CVE-2024-35962

netfilter: complete validation of user input

7.1 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

0.24%Up 0.2 points since May 21, 2024

What each source reports

CVE List Score used 7.1

netfilter: complete validation of user input

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: CVE-2024-35962
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2024-35680 7.1

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: EUVD-2024-35680
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j7rq-227r-98j4 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: complete...

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: GHSA-j7rq-227r-98j4
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.1

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: CVE-2024-35962
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2024-35962 5.5

Record: BELL-CVE-2024-35962
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.1

netfilter: complete validation of user input

In the Linux kernel, the following vulnerability has been resolved:

netfilter: complete validation of user input

In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls.

In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check:

if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: CVE-2024-35962
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 24 moreShow less

OSVDEBIAN-CVE-2024-35962 5.5

In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that do_replace() handlers use copy_from_sockptr() (which I fixed), followed by unsafe copy_from_sockptr_offset() calls. In all functions, we can perform the @optlen validation before even calling xt_alloc_table_info() with the following check: if ((u64)optlen < (u64)tmp.size + sizeof(tmp)) return -EINVAL;

Record: DEBIAN-CVE-2024-35962
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-2673 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net: hamradio: fix memory leak in mkiss_close

My local syzbot instance hit memory leak in mkiss_open()[1]. The problem was in missing free_netdev() in mkiss_close().

In mkiss_open() netdevice is allocated and then registered, but in mkiss_close() netdevice was only unregistered, but not freed.

Fail log:

BUG: memory leak unreferenced object 0xffff8880281ba000 (size 4096): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 61 78 30 00 00 00 00 00 00 00 00 00 00 00 00 00 ax0............. 00 27 fa 2a 80 88 ff ff 00 00 00 00 00 00 00 00 .'.*............ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706e7e8>] alloc_netdev_mqs+0x98/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak unreferenced object 0xffff8880141a9a00 (size 96): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): e8 a2 1b 28 80 88 ff ff e8 a2 1b 28 80 88 ff ff ...(.......(.... 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... backtrace: [<ffffffff8709f68b>] __hw_addr_create_ex+0x5b/0x310 [<ffffffff8709fb38>] __hw_addr_add_ex+0x1f8/0x2b0 [<ffffffff870a0c7b>] dev_addr_init+0x10b/0x1f0 [<ffffffff8706e88b>] alloc_netdev_mqs+0x13b/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak unreferenced object 0xffff8880219bfc00 (size 512): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 a0 1b 28 80 88 ff ff 80 8f b1 8d ff ff ff ff ...(............ 80 8f b1 8d ff ff ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706eec7>] alloc_netdev_mqs+0x777/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak unreferenced object 0xffff888029b2b200 (size 256): comm "syz-executor.1", pid 11443, jiffies 4295046091 (age 17.660s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81a27201>] kvmalloc_node+0x61/0xf0 [<ffffffff8706f062>] alloc_netdev_mqs+0x912/0xe80 [<ffffffff84e64192>] mkiss_open+0xb2/0x6f0 [1] [<ffffffff842355db>] tty_ldisc_open+0x9b/0x110 [<ffffffff84236488>] tty_set_ldisc+0x2e8/0x670 [<ffffffff8421f7f3>] tty_ioctl+0xda3/0x1440 [<ffffffff81c9f273>] __x64_sys_ioctl+0x193/0x200 [<ffffffff8911263a>] do_syscall_64+0x3a/0xb0 [<ffffffff89200068>]…

Record: OESA-2026-2673
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:5066 7.1

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5066
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:5067 7.1

Red Hat Security Advisory: kernel-rt security update

Record: RHSA-2024:5067
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:5101 7.8

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5101
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:5928 7.1

Red Hat Security Advisory: kernel security update

Record: RHSA-2024:5928
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-35962 5.5

Record: UBUNTU-CVE-2024-35962
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVALSA-2024:5928 No score

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: nftables: nft_set_rbtree skip end interval element from gc (CVE-2024-26581)
kernel: netfilter: nft_limit: reject configurations that cause integer overflow (CVE-2024-26668)
kernel: vfio/pci: Lock external INTx masking ops (CVE-2024-26810)
kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CVE-2024-26855)
kernel: x86/xen: Add some null pointer checking to smp.c (CVE-2024-26908)
kernel: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (CVE-2024-26925)
kernel: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020)
kernel: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019)
kernel: netfilter: flowtable: validate pppoe header (CVE-2024-27016)
kernel: netfilter: bridge: confirm multicast packets before passing them up the stack (CVE-2024-27415)
kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)
kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)
kernel: netfilter: nf_tables: discard table flag update with pending basechain deletion (CVE-2024-35897)
kernel: netfilter: validate user input for expected length (CVE-2024-35896)
kernel: netfilter: complete validation of user input (CVE-2024-35962)
kernel: ice: fix LAG and VF lock dependency in ice_reset_vf() (CVE-2024-36003)
kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race (CVE-2023-52771)
kernel: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (CVE-2023-52880)
kernel: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (CVE-2024-36025)
kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)
kernel: crypto: bcm - Fix pointer arithmetic (CVE-2024-38579)
kernel: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (CVE-2024-38544)
kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)
kernel: net: bridge: xmit: make sure we have at least eth header len bytes (CVE-2024-38538)
kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (CVE-2024-39476)
kernel: ipv6: fix possible race in __fib6_drop_pcpu_from() (CVE-2024-40905)
kernel: wifi: cfg80211: Lock wiphy in cfg80211_get_station (CVE-2024-40911)
kernel: wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CVE-2024-40912)
kernel: mm/huge_memory: don't unpoison huge_zero_folio (CVE-2024-40914)
kernel: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CVE-2024-40929)
kernel: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (CVE-2024-40939)
kernel: wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CVE-2024-40941)
kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (CVE-2024-40957)
kernel: scsi: qedi: Fix crash while reading debugfs attribute (CVE-2024-40978)
kernel: tipc: force a dst refcount before doing decryption (CVE-2024-40983)
kernel: virtio-net: tap: mlx5_core short frame denial of service (CVE-2024-41090)
kernel: virtio-net: tun: mlx5_core short frame denial of service (CVE-2024-41091)
kernel: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port() (CVE-2024-41041)
kernel: NFSv4: Fix memory leak in nfs4_set_security_label (CVE-2024-41076)
kernel: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (CVE-2024-42110)
kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:5928
Updated: 2026-11-02

OSVCLSA-2024-1725293298 No score

kernel: Fix of 37 CVEs

tun: add missing verification for short frame {CVE-2024-41091}
tap: add missing verification for short frame {CVE-2024-41090}
drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
net: fix __dst_negative_advice() race {CVE-2024-36971}
net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
net: fix out-of-bounds access in ops_init {CVE-2024-36883}
net/sched: flower: Fix chain template offload {CVE-2024-26669}
netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
wait: add wake_up_pollfree() {CVE-2023-52707}
x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
netfilter: complete validation of user input {CVE-2024-35962}
SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
netfilter: validate user input for expected length {CVE-2024-35896}
virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
gro: fix ownership transfer {CVE-2024-35890}
mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
ata: libata-core: Fix double free on error {CVE-2024-41087}
netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
tcp_metrics: validate source addr length {CVE-2024-42154}

Record: CLSA-2024-1725293298
Updated: 2026-11-02

OSVCLSA-2024-1727690025 No score

kernel: Fix of 80 CVEs

sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
nvme: avoid double free special payload {CVE-2024-41073}
wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
selinux: fix double free of cond_list on error paths {CVE-2022-48740}
ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
x86/entry: Rename ignore_sysret() {CVE-2024-25744}
x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
x86: Introduce ia32_enabled() {CVE-2024-25744}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
hwmon: (w83793) Fix NULL pointer…

Record: CLSA-2024-1727690025
Updated: 2026-11-02

OSVCLSA-2024-1727690947 No score

kernel: Fix of 80 CVEs

sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
mISDN: Fix a use after free in hfcmulti_tx() {CVE-2024-42280}
nvme: avoid double free special payload {CVE-2024-41073}
wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
xfs: don't walk off the end of a directory data block {CVE-2024-41013}
tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
KVM: x86/mmu: make apf token non-zero to fix bug {CVE-2022-48943}
cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919}
netfilter: fix use-after-free in __nf_register_net_hook() {CVE-2022-48912}
rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() {CVE-2022-48742}
selinux: fix double free of cond_list on error paths {CVE-2022-48740}
ALSA: hda: Fix UAF of leds class devs at unbinding {CVE-2022-48735}
drm/nouveau: fix off by one in BIOS boundary checking {CVE-2022-48732}
mm, slub: fix potential memoryleak in kmem_cache_open() {CVE-2021-47466}
x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25744}
x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
x86/entry: Rename ignore_sysret() {CVE-2024-25744}
x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
x86: Introduce ia32_enabled() {CVE-2024-25744}
x86/asm/64: Change all ENTRY+END to SYM_CODE_* {CVE-2024-25744}
x86/head/64: Annotate start_cpu0() as non-callable {CVE-2024-25744}
x86/asm: Do not annotate functions with GLOBAL {CVE-2024-25744}
kprobes/x86/xen: blacklist non-attachable xen interrupt functions {CVE-2024-25744}
x86/asm/64: Add ENDs to some functions and relabel with SYM_CODE_* {CVE-2024-25744}
x86/asm: Use SYM_INNER_LABEL instead of GLOBAL {CVE-2024-25744}
x86/asm: Annotate aliases {CVE-2024-25744}
x86/asm/crypto: Annotate local functions {CVE-2024-25744}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer…

Record: CLSA-2024-1727690947
Updated: 2026-11-02

OSVCLSA-2024-1727815919 No score

kernel: Fix of 73 CVEs

firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
scsi: qedf: Make qedf_execute_tmf() non-preemptible {CVE-2024-42124}
ftruncate: pass a signed offset {CVE-2024-42084}
firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor {CVE-2024-41035}
xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
udp: do not accept non-tunnel GSO skbs landing in a tunnel {CVE-2024-35884}
nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
drm/amdgpu: Fix the null pointer when load rlc firmware {CVE-2024-26649}
Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
ACPI: LPIT: Avoid u32 multiplication overflow {CVE-2023-52683}
ACPI: extlog: fix NULL pointer dereference check {CVE-2023-52605}
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
USB: core: Fix hang in usb_kill_urb by adding memory barriers {CVE-2022-48760}
phylib: fix potential use-after-free {CVE-2022-48754}
serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
mlxsw: thermal: Fix out-of-bounds memory accesses {CVE-2021-47441}
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs {CVE-2021-47393}
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47384}
virtio-net: Add validation for used length {CVE-2021-47352}
fbmem: Do not delete the mode that is still in use {CVE-2021-47338}
watchdog: Fix possible use-after-free by calling del_timer_sync() {CVE-2021-47321}
ACPI: fix NULL pointer dereference {CVE-2021-47289}
driver core: auxiliary bus: Fix memory leak when driver_register() fail {CVE-2021-47287}
Input: elantech - fix stack out of bound access in elantech_change_report_id() {CVE-2021-47097}
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts {CVE-2022-48866}
ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet {CVE-2024-39506}
vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
net: openvswitch: fix overwriting ct original tuple for ICMPv6…

Record: CLSA-2024-1727815919
Updated: 2026-11-02

OSVCLSA-2026-1771078945 No score

kernel: Fix of 131 CVEs

net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
xfrm: Duplicate SPI Handling {CVE-2025-39797}
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
nfs: fix UAF in direct writes {CVE-2024-26958}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
loop: Fix use-after-free issues {CVE-2023-53111}
media: rc: fix races with imon_disconnect() {CVE-2025-39993}
fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
sctp: handle the error returned from sctp_auth_asoc_init_active_key {CVE-2022-50243}
crypto: qat - resolve race condition during AER recovery {CVE-2024-39493}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
netfilter: validate user input for expected length {CVE-2024-35962}
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
pid: take a reference when initializing cad_pid {CVE-2021-47118}
wifi: cfg80211: check A-MSDU format more carefully…

Record: CLSA-2026-1771078945
Updated: 2026-11-02

OSVSUSE-SU-2024:2360-1 No score