CVE-2024-27074

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Disable kvmclock on all CPUs on shutdown

Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate.

Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource.(CVE-2021-47110)

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix NULL ptr dereference on VSI filter sync

Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops.(CVE-2021-47184)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix pcluster use-after-free on UP platforms

During stress testing with CONFIG_SMP disabled, KASAN reports as below:

================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789

CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389

Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90

The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing.

Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.(CVE-2022-48674)

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - Fix page fault dead lock on mmap-ed hwrng

There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /dev/hwrng. The resulting page fault triggers a recursive read which then dead-locks.

Fix this by using a stack buffer when calling copy_to_user.(CVE-2023-52615)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: disallow timeout for anonymous sets

Never used from userspace, disallow these parameters.(CVE-2023-52620)

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix a suspicious RCU usage warning

I received the following warning while running cthon against an ontap server running pNFS:

[ 57.202521] ============================= [ 57.202522] WARNING: suspicious RCU usage [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted [ 57.202525] ----------------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!! [ 57.202527] other info that might help us debug this:

[ 57.202528] …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

tun: avoid double free in tun_free_netdev

Avoid double free in tun_free_netdev() by moving the dev->tstats and tun->security allocs to a new ndo_init routine (tun_net_init()) that will be called by register_netdevice(). ndo_init is paired with the desctructor (tun_free_netdev()), so if there's an error in register_netdevice() the destructor will handle the frees.

BUG: KASAN: double-free or invalid-free in selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605

CPU: 0 PID: 25750 Comm: syz-executor416 Not tainted 5.16.0-rc2-syzk #1 Hardware name: Red Hat KVM, BIOS Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x89/0xb5 lib/dump_stack.c:106 print_address_description.constprop.9+0x28/0x160 mm/kasan/report.c:247 kasan_report_invalid_free+0x55/0x80 mm/kasan/report.c:372 ____kasan_slab_free mm/kasan/common.c:346 [inline] __kasan_slab_free+0x107/0x120 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1723 [inline] slab_free_freelist_hook mm/slub.c:1749 [inline] slab_free mm/slub.c:3513 [inline] kfree+0xac/0x2d0 mm/slub.c:4561 selinux_tun_dev_free_security+0x1a/0x20 security/selinux/hooks.c:5605 security_tun_dev_free_security+0x4f/0x90 security/security.c:2342 tun_free_netdev+0xe6/0x150 drivers/net/tun.c:2215 netdev_run_todo+0x4df/0x840 net/core/dev.c:10627 rtnl_unlock+0x13/0x20 net/core/rtnetlink.c:112 __tun_chr_ioctl+0x80c/0x2870 drivers/net/tun.c:3302 tun_chr_ioctl+0x2f/0x40 drivers/net/tun.c:3311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __x64_sys_ioctl+0x19d/0x220 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3a/0x80 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae(CVE-2021-47082)

In the Linux kernel, the following vulnerability has been resolved:

x86/kvm: Disable kvmclock on all CPUs on shutdown

Currenly, we disable kvmclock from machine_shutdown() hook and this only happens for boot CPU. We need to disable it for all CPUs to guard against memory corruption e.g. on restore from hibernate.

Note, writing '0' to kvmclock MSR doesn't clear memory location, it just prevents hypervisor from updating the location so for the short while after write and while CPU is still alive, the clock remains usable and correct so we don't need to switch to some other clocksource.(CVE-2021-47110)

In the Linux kernel, the following vulnerability has been resolved:

i40e: Fix NULL ptr dereference on VSI filter sync

Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops.(CVE-2021-47184)

In the Linux kernel, the following vulnerability has been resolved:

erofs: fix pcluster use-after-free on UP platforms

During stress testing with CONFIG_SMP disabled, KASAN reports as below:

================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789

CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389

Last potentially related work creation: …

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Use separate handlers for interrupts

For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data.(CVE-2024-27030)

In the Linux kernel, the following vulnerability has been resolved:

media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain:

saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go)

go is freed and thus bounce is leaked.(CVE-2024-27074)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: use timestamp to check for set element timeout

Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area.

Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished.

.lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue.(CVE-2024-27397)

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: Fix kernel panic caused by incorrect error handling

The error path while failing to register devices on the TEE bus has a bug leading to kernel panic as follows:

[ 15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c [ 15.406913] Mem abort info: [ 15.409722] ESR = 0x0000000096000005 [ 15.413490] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.418814] SET = 0, FnV = 0 [ 15.421878] EA = 0, S1PTW = 0 [ 15.425031] FSC = 0x05: level 1 translation fault [ 15.429922] Data abort info: [ 15.432813] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 15.438310] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 15.443372] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000 [ 15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000 [ 15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") lead to the introduction of this bug. So fix it appropriately.(CVE-2024-35785)

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: fix a memleak in lima_heap_alloc

When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks.(CVE-2024-35829)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: extend minimum interval restriction to entire cycle too

It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the taprio UAPI permits a cycle-time different from (and potentially shorter than) the sum of entry intervals.

We need one more restriction, which is that the cycle time itself must be larger than N * ETH_ZLEN bit times, where N is the number of schedule entries. This restriction needs to apply regardless of whether the cycle time came from the user or was the implicit, auto-calculated value, so we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)" branch. This way covers both conditions and scenarios.

Add a selftest which illustrates the issue triggered by syzbot.(CVE-2024-36244)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Use separate handlers for interrupts

For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data.(CVE-2024-27030)

In the Linux kernel, the following vulnerability has been resolved:

media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain:

saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go)

go is freed and thus bounce is leaked.(CVE-2024-27074)

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: use timestamp to check for set element timeout

Add a timestamp field at the beginning of the transaction, store it in the nftables per-netns area.

Update set backend .insert, .deactivate and sync gc path to use the timestamp, this avoids that an element expires while control plane transaction is still unfinished.

.lookup and .update, which are used from packet path, still use the current time to check if the element has expired. And .get path and dump also since this runs lockless under rcu read size lock. Then, there is async gc which also needs to check the current time since it runs asynchronously from a workqueue.(CVE-2024-27397)

In the Linux kernel, the following vulnerability has been resolved:

tee: optee: Fix kernel panic caused by incorrect error handling

The error path while failing to register devices on the TEE bus has a bug leading to kernel panic as follows:

[ 15.398930] Unable to handle kernel paging request at virtual address ffff07ed00626d7c [ 15.406913] Mem abort info: [ 15.409722] ESR = 0x0000000096000005 [ 15.413490] EC = 0x25: DABT (current EL), IL = 32 bits [ 15.418814] SET = 0, FnV = 0 [ 15.421878] EA = 0, S1PTW = 0 [ 15.425031] FSC = 0x05: level 1 translation fault [ 15.429922] Data abort info: [ 15.432813] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 15.438310] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 15.443372] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 15.448697] swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000d9e3e000 [ 15.455413] [ffff07ed00626d7c] pgd=1800000bffdf9003, p4d=1800000bffdf9003, pud=0000000000000000 [ 15.464146] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP

Commit 7269cba53d90 ("tee: optee: Fix supplicant based device enumeration") lead to the introduction of this bug. So fix it appropriately.(CVE-2024-35785)

In the Linux kernel, the following vulnerability has been resolved:

drm/lima: fix a memleak in lima_heap_alloc

When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks.(CVE-2024-35829)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: taprio: extend minimum interval restriction to entire cycle too

It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the taprio UAPI permits a cycle-time different from (and potentially shorter than) the sum of entry intervals.

We need one more restriction, which is that the cycle time itself must be larger than N * ETH_ZLEN bit times, where N is the number of schedule entries. This restriction needs to apply regardless of whether the cycle time came from the user or was the implicit, auto-calculated value, so we move the existing "cycle == 0" check outside the "if "(!new->cycle_time)" branch. This way covers both conditions and scenarios.

Add a selftest which illustrates the issue triggered by syzbot.(CVE-2024-36244)

In the Linux…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Fix possible null pointer dereference.

This patch fixes possible null pointer dereference in files "rvu_debugfs.c" and "rvu_nix.c"(CVE-2021-47484)

In the Linux kernel, the following vulnerability has been resolved:

tcp: do not accept ACK of bytes we never sent

This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow.

ACK seq validation is currently following RFC 5961 5.2 guidelines:

The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.

This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent.

This greatly improves TCP security at a little cost.

I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC.

tp->bytes_acked was added in linux-4.2

Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand:

0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0

// ---------------- Handshake ------------------- //

// when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server.

+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14> +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4

// For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997

// Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535

// After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001(CVE-2023-52881)

In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Use separate handlers for interrupts

For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data.(CVE-2024-27030)

In the Linux kernel, the following vulnerability has been resolved:

media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain:

saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go)

go is freed and thus bounce is leaked.(CVE-2024-27074)

In the Linux kernel, the following vulnerability has…

In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go) go is freed and thus bounce is leaked.

• CVE-url: https://ubuntu.com/security/CVE-2024-26810
  • vfio/pci: Lock external INTx masking ops
• CVE-url: https://ubuntu.com/security/CVE-2024-38587
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug
• CVE-url: https://ubuntu.com/security/CVE-2024-39493
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
• CVE-url: https://ubuntu.com/security/CVE-2024-38381
  • nfc: nci: Fix uninit-value in nci_rx_work
• CVE-url: https://ubuntu.com/security/CVE-2023-52620
  • netfilter: nf_tables: disallow timeout for anonymous sets
• CVE-url: https://ubuntu.com/security/CVE-2024-35805
  • dm snapshot: fix lockup in dm_exception_table_exit
• CVE-url: https://ubuntu.com/security/CVE-2024-26923
  • af_unix: Fix garbage collector racing against connect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35969
  • ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
• CVE-url: https://ubuntu.com/security/CVE-2024-26863
  • hsr: Fix uninit-value access in hsr_get_node()
• CVE-url: https://ubuntu.com/security/CVE-2024-26993
  • fs: sysfs: Fix reference leak in sysfs_break_active_protection()
• CVE-url: https://ubuntu.com/security/CVE-2024-27388
  • SUNRPC: fix some memleaks in gssx_dec_option_array
• CVE-url: https://ubuntu.com/security/CVE-2024-35886
  • ipv6: Fix infinite recursion in fib6_dump_done().
• CVE-url: https://ubuntu.com/security/CVE-2024-35809
  • PCI/PM: Drain runtime-idle callbacks before driver removal
• CVE-url: https://ubuntu.com/security/CVE-2024-26875
  • media: pvrusb2: fix uaf in pvr2_context_set_notify
• CVE-url: https://ubuntu.com/security/CVE-2024-26851
  • netfilter: nf_conntrack_h323: Add protection for bmp length out of range
• CVE-url: https://ubuntu.com/security/CVE-2024-35915
  • nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
• CVE-url: https://ubuntu.com/security/CVE-2024-26999
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood
• CVE-url: https://ubuntu.com/security/CVE-2023-52699
  • sysv: don't call sb_bread() with pointers_lock held
• CVE-url: https://ubuntu.com/security/CVE-2024-35828
  • wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
• CVE-url: https://ubuntu.com/security/CVE-2024-27001
  • comedi: vmk80xx: fix incomplete endpoint checking
• CVE-url: https://ubuntu.com/security/CVE-2024-27008
  • drm: nv04: Fix out of bounds access
• CVE-url: https://ubuntu.com/security/CVE-2024-35935
  • btrfs: send: handle path ref underflow in header iterate_inode_ref()
• CVE-url: https://ubuntu.com/security/CVE-2024-27059
  • USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
• CVE-url: https://ubuntu.com/security/CVE-2024-26974
  • crypto: qat - resolve race condition during AER recovery
• CVE-url: https://ubuntu.com/security/CVE-2024-26965
  • clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
• CVE-url: https://ubuntu.com/security/CVE-2024-26931
  • scsi: qla2xxx: Fix command flush on cable pull
• CVE-url: https://ubuntu.com/security/CVE-2024-35910
  • mptcp: add sk_stop_timer_sync helper
• CVE-url: https://ubuntu.com/security/CVE-2024-35944
  • VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
• CVE-url: https://ubuntu.com/security/CVE-2024-35830
  • media: tc358743: register v4l2 async device only after successful setup
• CVE-url: https://ubuntu.com/security/CVE-2024-26956
  • nilfs2: fix failure to detect DAT corruption in btree and direct mappings
• CVE-url: https://ubuntu.com/security/CVE-2024-35807
  • ext4: fix corruption during on-line resize
• CVE-url: https://ubuntu.com/security/CVE-2024-26813
  • vfio/platform: Create persistent IRQ handlers
• CVE-url: https://ubuntu.com/security/CVE-2023-52644
  • wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2024-26810
  • vfio/pci: Lock external INTx masking ops
• CVE-url: https://ubuntu.com/security/CVE-2024-38587
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug
• CVE-url: https://ubuntu.com/security/CVE-2024-39493
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
• CVE-url: https://ubuntu.com/security/CVE-2024-38381
  • nfc: nci: Fix uninit-value in nci_rx_work
• CVE-url: https://ubuntu.com/security/CVE-2023-52620
  • netfilter: nf_tables: disallow timeout for anonymous sets
• CVE-url: https://ubuntu.com/security/CVE-2024-35805
  • dm snapshot: fix lockup in dm_exception_table_exit
• CVE-url: https://ubuntu.com/security/CVE-2024-26923
  • af_unix: Fix garbage collector racing against connect()
• CVE-url: https://ubuntu.com/security/CVE-2024-35969
  • ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
• CVE-url: https://ubuntu.com/security/CVE-2024-26863
  • hsr: Fix uninit-value access in hsr_get_node()
• CVE-url: https://ubuntu.com/security/CVE-2024-26993
  • fs: sysfs: Fix reference leak in sysfs_break_active_protection()
• CVE-url: https://ubuntu.com/security/CVE-2024-27388
  • SUNRPC: fix some memleaks in gssx_dec_option_array
• CVE-url: https://ubuntu.com/security/CVE-2024-35886
  • ipv6: Fix infinite recursion in fib6_dump_done().
• CVE-url: https://ubuntu.com/security/CVE-2024-35809
  • PCI/PM: Drain runtime-idle callbacks before driver removal
• CVE-url: https://ubuntu.com/security/CVE-2024-26875
  • media: pvrusb2: fix uaf in pvr2_context_set_notify
• CVE-url: https://ubuntu.com/security/CVE-2024-26851
  • netfilter: nf_conntrack_h323: Add protection for bmp length out of range
• CVE-url: https://ubuntu.com/security/CVE-2024-35915
  • nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet
• CVE-url: https://ubuntu.com/security/CVE-2024-26999
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood
• CVE-url: https://ubuntu.com/security/CVE-2023-52699
  • sysv: don't call sb_bread() with pointers_lock held
• CVE-url: https://ubuntu.com/security/CVE-2024-35828
  • wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
• CVE-url: https://ubuntu.com/security/CVE-2024-27001
  • comedi: vmk80xx: fix incomplete endpoint checking
• CVE-url: https://ubuntu.com/security/CVE-2024-27008
  • drm: nv04: Fix out of bounds access
• CVE-url: https://ubuntu.com/security/CVE-2024-35935
  • btrfs: send: handle path ref underflow in header iterate_inode_ref()
• CVE-url: https://ubuntu.com/security/CVE-2024-27059
  • USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
• CVE-url: https://ubuntu.com/security/CVE-2024-26974
  • crypto: qat - resolve race condition during AER recovery
• CVE-url: https://ubuntu.com/security/CVE-2024-26965
  • clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
• CVE-url: https://ubuntu.com/security/CVE-2024-26931
  • scsi: qla2xxx: Fix command flush on cable pull
• CVE-url: https://ubuntu.com/security/CVE-2024-35910
  • mptcp: add sk_stop_timer_sync helper
• CVE-url: https://ubuntu.com/security/CVE-2024-35944
  • VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
• CVE-url: https://ubuntu.com/security/CVE-2024-35830
  • media: tc358743: register v4l2 async device only after successful setup
• CVE-url: https://ubuntu.com/security/CVE-2024-26956
  • nilfs2: fix failure to detect DAT corruption in btree and direct mappings
• CVE-url: https://ubuntu.com/security/CVE-2024-35807
  • ext4: fix corruption during on-line resize
• CVE-url: https://ubuntu.com/security/CVE-2024-26813
  • vfio/platform: Create persistent IRQ handlers
• CVE-url: https://ubuntu.com/security/CVE-2023-52644
  • wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
• CVE-url:…

• CVE-url: https://ubuntu.com/security/CVE-2024-35902
  • net/rds: fix possible cp null dereference
• CVE-url: https://ubuntu.com/security/CVE-2024-38587
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug
• CVE-url: https://ubuntu.com/security/CVE-2024-39493
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak
• CVE-url: https://ubuntu.com/security/CVE-2024-38381
  • nfc: nci: Fix uninit-value in nci_rx_work
• CVE-url: https://ubuntu.com/security/CVE-2024-26810
  • vfio/pci: Lock external INTx masking ops
• CVE-url: https://ubuntu.com/security/CVE-2024-26687
  • xen/events: close evtchn after mapping cleanup
• CVE-url: https://ubuntu.com/security/CVE-2024-35893
  • net: sched: change type of reference and bind counters
  • net: sched: act_skbmod: remove dependency on rtnl lock
  • net/sched: act_skbmod: prevent kernel-infoleak
• CVE-url: https://ubuntu.com/security/CVE-2024-35823
  • vt: preserve unicode values corresponding to screen characters
  • vt: fix unicode buffer corruption when deleting characters
• CVE-url: https://ubuntu.com/security/CVE-2024-35805
  • dm snapshot: Replace mutex with rw semaphore
  • dm snapshot: fix lockup in dm_exception_table_exit
• CVE-url: https://ubuntu.com/security/CVE-2024-27004
  • clk: core: clarify the check for runtime PM
  • clk: Get runtime PM before walking tree during disable_unused
• CVE-url: https://ubuntu.com/security/CVE-2024-26852
  • net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
• CVE-url: https://ubuntu.com/security/CVE-2023-52620
  • netfilter: nf_tables: disallow timeout for anonymous sets
• CVE-url: https://ubuntu.com/security/CVE-2024-25739
  • ubi: Check for too small LEB size in VTBL code
• CVE-url: https://ubuntu.com/security/CVE-2024-27437
  • genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
  • vfio/pci: Disable auto-enable of exclusive INTx IRQ
• CVE-url: https://ubuntu.com/security/CVE-2022-48627
  • vc: separate state
  • vt: fix memory overlapping when deleting chars in the buffer
• CVE-url: https://ubuntu.com/security/CVE-2024-35910
  • mptcp: add sk_stop_timer_sync helper
  • tcp: properly terminate timers for kernel sockets
• CVE-url: https://ubuntu.com/security/CVE-2024-35969
  • ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
• CVE-url: https://ubuntu.com/security/CVE-2024-27024
  • RDS: RDMA: Fix the NULL-ptr deref in rds_ib_get_mr
  • net/rds: fix WARNING in rds_conn_connect_if_down
• CVE-url: https://ubuntu.com/security/CVE-2024-26863
  • hsr: Fix uninit-value access in hsr_get_node()
• CVE-url: https://ubuntu.com/security/CVE-2024-26984
  • nouveau: fix instmem race condition around ptr stores
• CVE-url: https://ubuntu.com/security/CVE-2024-36020
  • i40e: fix vf may be used uninitialized in this function warning
• CVE-url: https://ubuntu.com/security/CVE-2024-35849
  • btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
• CVE-url: https://ubuntu.com/security/CVE-2024-27388
  • SUNRPC: fix some memleaks in gssx_dec_option_array
• CVE-url: https://ubuntu.com/security/CVE-2024-35886
  • ipv6: Fix infinite recursion in fib6_dump_done().
• CVE-url: https://ubuntu.com/security/CVE-2024-35809
  • PCI/PM: Drain runtime-idle callbacks before driver removal
• CVE-url: https://ubuntu.com/security/CVE-2024-26875
  • media: pvrusb2: fix uaf in pvr2_context_set_notify
• CVE-url: https://ubuntu.com/security/CVE-2024-26851
  • netfilter: nf_conntrack_h323: Add protection for bmp length out of range
• CVE-url: https://ubuntu.com/security/CVE-2024-26999
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood
• CVE-url: https://ubuntu.com/security/CVE-2024-35819
  • soc: fsl: qbman: Use raw spinlock for cgr_lock
• CVE-url: https://ubuntu.com/security/CVE-2024-35806
  • soc: fsl: qbman: Always disable interrupts when taking…

• Bump ABI 4.15.0-232

In the Linux kernel, the following vulnerability has been resolved:

media: go7007: fix a memleak in go7007_load_encoder

In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain:

saa7134_go7007_init |-> go7007_boot_encoder |-> go7007_load_encoder |-> kfree(go)

go is freed and thus bounce is leaked.

The SUSE Linux Enterprise 12 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46955: Fixed an out-of-bounds read with openvswitch, when fragmenting IPv4 packets (bsc#1220513).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47113: Abort…

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed a PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed a double free of blk_mq_tag_set in dev remove after table load fails in dm rq (bsc#1220554).
• CVE-2021-46939: Fixed a denial of service in trace_clock_global() in tracing (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed a data corruption bug in raid1 arrays using bitmaps in md/raid1 (bsc#1220662).
• CVE-2021-46958: Fixed a race between transaction aborts and fsyncs leading to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed a warning on smb2_get_enc_key in cifs (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed a NULL pointer in flush_workqueue in nbd (bsc#1220611).
• CVE-2021-46988: Fixed release page in error path to avoid BUG_ON (bsc#1220706).
• CVE-2021-46990: Fixed a denial of service when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed an use after free bug in enic_hard_start_xmit in ethernet/enic (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed a RX consumer index logic in the error path in bnxt_rx_pkt() in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed a kernel memory fault for pte update on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed a null pointer dereference in lpfc_prep_els_iocb() in scsi lpfc (bsc#1220640).
• CVE-2021-47049: Fixed an after free in __vmbus_open() in hv vmbus (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed a user-memory-access error on vf2pf_lock in crypto (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed a potential use-after-free during bridge detach in drm bridge/panel (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed a memory leak in error handling paths in hv_uio_cleanup() in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed a data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed a crash in ext4_es_cache_extent as ext4_split_extent_at failed in ext4 (bsc#1221575).
• CVE-2021-47118: Fixed an use-after-free in init task's struct pid in pid (bsc#1221605).
• CVE-2021-47119: Fixed a memory leak in ext4_fill_super in ext4 (bsc#1221608). -…

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2019-25160: Fixed out-of-bounds memory accesses in netlabel (bsc#1220394).
• CVE-2020-36312: Fixed an issue in virt/kvm/kvm_main.c that had a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure (bsc#1184509).
• CVE-2021-23134: Fixed a use-after-free issue in nfc sockets (bsc#1186060).
• CVE-2021-46904: Fixed NULL pointer dereference during tty device unregistration (bsc#1220416).
• CVE-2021-46905: Fixed NULL pointer dereference on disconnect regression (bsc#1220418).
• CVE-2021-46909: Fixed PCI interrupt mapping in ARM footbridge (bsc#1220442).
• CVE-2021-46938: Fixed double free of blk_mq_tag_set in dev remove after table load fails (bsc#1220554).
• CVE-2021-46939: Fixed possible hung in trace_clock_global() (bsc#1220580).
• CVE-2021-46941: Fixed core softreset when switch mode in usb dwc3 (bsc#1220628).
• CVE-2021-46950: Fixed possible data corruption in md/raid1 when ending a failed write request (bsc#1220662).
• CVE-2021-46958: Fixed race between transaction aborts and fsyncs that could lead to use-after-free in btrfs (bsc#1220521).
• CVE-2021-46960: Fixed wrong error code from smb2_get_enc_key() (bsc#1220528).
• CVE-2021-46963: Fixed crash in qla2xxx_mqueuecommand() (bsc#1220536).
• CVE-2021-46964: Fixed unreserved extra IRQ vectors in qla2xxx (bsc#1220538).
• CVE-2021-46966: Fixed potential use-after-free issue in cm_write() (bsc#1220572).
• CVE-2021-46981: Fixed NULL pointer in flush_workqueue (bsc#1220611).
• CVE-2021-46988: Fixed possible crash in userfaultfd due to unreleased page (bsc#1220706).
• CVE-2021-46990: Fixed crashes when toggling entry flush barrier in powerpc/64s (bsc#1220743).
• CVE-2021-46998: Fixed a use after free bug in enic_hard_start_xmit() (bsc#1220625).
• CVE-2021-47006: Fixed wrong check in overflow_handler hook in ARM 9064/1 hw_breakpoint (bsc#1220751).
• CVE-2021-47015: Fixed RX consumer index logic in the error path in bnxt_en (bsc#1220794).
• CVE-2021-47024: Fixed possible memory leak in vsock/virtio when closing socket (bsc#1220637).
• CVE-2021-47034: Fixed resolved pte update for kernel memory on radix in powerpc/64s (bsc#1220687).
• CVE-2021-47045: Fixed null pointer dereference in lpfc_prep_els_iocb() (bsc#1220640).
• CVE-2021-47049: Fixed Use after free in __vmbus_open() (bsc#1220692).
• CVE-2021-47055: Fixed missing permissions for locking and badblock ioctls in mtd (bsc#1220768).
• CVE-2021-47056: Fixed uninitialized lock in adf_vf2pf_shutdown() (bsc#1220769).
• CVE-2021-47060: Fixed a bug in KVM by stop looking for coalesced MMIO zones if the bus is destroyed (bsc#1220742).
• CVE-2021-47061: Fixed a bug in KVM by destroy I/O bus devices on unregister failure after sync'ing SRCU (bsc#1220745).
• CVE-2021-47063: Fixed possible use-after-free in panel_bridge_detach() (bsc#1220777).
• CVE-2021-47068: Fixed a use-after-free issue in llcp_sock_bind/connect (bsc#1220739).
• CVE-2021-47070: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220829).
• CVE-2021-47071: Fixed memory leak in error handling paths in uio_hv_generic (bsc#1220846).
• CVE-2021-47073: Fixed oops on rmmod dell_smbios init_dell_smbios_wmi() (bsc#1220850).
• CVE-2021-47100: Fixed UAF when uninstall in ipmi (bsc#1220985).
• CVE-2021-47101: Fixed uninit-value in asix_mdio_read() (bsc#1220987).
• CVE-2021-47104: Fixed memory leak in qib_user_sdma_queue_pkts() (bsc#1220960).
• CVE-2021-47110: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221532).
• CVE-2021-47112: Fixed possible memory corruption when restoring from hibernation in x86/kvm (bsc#1221541).
• CVE-2021-47114: Fixed data corruption by fallocate in ocfs2 (bsc#1221548).
• CVE-2021-47117: Fixed bug on in ext4_es_cache_extent() as ext4_split_extent_at() failed (bsc#1221575).
• CVE-2021-47118: Fixed possible use-after-free when initializing cad_pid (bsc#1221605). -…

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).
• CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).
• CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).
• CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).
• CVE-2024-27401: Fixed user_length taken into account when fetching packet contents (bsc#1224181).
• CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721)
• CVE-2024-27419: Fixed data-races around sysctl_net_busy_read (bsc#1224759)
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35791: Flush pages under…

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING (bsc#1224575).
• CVE-2024-36938: Fixed NULL pointer dereference in sk_psock_skb_ingress_enqueue (bsc#1225761).
• CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2024-35998: Fixed lock ordering potential deadlock in cifs_sync_mid_result (bsc#1224549).
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).
• CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).
• CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).
• CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).
• CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).
• CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).
• CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).
• CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).
• CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).
• CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2024-35964: Fixed not validating setsockopt user input (bsc#1224581).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (CVE-2023-52698 bsc#1224621)
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).
• CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround (bsc#1224531).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).
• CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).
• CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).
• CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).
• CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).
• CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580).
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios (bsc#1224530).
• CVE-2024-35852: Fixed memory leak when canceling rehash work (bsc#1224502).
• CVE-2024-36006: Fixed incorrect list API usage (bsc#1224541).
• CVE-2024-36007: Fixed warning during rehash (bsc#1224543).
• CVE-2024-35885: Stop interface during shutdown (bsc#1224519).
• CVE-2024-35907: Call request_irq() after NAPI initialized (bsc#1224492).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure…

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)
• CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)
• CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)
• CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).
• CVE-2023-42755: Check user supplied offsets (bsc#1215702).
• CVE-2023-52586: Fixed mutex lock in control vblank irq (bsc#1221081).
• CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).
• CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).
• CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).
• CVE-2023-52660: Fiedx IRQ handling due to shared interrupts (bsc#1224443).
• CVE-2023-52664: Eliminate double free in error handling logic (bsc#1224747).
• CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).
• CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() (bsc#1224727).
• CVE-2023-52680: Fixed missing error checks to *_ctl_get() (bsc#1224608).
• CVE-2023-52692: Fixed missing error check to scarlett2_usb_set_config() (bsc#1224628).
• CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass() (bsc#1224621)
• CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr() (bsc#1225114)
• CVE-2023-52757: Fixed potential deadlock when releasing mids (bsc#1225548).
• CVE-2023-52795: Fixed use after free in vhost_vdpa_probe() (bsc#1225085).
• CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).
• CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce info is read via debugfs (bsc#1225097).
• CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).
• CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).
• CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
• CVE-2024-26643: Fixed mark set as dead when unbinding anonymous set with timeout (bsc#1221829).
• CVE-2024-26679: Fixed read sk->sk_family once in inet_recv_error() (bsc#1222385).
• CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).
• CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870)
• CVE-2024-26715: Fixed NULL pointer dereference in dwc3_gadget_suspend (bsc#1222561).
• CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes bsc#1222608).
• CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).
• CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)
• CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)
• CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)
• CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).
• CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).
• CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)
• CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).
• CVE-2024-26900: Fixed kmemleak of rdev->serial (bsc#1223046).
• CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).
• CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)
• CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).
• CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).
• CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).
• CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).
• CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).
• CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).
• CVE-2024-27042: Fixed potential out-of-bounds access in…

The SUSE Linux Enterprise Micro 6.0 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (bsc#1223813)
• CVE-2024-40948: mm/page_table_check: fix crash on ZONE_DEVICE (bsc#1227801).
• CVE-2024-35890:…

The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2024-41014: xfs: add bounds checking to xlog_recover_process_data (bsc#1228408).
• CVE-2024-41013: xfs: do not walk off the end of a directory data block (bsc#1228405).
• CVE-2024-41017: jfs: do not walk off the end of ealist (bsc#1228403).
• CVE-2024-40972: ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (bsc#1227910).
• CVE-2024-39276: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (bsc#1226993).
• CVE-2024-40925: block: fix request.queuelist usage in flush (bsc#1227789).
• CVE-2024-40998: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (bsc#1227866).
• CVE-2024-41011: drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (bsc#1228114).
• CVE-2024-39494: ima: Fix use-after-free on a dentry's dname.name (bsc#1227716).
• CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace (bsc#1227719).
• CVE-2024-41091: tun: add missing verification for short frame (bsc#1228327).
• CVE-2024-41090: tap: add missing verification for short frame (bsc#1228328).
• CVE-2024-40999: net: ena: Add validation for completion descriptors consistency (bsc#1227913).
• CVE-2024-40966: kABI: tty: add the option to have a tty reject a new ldisc (bsc#1227886).
• CVE-2024-40975: platform/x86: x86-android-tablets: Unregister devices in reverse order (bsc#1227926).
• CVE-2024-40970: Avoid hw_desc array overrun in dw-axi-dmac (bsc#1227899).
• CVE-2024-40947: ima: Avoid blocking in RCU read-side critical section (bsc#1227803).
• CVE-2024-40908: bpf: Set run context for rawtp test_run callback (bsc#1227783).
• CVE-2024-40960: ipv6: prevent possible NULL dereference in rt6_probe() (bsc#1227813).
• CVE-2024-40935: cachefiles: flush all requests after setting CACHEFILES_DEAD (bsc#1227797).
• CVE-2024-40961: ipv6: prevent possible NULL deref in fib6_nh_init() (bsc#1227814).
• CVE-2024-39504: netfilter: nft_inner: validate mandatory meta and payload (bsc#1227757).
• CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() (bsc#1227862).
• CVE-2024-40937: gve: Clear napi->skb before dev_kfree_skb_any() (bsc#1227836).
• CVE-2024-39507: net: hns3: fix kernel crash problem in concurrent scenario (bsc#1227730).
• CVE-2024-40940: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail (bsc#1227800).
• CVE-2024-40928: net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (bsc#1227788).
• CVE-2024-26944: btrfs: zoned: fix lock ordering in btrfs_zone_activate() (bsc#1223731).
• CVE-2024-40923: vmxnet3: disable rx data ring on dma allocation failure (bsc#1227786).
• CVE-2024-40931: mptcp: ensure snd_una is properly initialized on connect (bsc#1227780).
• CVE-2024-40919: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (bsc#1227779).
• CVE-2024-39487: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (bsc#1227573)
• CVE-2024-35908: tls: get psock ref after taking rxlock to avoid leak (bsc#1224490)
• CVE-2024-35899: netfilter: nf_tables: flush pending destroy work before exit_net release (bsc#1224499)
• CVE-2024-35934: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (bsc#1224641)
• CVE-2024-35893: net/sched: act_skbmod: prevent kernel-infoleak (bsc#1224512)
• CVE-2024-40901: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (bsc#1227762).
• CVE-2024-39472: xfs: fix log recovery buffer allocation for the legacy h_size fixup (bsc#1227432).
• CVE-2024-40953: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() (bsc#1227806).
• CVE-2024-27404: mptcp: fix data races on remote_id (bsc#1224422)
• CVE-2024-27020: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (bsc#1223815)
• CVE-2024-27019: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Sun RPC protocol;
• ALSA SH drivers;
• SOF drivers;
• USB sound devices;
• KVM core; (CVE-2024-26859, CVE-2024-26944, CVE-2024-27049, CVE-2024-26868, CVE-2024-26932, CVE-2024-35843, CVE-2024-35814, CVE-2024-26866, CVE-2024-26941, CVE-2024-27080,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Sun RPC protocol;
• ALSA SH drivers;
• SOF drivers;
• USB sound devices;
• KVM core; (CVE-2024-26859, CVE-2024-26944, CVE-2024-27049, CVE-2024-26868, CVE-2024-26932, CVE-2024-35843, CVE-2024-35814, CVE-2024-26866, CVE-2024-26941, CVE-2024-27080,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Sun RPC protocol;
• ALSA SH drivers;
• SOF drivers;
• USB sound devices;
• KVM core; (CVE-2024-26859, CVE-2024-26944, CVE-2024-27049, CVE-2024-26868, CVE-2024-26932, CVE-2024-35843, CVE-2024-35814, CVE-2024-26866, CVE-2024-26941, CVE-2024-27080,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26776, CVE-2024-26802, CVE-2024-26790, CVE-2024-27388, CVE-2024-27077, CVE-2024-26884, CVE-2024-26779, CVE-2024-26897, CVE-2024-27045, CVE-2024-26851, CVE-2024-27065, CVE-2024-26843, CVE-2024-26743, CVE-2024-27052, CVE-2024-26855, CVE-2024-27436, CVE-2024-27078, CVE-2024-26898, CVE-2024-27405, CVE-2024-26894, CVE-2024-26584, CVE-2024-26915, CVE-2024-26763, CVE-2024-27047, CVE-2024-26809, CVE-2024-26883, CVE-2024-26901, CVE-2024-27412, CVE-2024-26803, CVE-2024-26751, CVE-2024-35829, CVE-2024-27432, CVE-2023-52447, CVE-2024-26748, CVE-2024-27051, CVE-2023-52434, CVE-2024-26749, CVE-2024-27034, CVE-2024-27390, CVE-2024-26879, CVE-2024-26859, CVE-2024-26835, CVE-2024-26861, CVE-2024-27030, CVE-2024-27415, CVE-2023-52656, CVE-2024-26773, CVE-2024-27043, CVE-2024-26601, CVE-2024-27073, CVE-2024-26782, CVE-2024-27413, CVE-2024-26880, CVE-2024-26793, CVE-2024-26766, CVE-2024-26750, CVE-2024-26852, CVE-2024-26805, CVE-2024-35830, CVE-2024-26798, CVE-2023-52644, CVE-2024-26787, CVE-2024-26846,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

It was discovered that the MediaTek SoC Gigabit Ethernet driver in the Linux kernel contained a race condition when stopping the device. A local attacker could possibly use this to cause a denial of service (device unavailability). (CVE-2024-27432)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26877, CVE-2024-35829, CVE-2024-26737, CVE-2024-27075, CVE-2024-27414, CVE-2024-27053, CVE-2024-26889, CVE-2024-26792, CVE-2024-26882, CVE-2024-26906, CVE-2024-26851, CVE-2024-27037, CVE-2024-26782, CVE-2024-27388, CVE-2024-26748, CVE-2024-27419, CVE-2024-27034, CVE-2023-52662, CVE-2024-27047, CVE-2024-26874, CVE-2024-26779, CVE-2024-26872, CVE-2024-26820, CVE-2024-35811, CVE-2024-26771, CVE-2024-26733, CVE-2024-26903, CVE-2024-26736, CVE-2024-26870, CVE-2024-26883, CVE-2024-27403, CVE-2024-26878, CVE-2024-26857, CVE-2023-52645, CVE-2024-26601, CVE-2024-26891, CVE-2024-27028, CVE-2024-27054, CVE-2024-26804, CVE-2024-27405, CVE-2024-35830, CVE-2024-26898, CVE-2024-26754, CVE-2024-26793, CVE-2024-26747, CVE-2024-26901, CVE-2023-52652, CVE-2023-52650, CVE-2024-26651, CVE-2024-26816, CVE-2024-35845, CVE-2024-26862, CVE-2024-26884, CVE-2024-26752, CVE-2024-26852, CVE-2023-52656, CVE-2024-26790, CVE-2024-26603, CVE-2024-27078, CVE-2024-26802, CVE-2024-27045, CVE-2024-27024, CVE-2024-27073, CVE-2024-26585, CVE-2024-26894, CVE-2024-26583, CVE-2024-27416, CVE-2024-27431, CVE-2024-35844, CVE-2024-26838, CVE-2024-27410, CVE-2024-26915, CVE-2024-26772, CVE-2024-26897, CVE-2024-26798, CVE-2024-27415, CVE-2024-26855, CVE-2024-26833, CVE-2024-26764, CVE-2024-26659,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-35830, CVE-2024-27052, CVE-2023-52620, CVE-2024-26903, CVE-2024-27413, CVE-2024-26766, CVE-2024-27077, CVE-2024-27044, CVE-2024-27076, CVE-2024-26833, CVE-2024-26874, CVE-2024-26863, CVE-2023-52650, CVE-2024-26820, CVE-2024-26787, CVE-2023-52656, CVE-2024-26651, CVE-2024-27065, CVE-2024-27053, CVE-2024-26583, CVE-2024-26774, CVE-2024-26782, CVE-2023-52640, CVE-2024-26838, CVE-2024-27410, CVE-2024-26870, CVE-2024-27024, CVE-2024-26891, CVE-2024-26889, CVE-2024-26897, CVE-2024-26857, CVE-2023-52434, CVE-2023-52645, CVE-2024-26901, CVE-2024-26872, CVE-2024-27051, CVE-2024-27388, CVE-2024-26584, CVE-2024-26802, CVE-2024-26733, CVE-2024-27419, CVE-2023-52447, CVE-2024-27054, CVE-2024-26840, CVE-2024-27038, CVE-2024-27028, CVE-2024-26883, CVE-2024-27074, CVE-2024-26735, CVE-2024-26852, CVE-2024-27034, CVE-2024-26744, CVE-2024-26907, CVE-2024-26777, CVE-2024-26835, CVE-2024-35845, CVE-2024-35828, CVE-2024-27037, CVE-2024-26764, CVE-2024-26798, CVE-2024-27414, CVE-2024-26878, CVE-2024-27390, CVE-2024-26856, CVE-2024-26884, CVE-2024-26779, CVE-2024-26895, CVE-2024-27436, CVE-2023-52641, CVE-2024-27039, CVE-2024-26776, CVE-2024-26749, CVE-2024-27047, CVE-2024-26882, CVE-2023-52652, CVE-2023-52662, CVE-2024-26763, CVE-2024-27030, CVE-2024-26772, CVE-2024-26859, CVE-2024-26791, CVE-2024-26788, CVE-2024-27046, CVE-2024-26736, CVE-2024-26750, CVE-2024-26801, CVE-2024-35811, CVE-2024-26737, CVE-2024-27416, CVE-2024-26769, CVE-2024-26906, CVE-2024-26795, CVE-2024-27417, CVE-2024-27078, CVE-2024-26790,…

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-1151)

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service (system crash). (CVE-2024-23849)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• Core kernel;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Android drivers;
• Power management core;
• Bus devices;
• Hardware random number generator core;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• Device frequency scaling framework;
• DMA engine subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• HID subsystem;
• Hardware monitoring drivers;
• I2C subsystem;
• IIO ADC drivers;
• IIO subsystem;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• PCI driver for MicroSemi Switchtec;
• PHY drivers;
• MediaTek PM domains;
• Power supply drivers;
• SCSI drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• DesignWare USB3 driver;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• Ceph distributed file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• JFS file system;
• Network file system client;
• NILFS2 file system;
• NTFS3 file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Memory management;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Ethernet bridge;
• CAN network layer;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• Logical Link…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26901, CVE-2024-35844, CVE-2024-27024, CVE-2024-26835, CVE-2024-26879, CVE-2024-26846, CVE-2024-35829, CVE-2024-26804, CVE-2024-26802, CVE-2024-27039, CVE-2024-27075, CVE-2024-27076, CVE-2024-26863, CVE-2024-27046, CVE-2024-26776, CVE-2024-26875, CVE-2024-26885, CVE-2024-26583, CVE-2024-26777, CVE-2024-26803, CVE-2024-27047, CVE-2024-26748, CVE-2024-27044, CVE-2024-27416, CVE-2024-26906, CVE-2024-27405, CVE-2024-26749, CVE-2024-27436, CVE-2024-26895, CVE-2023-52662, CVE-2024-26772, CVE-2023-52645, CVE-2024-26787, CVE-2024-26788, CVE-2023-52497, CVE-2024-26795, CVE-2024-26763, CVE-2024-27414, CVE-2024-26870, CVE-2024-27412, CVE-2024-27078, CVE-2024-27388, CVE-2024-26894, CVE-2023-52641, CVE-2024-27053, CVE-2024-26584, CVE-2024-26752, CVE-2024-35845, CVE-2024-26884, CVE-2024-26782, CVE-2024-26859, CVE-2024-26809, CVE-2024-27038, CVE-2024-26897, CVE-2024-26750, CVE-2023-52644, CVE-2024-26848, CVE-2024-26833, CVE-2024-26801, CVE-2024-26872, CVE-2023-52620, CVE-2023-52652, CVE-2024-26839, CVE-2024-26851, CVE-2024-26805, CVE-2024-26659, CVE-2024-26791, CVE-2023-52640, CVE-2024-26883, CVE-2024-26737, CVE-2024-27028, CVE-2024-26603, CVE-2024-27073, CVE-2024-26792, CVE-2024-35830, CVE-2024-26585, CVE-2024-27045, CVE-2024-26880,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-47233)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• PowerPC architecture;
• x86 architecture;
• Block layer subsystem;
• ACPI drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DPLL subsystem;
• ARM SCMI message protocol;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• Powercap sysfs driver;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• Thermal drivers;
• TTY drivers;
• USB subsystem;
• DesignWare USB3 driver;
• VFIO drivers;
• Backlight driver;
• Virtio drivers;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• debug file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client;
• NILFS2 file system;
• Overlay file system;
• Pstore file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• PCI iomap interfaces;
• Memory management;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• IEEE 802.15.4 subsystem;
• Netfilter;
• Packet sockets;
• Network traffic control;
• Sun RPC protocol;
• ALSA SH drivers;
• SOF drivers;
• USB sound devices;
• KVM core; (CVE-2024-27032, CVE-2024-26868, CVE-2024-26879, CVE-2024-27033, CVE-2024-26943, CVE-2024-27040, CVE-2024-26950, CVE-2023-52650,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• RISC-V architecture;
• x86 architecture;
• ACPI drivers;
• Block layer subsystem;
• Clock framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• InfiniBand drivers;
• IOMMU subsystem;
• Multiple devices driver;
• Media drivers;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• USB subsystem;
• Framebuffer layer;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• Network file system client;
• NTFS3 file system;
• Diskquota system;
• SMB network file system;
• BPF subsystem;
• Netfilter;
• TLS protocol;
• io_uring subsystem;
• Bluetooth subsystem;
• Memory management;
• Ethernet bridge;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• L2TP protocol;
• MAC80211 subsystem;
• Multipath TCP;
• Netlink;
• NET/ROM layer;
• Packet sockets;
• RDS protocol;
• Sun RPC protocol;
• Unix domain sockets;
• Wireless networking;
• USB sound devices; (CVE-2024-26643, CVE-2024-26735, CVE-2024-27024, CVE-2024-26838, CVE-2024-27045, CVE-2024-26747, CVE-2024-26774, CVE-2024-26889, CVE-2024-26766, CVE-2024-26878, CVE-2024-35845, CVE-2024-27034, CVE-2024-26857, CVE-2024-26863, CVE-2024-27030, CVE-2024-27043, CVE-2023-52662, CVE-2024-26787, CVE-2024-26782, CVE-2023-52434, CVE-2024-26802, CVE-2024-26776, CVE-2024-26584, CVE-2024-26875, CVE-2023-52650, CVE-2024-26879, CVE-2024-26820, CVE-2024-27410, CVE-2024-26859, CVE-2024-26744, CVE-2024-26743, CVE-2024-27075, CVE-2024-35830, CVE-2024-26779, CVE-2024-26843, CVE-2024-26778, CVE-2024-27046, CVE-2024-27412, CVE-2024-26839, CVE-2024-26773, CVE-2024-26748, CVE-2023-52620, CVE-2024-26805, CVE-2024-26915, CVE-2024-26848, CVE-2024-26688, CVE-2024-26840, CVE-2024-26856, CVE-2024-27414, CVE-2023-52645, CVE-2024-26880, CVE-2023-52656, CVE-2024-27053, CVE-2024-26752, CVE-2024-27047, CVE-2024-27416, CVE-2024-26882, CVE-2024-26803, CVE-2024-27073, CVE-2024-26884, CVE-2024-26769, CVE-2024-26737, CVE-2024-27054, CVE-2024-27044, CVE-2024-26777, CVE-2024-26749, CVE-2024-27436, CVE-2024-26788, CVE-2024-26751, CVE-2024-35828, CVE-2024-26891, CVE-2024-26771, CVE-2024-26877, CVE-2024-26733, CVE-2024-26793, CVE-2024-26659, CVE-2024-27419, CVE-2024-26870,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35969, CVE-2024-35819, CVE-2024-26851, CVE-2024-26816, CVE-2024-26643, CVE-2023-52656, CVE-2024-27020, CVE-2024-35821, CVE-2024-35930, CVE-2024-35936, CVE-2024-27075, CVE-2024-26817, CVE-2024-26984, CVE-2024-35895, CVE-2024-35853, CVE-2024-27043, CVE-2024-35978, CVE-2024-35960, CVE-2024-26882, CVE-2024-35806, CVE-2024-35830, CVE-2024-26852, CVE-2024-35915, CVE-2024-36006, CVE-2024-35935, CVE-2024-26926, CVE-2024-35877, CVE-2024-27396, CVE-2024-26654, CVE-2024-27077, CVE-2024-27078, CVE-2024-27000, CVE-2024-35888, CVE-2024-27437, CVE-2024-26994, CVE-2024-26973, CVE-2024-26687, CVE-2024-26955, CVE-2024-26898, CVE-2024-26859, CVE-2023-52620,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-27076, CVE-2024-35849, CVE-2024-35899, CVE-2024-27038, CVE-2024-35982, CVE-2024-26687, CVE-2024-26863, CVE-2024-36004, CVE-2024-27004, CVE-2024-27065, CVE-2024-36020, CVE-2024-27000, CVE-2024-26981, CVE-2024-26973, CVE-2024-35922, CVE-2024-35969, CVE-2024-26851, CVE-2023-52880, CVE-2024-35813, CVE-2024-26859, CVE-2024-27078, CVE-2024-27020, CVE-2024-35809, CVE-2024-27001, CVE-2024-26969, CVE-2024-26993, CVE-2024-35935, CVE-2024-35815, CVE-2024-26931, CVE-2024-35823, CVE-2024-26984, CVE-2024-27024, CVE-2024-27419, CVE-2024-27008, CVE-2024-35825, CVE-2023-52644, CVE-2024-35933, CVE-2024-35830, CVE-2024-35900, CVE-2024-27046, CVE-2024-26651,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2023-52620, CVE-2023-52650, CVE-2024-26999, CVE-2024-26857, CVE-2024-35984, CVE-2024-27043, CVE-2024-26810, CVE-2023-52880, CVE-2024-35915, CVE-2024-26955, CVE-2024-27396, CVE-2024-35922, CVE-2024-27395, CVE-2024-35899, CVE-2024-35809, CVE-2024-27000, CVE-2024-27004, CVE-2024-35830, CVE-2024-26931, CVE-2024-26993, CVE-2024-27013, CVE-2024-26812, CVE-2024-35893, CVE-2024-27073, CVE-2024-26687, CVE-2024-26969, CVE-2024-26901, CVE-2024-26875, CVE-2024-26976, CVE-2024-26889, CVE-2024-26586, CVE-2024-36020, CVE-2024-26859, CVE-2024-35944, CVE-2024-35888, CVE-2024-26965, CVE-2024-36007, CVE-2024-35847, CVE-2024-27436, CVE-2024-35982, CVE-2023-52699,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35930, CVE-2024-26687, CVE-2024-26828, CVE-2024-26903, CVE-2024-35893, CVE-2024-35847, CVE-2024-35849, CVE-2024-35789, CVE-2024-26812, CVE-2024-26898, CVE-2024-26937, CVE-2024-35809, CVE-2023-52620, CVE-2024-35852, CVE-2024-26922, CVE-2024-26923, CVE-2024-27001, CVE-2024-35915, CVE-2024-35935, CVE-2024-26974, CVE-2024-26859, CVE-2024-26999, CVE-2024-26981, CVE-2024-35982, CVE-2024-26969, CVE-2024-26889, CVE-2024-26984, CVE-2024-27077, CVE-2024-26973, CVE-2024-27436, CVE-2024-26965, CVE-2024-35855, CVE-2024-27024, CVE-2024-26934, CVE-2024-35806, CVE-2024-35895, CVE-2024-27076, CVE-2024-26931, CVE-2024-35888, CVE-2024-35899, CVE-2024-35815,…

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• Cryptographic API;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• PCI subsystem;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• File systems infrastructure;
• BTRFS file system;
• Ext4 file system;
• FAT file system;
• NILFS2 file system;
• Diskquota system;
• SMB network file system;
• UBI file system;
• io_uring subsystem;
• BPF subsystem;
• Core kernel;
• Memory management;
• B.A.T.M.A.N. meshing protocol;
• Bluetooth subsystem;
• Networking core;
• HSR network protocol;
• IPv4 networking;
• IPv6 networking;
• MAC80211 subsystem;
• Netfilter;
• NET/ROM layer;
• NFC subsystem;
• Open vSwitch;
• Packet sockets;
• RDS protocol;
• Network traffic control;
• Sun RPC protocol;
• Unix domain sockets;
• ALSA SH drivers;
• USB sound devices;
• KVM core; (CVE-2024-35982, CVE-2024-26862, CVE-2024-35997, CVE-2024-26851, CVE-2024-26817, CVE-2024-26820, CVE-2024-26974, CVE-2024-35806, CVE-2024-26903, CVE-2024-35822, CVE-2024-27076, CVE-2024-26901, CVE-2024-26955, CVE-2024-26976, CVE-2024-35821, CVE-2024-27038, CVE-2024-26994, CVE-2023-52656, CVE-2024-27008, CVE-2024-26966, CVE-2024-26898, CVE-2024-26931, CVE-2024-35888, CVE-2024-26810, CVE-2024-26969, CVE-2024-35960, CVE-2024-26884, CVE-2024-26999, CVE-2024-35847, CVE-2024-35807, CVE-2024-26857, CVE-2024-35915, CVE-2023-52880, CVE-2024-35936, CVE-2024-26875, CVE-2024-26973, CVE-2024-35899, CVE-2024-35910, CVE-2024-27020, CVE-2024-26828, CVE-2024-26957,…

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not properly handle certain error conditions, leading to a NULL pointer dereference. A local attacker could possibly trigger this vulnerability to cause a denial of service. (CVE-2022-38096)

It was discovered that the ATA over Ethernet (AoE) driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2023-6270)

It was discovered that the Atheros 802.11ac wireless driver did not properly validate certain data structures, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service. (CVE-2023-7042)

It was discovered that the HugeTLB file system component of the Linux Kernel contained a NULL pointer dereference vulnerability. A privileged attacker could possibly use this to to cause a denial of service. (CVE-2024-0841)

It was discovered that the Intel Data Streaming and Intel Analytics Accelerator drivers in the Linux kernel allowed direct access to the devices for unprivileged users and virtual machines. A local attacker could use this to cause a denial of service. (CVE-2024-21823)

Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux Kernel contained a race condition, leading to a NULL pointer dereference. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-22099)

Gui-Dong Han discovered that the software RAID driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. A privileged attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-23307)

It was discovered that a race condition existed in the Bluetooth subsystem in the Linux kernel when modifying certain settings values through debugfs. A privileged local attacker could use this to cause a denial of service. (CVE-2024-24857, CVE-2024-24858, CVE-2024-24859)

Bai Jiaju discovered that the Xceive XC4000 silicon tuner device driver in the Linux kernel contained a race condition, leading to an integer overflow vulnerability. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-24861)

Chenyuan Yang discovered that the Unsorted Block Images (UBI) flash device volume management subsystem did not properly validate logical eraseblock sizes in certain situations. An attacker could possibly use this to cause a denial of service (system crash). (CVE-2024-25739)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• ARM32 architecture;
• ARM64 architecture;
• RISC-V architecture;
• x86 architecture;
• Block layer subsystem;
• Accessibility subsystem;
• ACPI drivers;
• Android drivers;
• Bluetooth drivers;
• Clock framework and drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Cryptographic API;
• DMA engine subsystem;
• EFI core;
• GPU drivers;
• HID subsystem;
• I2C subsystem;
• InfiniBand drivers;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• VMware VMCI Driver;
• MMC subsystem;
• Network drivers;
• NTB driver;
• NVME drivers;
• Device tree and open firmware driver;
• PCI subsystem;
• MediaTek PM domains;
• Power supply drivers;
• S/390 drivers;
• SCSI drivers;
• Freescale SoC drivers;
• SPI subsystem;
• Media staging drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• TTY drivers;
• USB subsystem;
• VFIO drivers;
• Framebuffer layer;
• Xen hypervisor drivers;
• AFS file system;
• File systems infrastructure;
• BTRFS file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• Network file system client; -…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• InfiniBand drivers;
• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2024-50051, CVE-2025-37752, CVE-2024-53130, CVE-2024-47685, CVE-2024-27074, CVE-2023-52477, CVE-2024-50202, CVE-2021-47345, CVE-2024-57996, CVE-2024-53131)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• InfiniBand drivers;
• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2024-50051, CVE-2025-37752, CVE-2024-53130, CVE-2024-47685, CVE-2024-27074, CVE-2023-52477, CVE-2024-50202, CVE-2021-47345, CVE-2024-57996, CVE-2024-53131)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• InfiniBand drivers;
• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2024-50051, CVE-2025-37752, CVE-2024-53130, CVE-2024-47685, CVE-2024-27074, CVE-2023-52477, CVE-2024-50202, CVE-2021-47345, CVE-2024-57996, CVE-2024-53131)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2024-53130, CVE-2025-38350, CVE-2024-50202, CVE-2024-47685, CVE-2025-37752, CVE-2024-50051, CVE-2024-57996, CVE-2023-52477, CVE-2024-27074, CVE-2024-53131)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2024-53130, CVE-2025-38350, CVE-2024-50202, CVE-2024-47685, CVE-2025-37752, CVE-2024-50051, CVE-2024-57996, CVE-2023-52477, CVE-2024-27074, CVE-2024-53131)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• Media drivers;
• SPI subsystem;
• USB core drivers;
• NILFS2 file system;
• IPv6 networking;
• Network traffic control; (CVE-2025-38350, CVE-2024-47685, CVE-2024-57996, CVE-2024-53130, CVE-2025-37752, CVE-2023-52477, CVE-2024-53131, CVE-2024-50202, CVE-2024-27074, CVE-2024-50051)