52619
  • linux/kernel.h: Add ALIGN_DOWN macro …

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix possible use-after-free in smsc75xx_bind
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix memory leak in smsc75xx_bind
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url: https://ubuntu.com/security/CVE-2024-26720
  • mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
• CVE-url: https://ubuntu.com/security/CVE-2024-26825
  • nfc: nci: free rx_data_reassembly skb on NCI device cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-26671
  • blk-mq: fix IO hang from sbitmap wakeup race
• CVE-url: https://ubuntu.com/security/CVE-2024-26675
  • ppp_async: limit MRU to 64K
• CVE-url: https://ubuntu.com/security/CVE-2023-52602
  • jfs: fix slab-out-of-bounds Read in dtSearch
• CVE-url: https://ubuntu.com/security/CVE-2024-26704
  • ext4: fix double-free of blocks due to wrong extents moved_len
• CVE-url: https://ubuntu.com/security/CVE-2023-52619
  • linux/kernel.h: Add ALIGN_DOWN macro …

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

[ Ubuntu: 4.15.0-228.239 ]

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() *…

In the Linux kernel, the following vulnerability has been resolved:

IB/ipoib: Fix mcast list locking

Releasing the priv->lock while iterating the priv->multicast_list in ipoib_mcast_join_task() opens a window for ipoib_mcast_dev_flush() to remove the items while in the middle of iteration. If the mcast is removed while the lock was dropped, the for loop spins forever resulting in a hard lockup (as was reported on RHEL 4.18.0-372.75.1.el8_6 kernel):

Task A (kworker/u72:2 below)       | Task B (kworker/u72:0 below)
-----------------------------------+-----------------------------------
ipoib_mcast_join_task(work)        | ipoib_ib_dev_flush_light(work)
  spin_lock_irq(&priv->lock)       | __ipoib_ib_dev_flush(priv, ...)
  list_for_each_entry(mcast,       | ipoib_mcast_dev_flush(dev = priv->dev)
      &priv->multicast_list, list) |
    ipoib_mcast_join(dev, mcast)   |
      spin_unlock_irq(&priv->lock) |
                                   |   spin_lock_irqsave(&priv->lock, flags)
                                   |   list_for_each_entry_safe(mcast, tmcast,
                                   |                  &priv->multicast_list, list)
                                   |     list_del(&mcast->list);
                                   |     list_add_tail(&mcast->list, &remove_list)
                                   |   spin_unlock_irqrestore(&priv->lock, flags)
      spin_lock_irq(&priv->lock)   |
                                   |   ipoib_mcast_remove_list(&remove_list)

(Here, mcast is no longer on the | list_for_each_entry_safe(mcast, tmcast, priv->multicast_list and we keep | remove_list, list) spinning on the remove_list of | >>> wait_for_completion(&mcast->done) the other thread which is blocked | and the list is still valid on | it's stack.)

Fix this by keeping the lock held and changing to GFP_ATOMIC to prevent eventual sleeps. Unfortunately we could not reproduce the lockup and confirm this fix but based on the code review I think this fix should address such lockups.

crash> bc 31 PID: 747 TASK: ff1c6a1a007e8000 CPU: 31 COMMAND: "kworker/u72:2"

[exception RIP: ipoib_mcast_join_task+0x1b1]
RIP: ffffffffc0944ac1  RSP: ff646f199a8c7e00  RFLAGS: 00000002
RAX: 0000000000000000  RBX: ff1c6a1a04dc82f8  RCX: 0000000000000000
                              work (&priv->mcast_task{,.work})
RDX: ff1c6a192d60ac68  RSI: 0000000000000286  RDI: ff1c6a1a04dc8000
       &mcast->list
RBP: ff646f199a8c7e90   R8: ff1c699980019420   R9: ff1c6a1920c9a000
R10: ff646f199a8c7e00  R11: ff1c6a191a7d9800  R12: ff1c6a192d60ac00
                                                     mcast
R13: ff1c6a1d82200000  R14: ff1c6a1a04dc8000  R15: ff1c6a1a04dc82d8
       dev                    priv (&priv->lock)     &priv->multicast_list (aka head)
ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018

--- <NMI exception stack> --- #5 [ff646f199a8c7e00] ipoib_mcast_join_task+0x1b1 at ffffffffc0944ac1 [ib_ipoib] #6 [ff646f199a8c7e98] process_one_work+0x1a7 at ffffffff9bf10967

crash> rx ff646f199a8c7e68 ff646f199a8c7e68: ff1c6a1a04dc82f8 <<< work = &priv->mcast_task.work

crash> list -hO ipoib_dev_priv.multicast_list ff1c6a1a04dc8000 (empty)

crash> ipoib_dev_priv.mcast_task.work.func,mcast_mutex.owner.counter ff1c6a1a04dc8000 mcast_task.work.func = 0xffffffffc0944910 <ipoib_mcast_join_task>, mcast_mutex.owner.counter = 0xff1c69998efec000

crash> b 8 PID: 8 TASK: ff1c69998efec000 CPU: 33 COMMAND: "kworker/u72:0"

#3 [ff646f1980153d50] wait_for_completion+0x96 at ffffffff9c7d7646 #4 [ff646f1980153d90] ipoib_mcast_remove_list+0x56 at ffffffffc0944dc6 [ib_ipoib] #5 [ff646f1980153de8] ipoib_mcast_dev_flush+0x1a7 at ffffffffc09455a7 [ib_ipoib] #6 [ff646f1980153e58] __ipoib_ib_dev_flush+0x1a4 at ffffffffc09431a4 [ib_ipoib] #7 [ff ---truncated---

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length…

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47113: Abort…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).
• CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).
• CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed double free of blk_mq_tag_set in dev remove after table load fails (bsc#1220554).
• CVE-2021-46939: Fixed possible hung in trace_clock_global() (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed possible data corruption in md/raid1 when ending a failed write request (bsc#1220662).
• CVE-2021-46958: Fixed race between transaction aborts and fsyncs that could lead to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed wrong error code from smb2_get_enc_key() (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed NULL pointer in flush_workqueue (bsc#1220611).
• CVE-2021-46988: Fixed possible crash in userfaultfd due to unreleased page (bsc#1220706).
• CVE-2021-46990: Fixed crashes when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed a use after free bug in enic_hard_start_xmit() (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed RX consumer index logic in the error path in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed resolved pte update for kernel memory on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed null pointer dereference in lpfc_prep_els_iocb() (bsc#1220640).
• CVE-2021-47049: Fixed Use after free in __vmbus_open() (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed uninitialized lock in adf_vf2pf_shutdown() (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed possible use-after-free in panel_bridge_detach() (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed bug on in ext4_es_cache_extent() as ext4_split_extent_at() failed (bsc#1221575).
• CVE-2021-47118: Fixed possible use-after-free when initializing cad_pid (bsc#1221605). -…

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize certain data structures before passing them to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-50431)

Murray McAllister discovered that the VMware Virtual GPU DRM driver in the Linux kernel did not properly handle memory objects when storing surfaces, leading to a use-after-free vulnerability. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5633)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2024-0340)

Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085)

Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Architecture specifics;
• Block layer;
• ACPI drivers;
• Android drivers;
• EDAC drivers;
• GPU drivers;
• InfiniBand drivers;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PHY drivers;
• PWM drivers;
• SCSI drivers;
• SPMI drivers;
• TTY drivers;
• Userspace I/O drivers;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• SMB network file system;
• BPF subsystem;
• Logical Link Layer;
• Netfilter;
• Unix domain sockets;
• AppArmor security module; (CVE-2024-26599, CVE-2023-52604, CVE-2023-52439, CVE-2024-26627, CVE-2024-26601, CVE-2024-26628, CVE-2023-52607, CVE-2023-52456, CVE-2023-52602, CVE-2023-52443, CVE-2023-52599, CVE-2023-52603, CVE-2024-26588, CVE-2024-26581, CVE-2023-52600, CVE-2024-26624, CVE-2023-52584, CVE-2024-26625, CVE-2023-52606, CVE-2023-52463, CVE-2023-52464, CVE-2023-52597, CVE-2023-52595, CVE-2023-52458, CVE-2023-52457, CVE-2023-52438, CVE-2023-52469, CVE-2023-52462, CVE-2024-26589, CVE-2024-26592, CVE-2024-26594, CVE-2023-52601, CVE-2023-52593, CVE-2023-52436, CVE-2023-52447, CVE-2023-52587, CVE-2023-52445,…

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• Block layer subsystem;
• Android drivers;
• Hardware random number generator core;
• GPU drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Pstore file system;
• Core kernel;
• Memory management;
• CAN network layer;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Realtek audio codecs; (CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615, CVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704, CVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435, CVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619, CVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486, CVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604, CVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671, CVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722, CVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623, CVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606, CVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615, CVE-2023-52595, CVE-2023-52607, CVE-2024-26636)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• Block layer subsystem;
• Android drivers;
• Hardware random number generator core;
• GPU drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Pstore file system;
• Core kernel;
• Memory management;
• CAN network layer;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Realtek audio codecs; (CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615, CVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704, CVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435, CVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619, CVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486, CVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604, CVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671, CVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722, CVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623, CVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606, CVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615, CVE-2023-52595, CVE-2023-52607, CVE-2024-26636)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Tomoyo security module;
• Realtek audio codecs; (CVE-2023-52616, CVE-2024-26679, CVE-2024-26608, CVE-2023-52594, CVE-2024-26622, CVE-2023-52643, CVE-2024-26594, CVE-2023-52598, CVE-2023-52627, CVE-2023-52491, CVE-2024-26592, CVE-2024-26717, CVE-2023-52638, CVE-2024-26704, CVE-2023-52637, CVE-2024-26645, CVE-2023-52602, CVE-2024-26722, CVE-2024-26671, CVE-2023-52599, CVE-2024-26720, CVE-2023-52631, CVE-2023-52486, CVE-2024-26640, CVE-2023-52606, CVE-2023-52633, CVE-2024-26593, CVE-2024-26664, CVE-2023-52618, CVE-2024-26625, CVE-2023-52604, CVE-2024-26695, CVE-2024-26644, CVE-2024-26826, CVE-2024-26600, CVE-2024-26808, CVE-2023-52619, CVE-2023-52597, CVE-2024-26602, CVE-2024-26635, CVE-2023-52623, CVE-2024-26665, CVE-2024-26916, CVE-2024-26689, CVE-2023-52635, CVE-2024-26712, CVE-2023-52614, CVE-2024-26606, CVE-2024-26610, CVE-2024-26675, CVE-2023-52617, CVE-2024-26697, CVE-2023-52595, CVE-2023-52494, CVE-2024-26641, CVE-2024-26698, CVE-2024-26707, CVE-2024-26673, CVE-2023-52493, CVE-2024-26676, CVE-2024-26910, CVE-2023-52601, CVE-2024-26660, CVE-2023-52608, CVE-2024-26615, CVE-2023-52587, CVE-2024-26825, CVE-2023-52498, CVE-2023-52492, CVE-2024-26668, CVE-2024-26715, CVE-2024-26685, CVE-2024-26702, CVE-2024-26663, CVE-2024-26636, CVE-2024-26627, CVE-2024-26696, CVE-2023-52583, CVE-2023-52642, CVE-2023-52489, CVE-2024-26614, CVE-2024-26829, CVE-2024-26684, CVE-2023-52615, CVE-2023-52435, CVE-2023-52530, CVE-2023-52607, CVE-2024-26920, CVE-2023-52622, CVE-2023-52588)

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52598, CVE-2023-52676, CVE-2023-52609, CVE-2024-26620, CVE-2023-52487, CVE-2023-52465, CVE-2023-52473, CVE-2023-52467, CVE-2024-26583, CVE-2023-52669, CVE-2023-52664, CVE-2023-52449, CVE-2023-52614, CVE-2024-26595, CVE-2023-52611, CVE-2023-52696, CVE-2023-52591, CVE-2023-52491, CVE-2024-35839, CVE-2023-52679, CVE-2024-26607, CVE-2023-52587, CVE-2023-52469, CVE-2023-52608, CVE-2023-52617, CVE-2023-52698, CVE-2024-26673, CVE-2024-35835, CVE-2024-26808, CVE-2024-26668, CVE-2023-52626, CVE-2023-52621, CVE-2024-35837, CVE-2023-52489, CVE-2023-52597, CVE-2024-26649, CVE-2024-26615, CVE-2024-35838, CVE-2023-52693, CVE-2023-52497, CVE-2024-35842, CVE-2024-26618, CVE-2024-26610, CVE-2024-26631, CVE-2024-26644, CVE-2024-26627, CVE-2023-52677, CVE-2023-52472, CVE-2023-52627, CVE-2023-52486, CVE-2023-52632, CVE-2023-52494, CVE-2023-52468, CVE-2024-26634, CVE-2023-52588, CVE-2024-26646, CVE-2024-26584, CVE-2023-52443, CVE-2023-52691, CVE-2024-26612, CVE-2023-52595, CVE-2024-26592, CVE-2024-26623, CVE-2023-52492, CVE-2024-26670, CVE-2023-52583, CVE-2023-52681, CVE-2023-52635, CVE-2023-52457,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…

Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service (system crash). (CVE-2023-6356, CVE-2023-6535, CVE-2023-6536)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• ACPI drivers;
• Android drivers;
• Drivers core;
• Power management core;
• Bus devices;
• Device frequency scaling framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• GPU drivers;
• IIO ADC drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PCI driver for MicroSemi Switchtec;
• Power supply drivers;
• RPMSG subsystem;
• SCSI drivers;
• QCOM SoC drivers;
• SPMI drivers;
• Thermal drivers;
• TTY drivers;
• VFIO drivers;
• BTRFS file system;
• Ceph distributed file system;
• EFI Variable file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• Network file systems library;
• Network file system server daemon;
• File systems infrastructure;
• Pstore file system;
• ReiserFS file system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• TLS protocol;
• Ethernet bridge;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NetLabel subsystem;
• Network traffic control;
• SMC sockets;
• Sun RPC protocol;
• AppArmor security module;
• Intel ASoC drivers;
• MediaTek ASoC drivers;
• USB sound devices; (CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618, CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454, CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586, CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622, CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606, CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623, CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839, CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617, CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598, CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676, CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625, CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618, CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678, CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649, CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667, CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666, CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593, CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493, CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587, CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696, CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470, CVE-2024-35838, CVE-2024-26645,…

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• MediaTek PM domains;
• Power supply drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system client;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Logical Link…