CVE-2023-52604

In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix wild memory access when clearing fragments

while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one:

KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ>

when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS.(CVE-2021-47014)

In the Linux kernel, the following vulnerability has been resolved:

udp: skip L4 aggregation for UDP tunnel packets

If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header.

That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc.

Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive.

The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets.

Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity.

v1 -> v2:

• hopefully clarify the commit message(CVE-2021-47036)

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix use after free on context disconnection

Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.(CVE-2023-52445)

In the Linux kernel, the following vulnerability has been resolved:

block: add check that partition length needs…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36778)

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36782)

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().(CVE-2021-46906)

In the Linux kernel, the following vulnerability has been resolved:

ARM: footbridge: fix PCI interrupt mapping

Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.(CVE-2021-46909)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Do core softreset when switch mode

According to the programming guide, to switch mode for DRD controller, the driver needs to do the following.

To switch from device to host:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(host mode)
3. Reset the host with USBCMD.HCRESET
4. Then follow up with the initializing host registers sequence

To switch from host to device:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(device mode)
3. Reset the device with DCTL.CSftRst
4. Then follow up with the initializing registers sequence

Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2].

So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device.

[1] https://lore.kernel.org/linux-usb/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/(CVE-2021-46941)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix stack OOB read while fragmenting IPv4 packets

running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367

CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36778)

In the Linux kernel, the following vulnerability has been resolved:

i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails

The PM reference count is not expected to be incremented on return in lpi2c_imx_master_enable.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.(CVE-2020-36782)

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().(CVE-2021-46906)

In the Linux kernel, the following vulnerability has been resolved:

ARM: footbridge: fix PCI interrupt mapping

Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.(CVE-2021-46909)

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: core: Do core softreset when switch mode

According to the programming guide, to switch mode for DRD controller, the driver needs to do the following.

To switch from device to host:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(host mode)
3. Reset the host with USBCMD.HCRESET
4. Then follow up with the initializing host registers sequence

To switch from host to device:

1. Reset controller with GCTL.CoreSoftReset
2. Set GCTL.PrtCapDir(device mode)
3. Reset the device with DCTL.CSftRst
4. Then follow up with the initializing registers sequence

Currently we're missing step 1) to do GCTL.CoreSoftReset and step 3) of switching from host to device. John Stult reported a lockup issue seen with HiKey960 platform without these steps[1]. Similar issue is observed with Ferry's testing platform[2].

So, apply the required steps along with some fixes to Yu Chen's and John Stultz's version. The main fixes to their versions are the missing wait for clocks synchronization before clearing GCTL.CoreSoftReset and only apply DCTL.CSftRst when switching from host to device.

[1] https://lore.kernel.org/linux-usb/[email protected]/ [2] https://lore.kernel.org/linux-usb/[email protected]/(CVE-2021-46941)

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: fix stack OOB read while fragmenting IPv4 packets

running openvswitch on kernels built with KASAN, it's possible to see the following splat while testing fragmentation of IPv4 packets:

BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60 Read of size 1 at addr ffff888112fc713c by task handler2/1367

CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix wild memory access when clearing fragments

while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one:

KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ>

when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS.(CVE-2021-47014)

In the Linux kernel, the following vulnerability has been resolved:

udp: skip L4 aggregation for UDP tunnel packets

If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header.

That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc.

Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive.

The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets.

Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity.

v1 -> v2:

• hopefully clarify the commit message(CVE-2021-47036)

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix use after free on context disconnection

Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.(CVE-2023-52445)

In the Linux kernel, the following vulnerability has been resolved:

block: add check that partition length needs…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix wild memory access when clearing fragments

while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one:

KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ>

when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS.(CVE-2021-47014)

In the Linux kernel, the following vulnerability has been resolved:

udp: skip L4 aggregation for UDP tunnel packets

If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header.

That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc.

Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive.

The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets.

Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity.

v1 -> v2:

• hopefully clarify the commit message(CVE-2021-47036)

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix use after free on context disconnection

Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.(CVE-2023-52445)

In the Linux kernel, the following vulnerability has been resolved:

block: add check that partition length needs…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: fix wild memory access when clearing fragments

while testing re-assembly/re-fragmentation using act_ct, it's possible to observe a crash like the following one:

KASAN: maybe wild-memory-access in range [0x0001000000000448-0x000100000000044f] CPU: 50 PID: 0 Comm: swapper/50 Tainted: G S 5.12.0-rc7+ #424 Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:inet_frag_rbtree_purge+0x50/0xc0 Code: 00 fc ff df 48 89 c3 31 ed 48 89 df e8 a9 7a 38 ff 4c 89 fe 48 89 df 49 89 c6 e8 5b 3a 38 ff 48 8d 7b 40 48 89 f8 48 c1 e8 03 <42> 80 3c 20 00 75 59 48 8d bb d0 00 00 00 4c 8b 6b 40 48 89 f8 48 RSP: 0018:ffff888c31449db8 EFLAGS: 00010203 RAX: 0000200000000089 RBX: 000100000000040e RCX: ffffffff989eb960 RDX: 0000000000000140 RSI: ffffffff97cfb977 RDI: 000100000000044e RBP: 0000000000000900 R08: 0000000000000000 R09: ffffed1186289350 R10: 0000000000000003 R11: ffffed1186289350 R12: dffffc0000000000 R13: 000100000000040e R14: 0000000000000000 R15: ffff888155e02160 FS: 0000000000000000(0000) GS:ffff888c31440000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005600cb70a5b8 CR3: 0000000a2c014005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> inet_frag_destroy+0xa9/0x150 call_timer_fn+0x2d/0x180 run_timer_softirq+0x4fe/0xe70 __do_softirq+0x197/0x5a0 irq_exit_rcu+0x1de/0x200 sysvec_apic_timer_interrupt+0x6b/0x80 </IRQ>

when act_ct temporarily stores an IP fragment, restoring the skb qdisc cb results in putting random data in FRAG_CB(), and this causes those "wild" memory accesses later, when the rbtree is purged. Never overwrite the skb cb in case tcf_ct_handle_fragments() returns -EINPROGRESS.(CVE-2021-47014)

In the Linux kernel, the following vulnerability has been resolved:

udp: skip L4 aggregation for UDP tunnel packets

If NETIF_F_GRO_FRAGLIST or NETIF_F_GRO_UDP_FWD are enabled, and there are UDP tunnels available in the system, udp_gro_receive() could end-up doing L4 aggregation (either SKB_GSO_UDP_L4 or SKB_GSO_FRAGLIST) at the outer UDP tunnel level for packets effectively carrying and UDP tunnel header.

That could cause inner protocol corruption. If e.g. the relevant packets carry a vxlan header, different vxlan ids will be ignored/ aggregated to the same GSO packet. Inner headers will be ignored, too, so that e.g. TCP over vxlan push packets will be held in the GRO engine till the next flush, etc.

Just skip the SKB_GSO_UDP_L4 and SKB_GSO_FRAGLIST code path if the current packet could land in a UDP tunnel, and let udp_gro_receive() do GRO via udp_sk(sk)->gro_receive.

The check implemented in this patch is broader than what is strictly needed, as the existing UDP tunnel could be e.g. configured on top of a different device: we could end-up skipping GRO at-all for some packets.

Anyhow, that is a very thin corner case and covering it will add quite a bit of complexity.

v1 -> v2:

• hopefully clarify the commit message(CVE-2021-47036)

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix use after free on context disconnection

Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.(CVE-2023-52445)

In the Linux kernel, the following vulnerability has been resolved:

block: add check that partition length needs…

In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type 's8[1365]' (aka 'signed char[1365]') CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> ================================================================================ Kernel panic - not syncing: UBSAN: panic_on_warn set ... CPU: 1 PID: 109 Comm: jfsCommit Not tainted 6.6.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 panic+0x30f/0x770 kernel/panic.c:340 check_panic_on_warn+0x82/0xa0 kernel/panic.c:236 ubsan_epilogue lib/ubsan.c:223 [inline] __ubsan_handle_out_of_bounds+0x13c/0x150 lib/ubsan.c:348 dbAdjTree+0x474/0x4f0 fs/jfs/jfs_dmap.c:2867 dbJoin+0x210/0x2d0 fs/jfs/jfs_dmap.c:2834 dbFreeBits+0x4eb/0xda0 fs/jfs/jfs_dmap.c:2331 dbFreeDmap fs/jfs/jfs_dmap.c:2080 [inline] dbFree+0x343/0x650 fs/jfs/jfs_dmap.c:402 txFreeMap+0x798/0xd50 fs/jfs/jfs_txnmgr.c:2534 txUpdateMap+0x342/0x9e0 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline] jfs_lazycommit+0x47a/0xb70 fs/jfs/jfs_txnmgr.c:2732 kthread+0x2d3/0x370 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304 </TASK> Kernel Offset: disabled Rebooting in 86400 seconds.. The issue is caused when the value of lp becomes greater than CTLTREESIZE which is the max size of stree. Adding a simple check solves this issue. Dave: As the function returns a void, good error handling would require a more intrusive code reorganization, so I modified Osama's patch at use WARN_ON_ONCE for lack of a cleaner option. The patch is tested via syzbot.

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix possible use-after-free in smsc75xx_bind
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix memory leak in smsc75xx_bind
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url: https://ubuntu.com/security/CVE-2024-26720
  • mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
• CVE-url: https://ubuntu.com/security/CVE-2024-26825
  • nfc: nci: free rx_data_reassembly skb on NCI device cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-26671
  • blk-mq: fix IO hang from sbitmap wakeup race
• CVE-url: https://ubuntu.com/security/CVE-2024-26675
  • ppp_async: limit MRU to 64K
• CVE-url: https://ubuntu.com/security/CVE-2023-52602
  • jfs: fix slab-out-of-bounds Read in dtSearch
• CVE-url: https://ubuntu.com/security/CVE-2024-26704
  • ext4: fix double-free of blocks due to wrong extents moved_len
• CVE-url: https://ubuntu.com/security/CVE-2023-52619
  • linux/kernel.h: Add ALIGN_DOWN macro …

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• Bionic update: upstream stable patchset 2021-07-14 (LP: #1936231) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix possible use-after-free in smsc75xx_bind
• Bionic update: upstream stable patchset 2021-06-11 (LP: #1931740) // CVE- url: https://ubuntu.com/security/CVE-2021-47171
  • net: usb: fix memory leak in smsc75xx_bind
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url: https://ubuntu.com/security/CVE-2024-26720
  • mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again
• CVE-url: https://ubuntu.com/security/CVE-2024-26825
  • nfc: nci: free rx_data_reassembly skb on NCI device cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-26671
  • blk-mq: fix IO hang from sbitmap wakeup race
• CVE-url: https://ubuntu.com/security/CVE-2024-26675
  • ppp_async: limit MRU to 64K
• CVE-url: https://ubuntu.com/security/CVE-2023-52602
  • jfs: fix slab-out-of-bounds Read in dtSearch
• CVE-url: https://ubuntu.com/security/CVE-2024-26704
  • ext4: fix double-free of blocks due to wrong extents moved_len
• CVE-url: https://ubuntu.com/security/CVE-2023-52619
  • linux/kernel.h: Add ALIGN_DOWN macro …

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
• CVE-url:…

[ Ubuntu: 4.15.0-228.239 ]

• CVE-url: https://ubuntu.com/security/CVE-2023-47233
  • wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
• CVE-url: https://ubuntu.com/security/CVE-2023-52601
  • jfs: Fix memleak in dbAdjCtl
• CVE-url: https://ubuntu.com/security/CVE-2024-26801
  • Bluetooth: Avoid potential use-after-free in hci_error_reset
• CVE-url: https://ubuntu.com/security/CVE-2024-26805
  • netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
• CVE-url: https://ubuntu.com/security/CVE-2024-26735
  • ipv6: sr: fix possible use-after-free and null-ptr-deref
• CVE-url: https://ubuntu.com/security/CVE-2023-52566
  • nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
• CVE-url: https://ubuntu.com/security/CVE-2021-46981
  • nbd: Fix NULL pointer in flush_workqueue
• CVE-url: https://ubuntu.com/security/CVE-2024-26622
  • tomoyo: fix UAF write bug in tomoyo_write_control()
• CVE-url: https://ubuntu.com/security/CVE-2024-26614
  • tcp: make sure init the accept_queue's spinlocks once
  • ipv6: init the accept_queue's spinlocks in inet6_create
• CVE-url: https://ubuntu.com/security/CVE-2023-52530
  • wifi: mac80211: fix potential key use-after-free
• CVE-url: https://ubuntu.com/security/CVE-2023-52524
  • net: nfc: llcp: Add lock when modifying device list
• CVE-url: https://ubuntu.com/security/CVE-2021-47173
  • misc/uss720: fix memory leak in uss720_probe
• CVE-url: https://ubuntu.com/security/CVE-2024-26910
  • timers: Get rid of del_singleshot_timer_sync()
  • timers: Update kernel-doc for various functions
  • timers: Use del_timer_sync() even on UP
  • timers: Rename del_timer_sync() to timer_delete_sync()
  • timers: Rename del_timer() to timer_delete()
  • timers: Silently ignore timers with a NULL function
  • timers: Split [try_to_]del_timer_sync to prepare for shutdown mode
  • timers: Add shutdown mechanism to the internal functions
  • timers: Provide timer_shutdown_sync
  • netfilter: ipset: fix performance regression in swap operation
• CVE-url: https://ubuntu.com/security/CVE-2023-52595
  • rt2x00: clear IV's on start to fix AP mode regression
  • wifi: rt2x00: restart beacon queue when hardware reset
• CVE-url: https://ubuntu.com/security/CVE-2023-52617
  • switchtec: Improve MRPC efficiency by enabling write combining
  • switchtec: Add MRPC DMA mode support
  • PCI: switchtec: Fix stdev_release() crash after surprise hot remove
• CVE-url: https://ubuntu.com/security/CVE-2024-26696
  • nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
• CVE-url: https://ubuntu.com/security/CVE-2024-26685
  • nilfs2: fix potential bug in end_buffer_async_write
• CVE-url: https://ubuntu.com/security/CVE-2024-26625
  • llc: call sock_orphan() at release time
• CVE-url: https://ubuntu.com/security/CVE-2023-52615
  • hwrng: core - Fix page fault dead lock on mmap-ed hwrng
• CVE-url: https://ubuntu.com/security/CVE-2023-52486
  • drm: Don't unref the same fb many times by mistake due to deadlock handling
• CVE-url: https://ubuntu.com/security/CVE-2024-26920
  • tracing/trigger: Fix to return error if failed to alloc snapshot
• CVE-url: https://ubuntu.com/security/CVE-2024-26697
  • nilfs2: fix data corruption in dsync block recovery for small block sizes
• CVE-url: https://ubuntu.com/security/CVE-2024-26679
  • inet: read sk->sk_family once in inet_recv_error()
• CVE-url: https://ubuntu.com/security/CVE-2023-52622
  • ext4: remove unnecessary check from alloc_flex_gd()
  • ext4: avoid online resizing failures due to oversized flex bg
• CVE-url: https://ubuntu.com/security/CVE-2024-26635
  • llc: Drop support for ETH_P_TR_802_2.
• CVE-url: https://ubuntu.com/security/CVE-2023-52594
  • wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() *…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

NOTE: This update has been retracted due to a bug in the BHI CPU sidechannel mitigation, which led to incorrect selection of other CPU mitigations.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46934: Fixed a bug by validating user data in compat ioctl (bsc#1220469).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47083: Fixed a global-out-of-bounds issue in mediatek: (bsc#1220917).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48627: Fixed a memory overlapping when deleting chars in the buffer (bsc#1220845).
• CVE-2022-48628: Fixed possible lock in ceph (bsc#1220848).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length (bsc#1220320).
• CVE-2023-52462: Fixed check for attempt to corrupt spilled pointer (bsc#1220325).
• CVE-2023-52463: Fixed null pointer dereference in efivarfs (bsc#1220328).
• CVE-2023-52467: Fixed a null pointer dereference in of_syscon_register…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
• CVE-2021-46926: Fixed bug when detecting controllers in ALSA/hda/intel-sdw-acpi (bsc#1220478).
• CVE-2021-46927: Fixed assertion bug in nitro_enclaves: Use get_user_pages_unlocked() (bsc#1220443).
• CVE-2021-46929: Fixed use-after-free issue in sctp_sock_dump() (bsc#1220482).
• CVE-2021-46930: Fixed usb/mtu3 list_head check warning (bsc#1220484).
• CVE-2021-46931: Fixed wrong type casting in mlx5e_tx_reporter_dump_sq() (bsc#1220486).
• CVE-2021-46933: Fixed possible underflow in ffs_data_clear() (bsc#1220487).
• CVE-2021-46936: Fixed use-after-free in tw_timer_handler() (bsc#1220439).
• CVE-2021-47082: Fixed ouble free in tun_free_netdev() (bsc#1220969).
• CVE-2021-47087: Fixed incorrect page free bug in tee/optee (bsc#1220954).
• CVE-2021-47091: Fixed locking in ieee80211_start_ap()) error path (bsc#1220959).
• CVE-2021-47093: Fixed memleak on registration failure in intel_pmc_core (bsc#1220978).
• CVE-2021-47094: Fixed possible memory leak in KVM x86/mmu (bsc#1221551).
• CVE-2021-47095: Fixed missing initialization in ipmi/ssif (bsc#1220979).
• CVE-2021-47096: Fixed uninitalized user_pversion in ALSA rawmidi (bsc#1220981).
• CVE-2021-47097: Fixed stack out of bound access in elantech_change_report_id() (bsc#1220982).
• CVE-2021-47098: Fixed integer overflow/underflow in hysteresis calculations hwmon: (lm90) (bsc#1220983).
• CVE-2021-47099: Fixed BUG_ON assertion in veth when skb entering GRO are cloned (bsc#1220955).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47102: Fixed incorrect structure access In line: upper = info->upper_dev in net/marvell/prestera (bsc#1221009).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47105: Fixed potential memory leak in ice/xsk (bsc#1220961).
• CVE-2021-47107: Fixed READDIR buffer overflow in NFSD (bsc#1220965).
• CVE-2021-47108: Fixed possible NULL pointer dereference for mtk_hdmi_conf in drm/mediatek (bsc#1220986).
• CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource() (bsc#1222660).
• CVE-2021-47182: Fixed buffer length handling in scsi_mode_sense() in scsi core (bsc#1222662).
• CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).
• CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).
• CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).
• CVE-2022-4744: Fixed double-free that could lead to DoS or privilege escalation in TUN/TAP device driver functionality (bsc#1209635).
• CVE-2022-48626: Fixed a potential use-after-free on remove path moxart (bsc#1220366).
• CVE-2022-48629: Fixed possible memory leak in qcom-rng (bsc#1220989).
• CVE-2022-48630: Fixed infinite loop on requests not multiple of WORD_SZ in crypto: qcom-rng (bsc#1220990).
• CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).
• CVE-2023-28746: Fixed Register File Data Sampling (bsc#1213456).
• CVE-2023-35827: Fixed a use-after-free issue in ravb_tx_timeout_work() (bsc#1212514).
• CVE-2023-4881: Fixed a out-of-bounds write flaw in the netfilter subsystem that could lead to potential information disclosure or a denial of service (bsc#1215221).
• CVE-2023-52447: Fixed map_fd_put_ptr() signature kABI workaround (bsc#1220251).
• CVE-2023-52450: Fixed NULL pointer dereference issue in upi_fill_topology() (bsc#1220237).
• CVE-2023-52453: Fixed data corruption in hisi_acc_vfio_pci (bsc#1220337).
• CVE-2023-52454: Fixed a kernel panic when host sends an invalid H2C PDU length…

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service (host domain crash). (CVE-2023-46838)

It was discovered that the Habana's AI Processors driver in the Linux kernel did not properly initialize certain data structures before passing them to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2023-50431)

Murray McAllister discovered that the VMware Virtual GPU DRM driver in the Linux kernel did not properly handle memory objects when storing surfaces, leading to a use-after-free vulnerability. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-5633)

It was discovered that the CIFS network file system implementation in the Linux kernel did not properly validate certain SMB messages, leading to an out-of-bounds read vulnerability. An attacker could use this to cause a denial of service (system crash) or possibly expose sensitive information. (CVE-2023-6610)

It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2024-0340)

Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085)

Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel, leading to a null pointer dereference vulnerability. A privileged local attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-24860)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Architecture specifics;
• Block layer;
• ACPI drivers;
• Android drivers;
• EDAC drivers;
• GPU drivers;
• InfiniBand drivers;
• Media drivers;
• Multifunction device drivers;
• MTD block device drivers;
• Network drivers;
• NVME drivers;
• PHY drivers;
• PWM drivers;
• SCSI drivers;
• SPMI drivers;
• TTY drivers;
• Userspace I/O drivers;
• Ceph distributed file system;
• EFI Variable file system;
• Ext4 file system;
• F2FS file system;
• GFS2 file system;
• JFS file system;
• SMB network file system;
• BPF subsystem;
• Logical Link Layer;
• Netfilter;
• Unix domain sockets;
• AppArmor security module; (CVE-2024-26599, CVE-2023-52604, CVE-2023-52439, CVE-2024-26627, CVE-2024-26601, CVE-2024-26628, CVE-2023-52607, CVE-2023-52456, CVE-2023-52602, CVE-2023-52443, CVE-2023-52599, CVE-2023-52603, CVE-2024-26588, CVE-2024-26581, CVE-2023-52600, CVE-2024-26624, CVE-2023-52584, CVE-2024-26625, CVE-2023-52606, CVE-2023-52463, CVE-2023-52464, CVE-2023-52597, CVE-2023-52595, CVE-2023-52458, CVE-2023-52457, CVE-2023-52438, CVE-2023-52469, CVE-2023-52462, CVE-2024-26589, CVE-2024-26592, CVE-2024-26594, CVE-2023-52601, CVE-2023-52593, CVE-2023-52436, CVE-2023-52447, CVE-2023-52587, CVE-2023-52445,…

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Realtek audio codecs; (CVE-2023-52594, CVE-2023-52601, CVE-2024-26826, CVE-2023-52622, CVE-2024-26665, CVE-2023-52493, CVE-2023-52633, CVE-2024-26684, CVE-2024-26663, CVE-2023-52618, CVE-2023-52588, CVE-2023-52637, CVE-2024-26825, CVE-2023-52606, CVE-2024-26594, CVE-2024-26625, CVE-2024-26720, CVE-2024-26614, CVE-2023-52627, CVE-2023-52602, CVE-2024-26673, CVE-2024-26685, CVE-2023-52638, CVE-2023-52498, CVE-2023-52619, CVE-2024-26910, CVE-2024-26689, CVE-2023-52583, CVE-2024-26676, CVE-2024-26671, CVE-2024-26704, CVE-2024-26608, CVE-2024-26610, CVE-2024-26592, CVE-2023-52599, CVE-2023-52595, CVE-2024-26660, CVE-2023-52617, CVE-2024-26645, CVE-2023-52486, CVE-2023-52631, CVE-2023-52607, CVE-2023-52608, CVE-2024-26722, CVE-2024-26615, CVE-2023-52615, CVE-2024-26636, CVE-2023-52642, CVE-2023-52587, CVE-2024-26712, CVE-2024-26675, CVE-2023-52614, CVE-2024-26606, CVE-2024-26916, CVE-2024-26600, CVE-2024-26679, CVE-2024-26829, CVE-2024-26641, CVE-2023-52623, CVE-2024-26627, CVE-2024-26696, CVE-2024-26640, CVE-2024-26635, CVE-2023-52491, CVE-2024-26664, CVE-2024-26602, CVE-2023-52604, CVE-2024-26717, CVE-2023-52643, CVE-2024-26593, CVE-2023-52598, CVE-2024-26668, CVE-2023-52435, CVE-2023-52597, CVE-2024-26715, CVE-2024-26707, CVE-2023-52635, CVE-2024-26695, CVE-2024-26698, CVE-2023-52494, CVE-2024-26920, CVE-2024-26808, CVE-2023-52616, CVE-2023-52492, CVE-2024-26702, CVE-2024-26644, CVE-2023-52489, CVE-2024-26697)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• Block layer subsystem;
• Android drivers;
• Hardware random number generator core;
• GPU drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Pstore file system;
• Core kernel;
• Memory management;
• CAN network layer;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Realtek audio codecs; (CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615, CVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704, CVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435, CVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619, CVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486, CVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604, CVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671, CVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722, CVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623, CVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606, CVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615, CVE-2023-52595, CVE-2023-52607, CVE-2024-26636)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM64 architecture;
• PowerPC architecture;
• S390 architecture;
• Block layer subsystem;
• Android drivers;
• Hardware random number generator core;
• GPU drivers;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Pstore file system;
• Core kernel;
• Memory management;
• CAN network layer;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Realtek audio codecs; (CVE-2024-26696, CVE-2023-52583, CVE-2024-26720, CVE-2023-52615, CVE-2023-52599, CVE-2023-52587, CVE-2024-26635, CVE-2024-26704, CVE-2024-26625, CVE-2024-26825, CVE-2023-52622, CVE-2023-52435, CVE-2023-52617, CVE-2023-52598, CVE-2024-26645, CVE-2023-52619, CVE-2024-26593, CVE-2024-26685, CVE-2023-52602, CVE-2023-52486, CVE-2024-26697, CVE-2024-26675, CVE-2024-26600, CVE-2023-52604, CVE-2024-26664, CVE-2024-26606, CVE-2023-52594, CVE-2024-26671, CVE-2024-26598, CVE-2024-26673, CVE-2024-26920, CVE-2024-26722, CVE-2023-52601, CVE-2024-26602, CVE-2023-52637, CVE-2023-52623, CVE-2024-26702, CVE-2023-52597, CVE-2024-26684, CVE-2023-52606, CVE-2024-26679, CVE-2024-26663, CVE-2024-26910, CVE-2024-26615, CVE-2023-52595, CVE-2023-52607, CVE-2024-26636)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Hardware random number generator core;
• Ext4 file system;
• JFS file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• Netlink;
• Tomoyo security module; (CVE-2024-26704, CVE-2023-52615, CVE-2024-26805, CVE-2023-52604, CVE-2024-26614, CVE-2023-52602, CVE-2024-26635, CVE-2024-26622, CVE-2023-52601, CVE-2024-26801)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Block layer subsystem;
• Userspace I/O drivers;
• Ceph distributed file system;
• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52524, CVE-2023-52530, CVE-2023-52601, CVE-2023-52439, CVE-2024-26635, CVE-2023-52602, CVE-2024-26614, CVE-2024-26704, CVE-2023-52604, CVE-2023-52566, CVE-2021-46981, CVE-2024-26622, CVE-2024-26735, CVE-2024-26805, CVE-2024-26801, CVE-2023-52583)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Ext4 file system;
• JFS file system;
• NILFS2 file system;
• Core kernel;
• Bluetooth subsystem;
• Networking core;
• IPv4 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Netlink;
• NFC subsystem;
• Tomoyo security module; (CVE-2023-52601, CVE-2024-26622, CVE-2024-26805, CVE-2024-26635, CVE-2023-52602, CVE-2024-26801, CVE-2023-52566, CVE-2024-26704, CVE-2021-46939, CVE-2024-26614, CVE-2023-52604, CVE-2023-52530, CVE-2023-52524)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• PowerPC architecture;
• S390 architecture;
• Core kernel;
• Block layer subsystem;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Cryptographic API;
• Device frequency;
• DMA engine subsystem;
• ARM SCMI message protocol;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Media drivers;
• Network drivers;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• SCSI drivers;
• DesignWare USB3 driver;
• BTRFS file system;
• Ceph distributed file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• SMB network file system;
• Memory management;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• Logical Link layer;
• MAC80211 subsystem;
• Multipath TCP;
• Netfilter;
• NFC subsystem;
• SMC sockets;
• Sun RPC protocol;
• TIPC protocol;
• Unix domain sockets;
• Tomoyo security module;
• Realtek audio codecs; (CVE-2023-52616, CVE-2024-26679, CVE-2024-26608, CVE-2023-52594, CVE-2024-26622, CVE-2023-52643, CVE-2024-26594, CVE-2023-52598, CVE-2023-52627, CVE-2023-52491, CVE-2024-26592, CVE-2024-26717, CVE-2023-52638, CVE-2024-26704, CVE-2023-52637, CVE-2024-26645, CVE-2023-52602, CVE-2024-26722, CVE-2024-26671, CVE-2023-52599, CVE-2024-26720, CVE-2023-52631, CVE-2023-52486, CVE-2024-26640, CVE-2023-52606, CVE-2023-52633, CVE-2024-26593, CVE-2024-26664, CVE-2023-52618, CVE-2024-26625, CVE-2023-52604, CVE-2024-26695, CVE-2024-26644, CVE-2024-26826, CVE-2024-26600, CVE-2024-26808, CVE-2023-52619, CVE-2023-52597, CVE-2024-26602, CVE-2024-26635, CVE-2023-52623, CVE-2024-26665, CVE-2024-26916, CVE-2024-26689, CVE-2023-52635, CVE-2024-26712, CVE-2023-52614, CVE-2024-26606, CVE-2024-26610, CVE-2024-26675, CVE-2023-52617, CVE-2024-26697, CVE-2023-52595, CVE-2023-52494, CVE-2024-26641, CVE-2024-26698, CVE-2024-26707, CVE-2024-26673, CVE-2023-52493, CVE-2024-26676, CVE-2024-26910, CVE-2023-52601, CVE-2024-26660, CVE-2023-52608, CVE-2024-26615, CVE-2023-52587, CVE-2024-26825, CVE-2023-52498, CVE-2023-52492, CVE-2024-26668, CVE-2024-26715, CVE-2024-26685, CVE-2024-26702, CVE-2024-26663, CVE-2024-26636, CVE-2024-26627, CVE-2024-26696, CVE-2023-52583, CVE-2023-52642, CVE-2023-52489, CVE-2024-26614, CVE-2024-26829, CVE-2024-26684, CVE-2023-52615, CVE-2023-52435, CVE-2023-52530, CVE-2023-52607, CVE-2024-26920, CVE-2023-52622, CVE-2023-52588)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• MediaTek PM domains;
• Power supply drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system client;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Logical Link…