{"id":"CVE-2024-56686","aliases":["EUVD-2024-53334","GHSA-4rq6-qv3v-654p","OESA-2025-1033","OESA-2025-1035","OESA-2025-1037","OESA-2025-1110","UBUNTU-CVE-2024-56686"],"status":"rejected","title":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race in...","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2024-12-28T09:46:13Z","modified":"2026-11-10T02:49:47Z","affected":[{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-245.0.0.147.oe2203sp3"}]}],"bundled":58},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.108.0.188.oe2203sp1"}]}],"bundled":60},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-245.0.0.144.oe2203sp4"}]}],"bundled":57},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.0-77.0.0.70.oe2403"}]}],"bundled":36},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-aws-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1018.18~18.04.1","5.4.0-1020.20~18.04.2","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.30~18.04.1","5.4.0-1030.31~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1038.40~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1045.47~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1058.61~18.04.3","5.4.0-1059.62~18.04.1","5.4.0-1060.63~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1081.88~18.04.1","5.4.0-1083.90~18.04.1","5.4.0-1084.91~18.04.1","5.4.0-1085.92~18.04.1","5.4.0-1086.93~18.04.1","5.4.0-1088.96~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1090.98~18.04.1","5.4.0-1092.100~18.04.2","5.4.0-1093.102~18.04.2","5.4.0-1094.102~18.04.1","5.4.0-1096.104~18.04.1","5.4.0-1097.105~18.04.1","5.4.0-1099.107~18.04.1","5.4.0-1100.108~18.04.1","5.4.0-1101.109~18.04.1","5.4.0-1103.111~18.04.1","5.4.0-1104.112~18.04.1","5.4.0-1105.113~18.04.1","5.4.0-1106.114~18.04.1","5.4.0-1107.115~18.04.1","5.4.0-1108.116~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.2","5.4.0-1113.123~18.04.1","5.4.0-1114.124~18.04.1","5.4.0-1116.126~18.04.1","5.4.0-1117.127~18.04.1","5.4.0-1118.128~18.04.1","5.4.0-1119.129~18.04.1","5.4.0-1120.130~18.04.1","5.4.0-1121.131~18.04.1","5.4.0-1122.132~18.04.1","5.4.0-1123.133~18.04.1","5.4.0-1124.134~18.04.1","5.4.0-1125.135~18.04.1","5.4.0-1126.136~18.04.1","5.4.0-1127.137~18.04.2","5.4.0-1128.138~18.04.1","5.4.0-1129.139~18.04.1","5.4.0-1130.140~18.04.1","5.4.0-1131.141~18.04.1","5.4.0-1132.142~18.04.1","5.4.0-1133.143~18.04.1","5.4.0-1134.144~18.04.1","5.4.0-1135.145~18.04.1","5.4.0-1136.146~18.04.1","5.4.0-1137.147~18.04.1","5.4.0-1139.149~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1147.157~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1153.163~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1156.166~18.04.1","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1160.170~18.04.1","5.4.0-1161.172~18.04.1","5.4.0-1162.173~18.04.1","5.4.0-1163.174~18.04.1","5.4.0-1165.176~18.04.1","5.4.0-1167.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-azure-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1020.20~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1023.23~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1026.26~18.04.1","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1035.36~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1041.43~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1047.49~18.04.1","5.4.0-1048.50~18.04.1","5.4.0-1049.51~18.04.1","5.4.0-1051.53~18.04.1","5.4.0-1055.57~18.04.1","5.4.0-1056.58~18.04.1","5.4.0-1058.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1064.67~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1069.72~18.04.1","5.4.0-1070.73~18.04.1","5.4.0-1072.75~18.04.1","5.4.0-1073.76~18.04.1","5.4.0-1074.77~18.04.1","5.4.0-1077.80~18.04.1","5.4.0-1078.81~18.04.1","5.4.0-1080.83~18.04.2","5.4.0-1083.87~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1089.94~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1091.96~18.04.1","5.4.0-1094.100~18.04.1","5.4.0-1095.101~18.04.1","5.4.0-1098.104~18.04.2","5.4.0-1100.106~18.04.1","5.4.0-1101.107~18.04.1","5.4.0-1103.109~18.04.1","5.4.0-1104.110~18.04.1","5.4.0-1105.111~18.04.1","5.4.0-1106.112~18.04.1","5.4.0-1107.113~18.04.1","5.4.0-1108.114~18.04.1","5.4.0-1109.115~18.04.1","5.4.0-1110.116~18.04.1","5.4.0-1111.117~18.04.1","5.4.0-1112.118~18.04.1","5.4.0-1113.119~18.04.1","5.4.0-1115.122~18.04.1","5.4.0-1116.123~18.04.1","5.4.0-1117.124~18.04.1","5.4.0-1118.125~18.04.1","5.4.0-1119.126~18.04.2","5.4.0-1120.127~18.04.1","5.4.0-1121.128~18.04.1","5.4.0-1122.129~18.04.1","5.4.0-1123.130~18.04.1","5.4.0-1124.131~18.04.1","5.4.0-1126.133~18.04.1","5.4.0-1127.134~18.04.1","5.4.0-1128.135~18.04.1","5.4.0-1129.136~18.04.1","5.4.0-1130.137~18.04.1","5.4.0-1131.138~18.04.1","5.4.0-1132.139~18.04.1","5.4.0-1133.140~18.04.1","5.4.0-1134.141~18.04.1","5.4.0-1135.142~18.04.1","5.4.0-1136.143~18.04.1","5.4.0-1137.144~18.04.1","5.4.0-1138.145~18.04.1","5.4.0-1139.146~18.04.1","5.4.0-1140.147~18.04.1","5.4.0-1142.149~18.04.1","5.4.0-1143.150~18.04.1","5.4.0-1145.152~18.04.1","5.4.0-1147.154~18.04.1","5.4.0-1148.155~18.04.1","5.4.0-1149.156~18.04.1","5.4.0-1150.157~18.04.1","5.4.0-1151.158~18.04.1","5.4.0-1152.159~18.04.1","5.4.0-1153.160~18.04.1","5.4.0-1154.161~18.04.1","5.4.0-1156.163~18.04.1","5.4.0-1157.164~18.04.1","5.4.0-1161.167~18.04.1","5.4.0-1162.168~18.04.1","5.4.0-1163.169~18.04.1","5.4.0-1164.170~18.04.1","5.4.0-1166.172~18.04.1","5.4.0-1167.173~18.04.1","5.4.0-1168.174~18.04.1","5.4.0-1169.175~18.04.1","5.4.0-1170.176~18.04.1","5.4.0-1171.177~18.04.1","5.4.0-1172.178~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-gcp-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.2","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1040.43~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.2","5.4.0-1046.49~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1051.55~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1060.64~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1065.69~18.04.1","5.4.0-1067.71~18.04.1","5.4.0-1068.72~18.04.1","5.4.0-1069.73~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.87~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.94~18.04.1","5.4.0-1087.95~18.04.1","5.4.0-1089.97~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1096.105~18.04.2","5.4.0-1097.106~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.2","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.1","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1128.137~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1139.148~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.150~18.04.1","5.4.0-1142.151~18.04.1","5.4.0-1143.152~18.04.1","5.4.0-1145.154~18.04.1","5.4.0-1147.156~18.04.1","5.4.0-1148.157~18.04.1","5.4.0-1149.158~18.04.1","5.4.0-1150.159~18.04.1","5.4.0-1151.160~18.04.1","5.4.0-1152.161~18.04.1","5.4.0-1153.162~18.04.1","5.4.0-1154.163~18.04.1","5.4.0-1155.164~18.04.1","5.4.0-1156.165~18.04.1","5.4.0-1157.166~18.04.1","5.4.0-1159.168~18.04.1","5.4.0-1160.169~18.04.1","5.4.0-1161.170~18.04.1","5.4.0-1162.171~18.04.1","5.4.0-1163.172~18.04.1","5.4.0-1164.173~18.04.1","5.4.0-1165.174~18.04.1","5.4.0-1166.175~18.04.1","5.4.0-1167.176~18.04.1","5.4.0-1168.178~18.04.1","5.4.0-1169.179~18.04.1","5.4.0-1170.180~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-hwe-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-37.41~18.04.1","5.4.0-39.43~18.04.1","5.4.0-40.44~18.04.1","5.4.0-42.46~18.04.1","5.4.0-45.49~18.04.2","5.4.0-47.51~18.04.1","5.4.0-48.52~18.04.1","5.4.0-51.56~18.04.1","5.4.0-52.57~18.04.1","5.4.0-53.59~18.04.1","5.4.0-54.60~18.04.1","5.4.0-56.62~18.04.1","5.4.0-58.64~18.04.1","5.4.0-59.65~18.04.1","5.4.0-60.67~18.04.1","5.4.0-62.70~18.04.1","5.4.0-64.72~18.04.1","5.4.0-65.73~18.04.1","5.4.0-66.74~18.04.2","5.4.0-67.75~18.04.1","5.4.0-70.78~18.04.1","5.4.0-71.79~18.04.1","5.4.0-72.80~18.04.1","5.4.0-73.82~18.04.1","5.4.0-74.83~18.04.1","5.4.0-77.86~18.04.1","5.4.0-80.90~18.04.1","5.4.0-81.91~18.04.1","5.4.0-84.94~18.04.1","5.4.0-86.97~18.04.1","5.4.0-87.98~18.04.1","5.4.0-89.100~18.04.1","5.4.0-90.101~18.04.1","5.4.0-91.102~18.04.1","5.4.0-92.103~18.04.2","5.4.0-94.106~18.04.1","5.4.0-96.109~18.04.1","5.4.0-97.110~18.04.1","5.4.0-99.112~18.04.1","5.4.0-100.113~18.04.1","5.4.0-104.118~18.04.1","5.4.0-105.119~18.04.1","5.4.0-107.121~18.04.1","5.4.0-109.123~18.04.1","5.4.0-110.124~18.04.1","5.4.0-113.127~18.04.1","5.4.0-117.132~18.04.1","5.4.0-120.136~18.04.1","5.4.0-121.137~18.04.1","5.4.0-122.138~18.04.1","5.4.0-124.140~18.04.1","5.4.0-125.141~18.04.1","5.4.0-126.142~18.04.1","5.4.0-128.144~18.04.1","5.4.0-131.147~18.04.1","5.4.0-132.148~18.04.1","5.4.0-133.149~18.04.1","5.4.0-135.152~18.04.2","5.4.0-136.153~18.04.1","5.4.0-137.154~18.04.1","5.4.0-139.156~18.04.1","5.4.0-144.161~18.04.1","5.4.0-146.163~18.04.1","5.4.0-147.164~18.04.1","5.4.0-148.165~18.04.1","5.4.0-149.166~18.04.1","5.4.0-150.167~18.04.1","5.4.0-152.169~18.04.1","5.4.0-153.170~18.04.1","5.4.0-155.172~18.04.1","5.4.0-156.173~18.04.1","5.4.0-159.176~18.04.1","5.4.0-162.179~18.04.1","5.4.0-163.180~18.04.1","5.4.0-164.181~18.04.1","5.4.0-165.182~18.04.1","5.4.0-166.183~18.04.2","5.4.0-167.184~18.04.1","5.4.0-169.187~18.04.1","5.4.0-170.188~18.04.1","5.4.0-171.189~18.04.1","5.4.0-172.190~18.04.1","5.4.0-173.191~18.04.1","5.4.0-174.193~18.04.1","5.4.0-175.195~18.04.1","5.4.0-177.197~18.04.1","5.4.0-181.201~18.04.1","5.4.0-182.202~18.04.1","5.4.0-186.206~18.04.1","5.4.0-187.207~18.04.1","5.4.0-189.209~18.04.1","5.4.0-190.210~18.04.1","5.4.0-192.212~18.04.1","5.4.0-193.213~18.04.1","5.4.0-195.215~18.04.1","5.4.0-196.216~18.04.1","5.4.0-198.218~18.04.1","5.4.0-200.220~18.04.1","5.4.0-202.222~18.04.1","5.4.0-204.224~18.04.1","5.4.0-205.225~18.04.1","5.4.0-208.228~18.04.1","5.4.0-211.231~18.04.1","5.4.0-212.232~18.04.1","5.4.0-214.234~18.04.1","5.4.0-215.235~18.04.1","5.4.0-216.236~18.04.1","5.4.0-218.238~18.04.1","5.4.0-219.239~18.04.1","5.4.0-220.240~18.04.1","5.4.0-221.241~18.04.1","5.4.0-222.242~18.04.1","5.4.0-223.243~18.04.1","5.4.0-224.244~18.04.1","5.4.0-225.245~18.04.1","5.4.0-227.247~18.04.1","5.4.0-228.248~18.04.1","5.4.0-229.249~18.04.1","5.4.0-231.251~18.04.1","5.4.0-233.253~18.04.1","5.4.0-234.254~18.04.1","5.4.0-238.258~18.04.1","5.4.0-241.261~18.04.1","5.4.0-242.262~18.04.1","5.4.0-244.264~18.04.1","5.4.0-245.265~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-ibm-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1010.11~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1017.19~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1020.22~18.04.1","5.4.0-1021.23~18.04.1","5.4.0-1023.25~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.32~18.04.1","5.4.0-1029.33~18.04.1","5.4.0-1031.35~18.04.1","5.4.0-1032.36~18.04.1","5.4.0-1033.37~18.04.1","5.4.0-1034.38~18.04.1","5.4.0-1036.41~18.04.1","5.4.0-1037.42~18.04.1","5.4.0-1040.45~18.04.2","5.4.0-1041.46~18.04.1","5.4.0-1042.47~18.04.1","5.4.0-1044.49~18.04.1","5.4.0-1045.50~18.04.1","5.4.0-1046.51~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1049.54~18.04.1","5.4.0-1050.55~18.04.1","5.4.0-1051.56~18.04.1","5.4.0-1052.57~18.04.1","5.4.0-1053.58~18.04.1","5.4.0-1054.59~18.04.1","5.4.0-1056.61~18.04.1","5.4.0-1057.62~18.04.1","5.4.0-1058.63~18.04.1","5.4.0-1059.64~18.04.1","5.4.0-1060.65~18.04.1","5.4.0-1061.66~18.04.1","5.4.0-1063.68~18.04.1","5.4.0-1064.69~18.04.1","5.4.0-1065.70~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1068.73~18.04.1","5.4.0-1069.74~18.04.1","5.4.0-1070.75~18.04.1","5.4.0-1071.76~18.04.1","5.4.0-1072.77~18.04.1","5.4.0-1073.78~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1075.80~18.04.1","5.4.0-1076.81~18.04.1","5.4.0-1077.82~18.04.1","5.4.0-1078.83~18.04.1","5.4.0-1079.84~18.04.1","5.4.0-1080.85~18.04.1","5.4.0-1081.86~18.04.1","5.4.0-1082.87~18.04.1","5.4.0-1083.88~18.04.1","5.4.0-1084.89~18.04.1","5.4.0-1085.90~18.04.1","5.4.0-1086.91~18.04.1","5.4.0-1090.95~18.04.1","5.4.0-1092.97~18.04.1","5.4.0-1093.98~18.04.1","5.4.0-1094.99~18.04.1","5.4.0-1095.100~18.04.1","5.4.0-1096.101~18.04.1","5.4.0-1097.102~18.04.1","5.4.0-1098.103~18.04.1","5.4.0-1099.104~18.04.1","5.4.0-1100.105~18.04.1","5.4.0-1102.107~18.04.1","5.4.0-1103.108~18.04.1","5.4.0-1104.109~18.04.1","5.4.0-1105.110~18.04.1","5.4.0-1107.112~18.04.1","5.4.0-1108.113~18.04.1","5.4.0-1109.114~18.04.1","5.4.0-1111.116~18.04.1","5.4.0-1112.117~18.04.1","5.4.0-1113.118~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-oracle-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1019.19~18.04.1","5.4.0-1021.21~18.04.1","5.4.0-1022.22~18.04.1","5.4.0-1024.24~18.04.1","5.4.0-1025.25~18.04.1","5.4.0-1028.29~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1033.35","5.4.0-1034.36~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1037.40~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1039.42~18.04.1","5.4.0-1041.44~18.04.1","5.4.0-1042.45~18.04.1","5.4.0-1043.46~18.04.1","5.4.0-1044.47~18.04.1","5.4.0-1046.50~18.04.2","5.4.0-1048.52~18.04.1","5.4.0-1049.53~18.04.1","5.4.0-1052.56~18.04.1","5.4.0-1053.57~18.04.1","5.4.0-1054.58~18.04.1","5.4.0-1055.59~18.04.1","5.4.0-1056.60~18.04.1","5.4.0-1057.61~18.04.1","5.4.0-1058.62~18.04.1","5.4.0-1059.63~18.04.1","5.4.0-1061.65~18.04.1","5.4.0-1062.66~18.04.1","5.4.0-1063.67~18.04.1","5.4.0-1064.68~18.04.1","5.4.0-1066.71~18.04.1","5.4.0-1067.72~18.04.1","5.4.0-1069.75~18.04.1","5.4.0-1070.76~18.04.1","5.4.0-1071.77~18.04.1","5.4.0-1073.79~18.04.1","5.4.0-1076.83~18.04.1","5.4.0-1078.86~18.04.1","5.4.0-1079.87~18.04.1","5.4.0-1081.89~18.04.1","5.4.0-1082.90~18.04.1","5.4.0-1083.91~18.04.1","5.4.0-1084.92~18.04.1","5.4.0-1086.95~18.04.1","5.4.0-1087.96~18.04.1","5.4.0-1090.99~18.04.2","5.4.0-1091.100~18.04.1","5.4.0-1092.101~18.04.1","5.4.0-1093.102~18.04.1","5.4.0-1094.103~18.04.1","5.4.0-1098.107~18.04.1","5.4.0-1099.108~18.04.1","5.4.0-1100.109~18.04.1","5.4.0-1101.110~18.04.1","5.4.0-1102.111~18.04.1","5.4.0-1103.112~18.04.1","5.4.0-1104.113~18.04.1","5.4.0-1105.114~18.04.1","5.4.0-1106.115~18.04.1","5.4.0-1107.116~18.04.1","5.4.0-1108.117~18.04.1","5.4.0-1109.118~18.04.1","5.4.0-1110.119~18.04.1","5.4.0-1111.120~18.04.1","5.4.0-1112.121~18.04.4","5.4.0-1113.122~18.04.1","5.4.0-1115.124~18.04.1","5.4.0-1116.125~18.04.1","5.4.0-1117.126~18.04.1","5.4.0-1118.127~18.04.1","5.4.0-1119.128~18.04.1","5.4.0-1120.129~18.04.1","5.4.0-1121.130~18.04.1","5.4.0-1122.131~18.04.1","5.4.0-1123.132~18.04.1","5.4.0-1124.133~18.04.1","5.4.0-1125.134~18.04.1","5.4.0-1126.135~18.04.1","5.4.0-1127.136~18.04.1","5.4.0-1129.138~18.04.1","5.4.0-1130.139~18.04.1","5.4.0-1131.140~18.04.1","5.4.0-1132.141~18.04.1","5.4.0-1133.142~18.04.1","5.4.0-1134.143~18.04.1","5.4.0-1135.144~18.04.1","5.4.0-1136.145~18.04.1","5.4.0-1137.146~18.04.1","5.4.0-1138.147~18.04.1","5.4.0-1140.149~18.04.1","5.4.0-1141.151~18.04.1","5.4.0-1142.152~18.04.1","5.4.0-1143.153~18.04.1","5.4.0-1144.154~18.04.1","5.4.0-1145.155~18.04.1","5.4.0-1146.156~18.04.1","5.4.0-1148.158~18.04.1","5.4.0-1149.159~18.04.1","5.4.0-1150.160~18.04.1","5.4.0-1151.161~18.04.1","5.4.0-1152.162~18.04.1","5.4.0-1154.164~18.04.1","5.4.0-1155.165~18.04.1","5.4.0-1156.166~18.04.2","5.4.0-1157.167~18.04.1","5.4.0-1158.168~18.04.1","5.4.0-1159.169~18.04.1","5.4.0-1161.171~18.04.1","5.4.0-1162.172~18.04.1","5.4.0-1163.173~18.04.1","5.4.0-1164.174~18.04.1","5.4.0-1165.175~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"linux-raspi-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1013.13~18.04.1","5.4.0-1015.15~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.20~18.04.1","5.4.0-1019.21~18.04.1","5.4.0-1021.24~18.04.1","5.4.0-1022.25~18.04.1","5.4.0-1023.26~18.04.1","5.4.0-1025.28~18.04.1","5.4.0-1026.29~18.04.1","5.4.0-1028.31~18.04.1","5.4.0-1029.32~18.04.1","5.4.0-1030.33~18.04.1","5.4.0-1032.35~18.04.1","5.4.0-1033.36~18.04.1","5.4.0-1034.37~18.04.1","5.4.0-1035.38~18.04.1","5.4.0-1036.39~18.04.1","5.4.0-1038.41~18.04.1","5.4.0-1041.45~18.04.1","5.4.0-1042.46~18.04.3","5.4.0-1043.47~18.04.1","5.4.0-1044.48~18.04.1","5.4.0-1045.49~18.04.1","5.4.0-1046.50~18.04.1","5.4.0-1047.52~18.04.1","5.4.0-1048.53~18.04.1","5.4.0-1050.56~18.04.1","5.4.0-1052.58~18.04.1","5.4.0-1053.60~18.04.1","5.4.0-1055.62~18.04.1","5.4.0-1056.63~18.04.1","5.4.0-1058.65~18.04.1","5.4.0-1059.66~18.04.1","5.4.0-1060.68~18.04.1","5.4.0-1062.70~18.04.1","5.4.0-1065.75~18.04.1","5.4.0-1066.76~18.04.1","5.4.0-1068.78~18.04.1","5.4.0-1069.79~18.04.1","5.4.0-1070.80~18.04.1","5.4.0-1071.81~18.04.1","5.4.0-1073.84~18.04.1","5.4.0-1074.85~18.04.1","5.4.0-1077.88~18.04.2","5.4.0-1078.89~18.04.1","5.4.0-1079.90~18.04.1","5.4.0-1080.91~18.04.1","5.4.0-1081.92~18.04.1","5.4.0-1082.93~18.04.1","5.4.0-1083.94~18.04.1","5.4.0-1084.95~18.04.1","5.4.0-1085.96~18.04.1","5.4.0-1086.97~18.04.1","5.4.0-1088.99~18.04.1","5.4.0-1089.100~18.04.1","5.4.0-1090.101~18.04.1","5.4.0-1091.102~18.04.1","5.4.0-1092.103~18.04.1","5.4.0-1093.104~18.04.1","5.4.0-1094.105~18.04.1","5.4.0-1095.106~18.04.1","5.4.0-1096.107~18.04.1","5.4.0-1097.109~18.04.2","5.4.0-1098.110~18.04.2","5.4.0-1100.112~18.04.1","5.4.0-1101.113~18.04.1","5.4.0-1102.114~18.04.1","5.4.0-1103.115~18.04.1","5.4.0-1104.116~18.04.1","5.4.0-1105.117~18.04.1","5.4.0-1106.118~18.04.1","5.4.0-1107.119~18.04.1","5.4.0-1108.120~18.04.1","5.4.0-1109.121~18.04.1","5.4.0-1110.122~18.04.1","5.4.0-1111.123~18.04.1","5.4.0-1112.124~18.04.1","5.4.0-1114.126~18.04.1","5.4.0-1115.127~18.04.1","5.4.0-1116.128~18.04.1","5.4.0-1117.129~18.04.1","5.4.0-1118.130~18.04.1","5.4.0-1119.131~18.04.1","5.4.0-1120.132~18.04.1","5.4.0-1121.133~18.04.1","5.4.0-1122.134~18.04.1","5.4.0-1129.142~18.04.1","5.4.0-1130.143~18.04.1","5.4.0-1131.144~18.04.1","5.4.0-1132.145~18.04.1","5.4.0-1133.146~18.04.1","5.4.0-1134.147~18.04.1","5.4.0-1135.148~18.04.1","5.4.0-1136.149~18.04.1","5.4.0-1137.150~18.04.1","5.4.0-1139.152~18.04.1","5.4.0-1140.153~18.04.1","5.4.0-1143.156~18.04.1","5.4.0-1144.157~18.04.1","5.4.0-1145.158~18.04.1","5.4.0-1146.159~18.04.1","5.4.0-1147.160~18.04.1","5.4.0-1148.161~18.04.1","5.4.0-1149.162~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1008.9","5.4.0-1009.10","5.4.0-1010.11","5.4.0-1011.12","5.4.0-1012.13","5.4.0-1013.14","5.4.0-1014.15","5.4.0-1015.16","5.4.0-1016.17","5.4.0-1018.19","5.4.0-1021.22","5.4.0-1022.23","5.4.0-1023.24","5.4.0-1024.25","5.4.0-1025.26","5.4.0-1026.27","5.4.0-1027.28","5.4.0-1029.30","5.4.0-1031.32","5.4.0-1032.33","5.4.0-1033.34","5.4.0-1034.35","5.4.0-1036.37","5.4.0-1037.38","5.4.0-1038.39","5.4.0-1039.40","5.4.0-1040.41","5.4.0-1043.44","5.4.0-1046.48","5.4.0-1048.51","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1056.60","5.4.0-1057.61","5.4.0-1060.64","5.4.0-1061.65","5.4.0-1062.66","5.4.0-1064.68","5.4.0-1065.69","5.4.0-1066.70","5.4.0-1067.71","5.4.0-1068.72","5.4.0-1069.73","5.4.0-1070.74","5.4.0-1071.75","5.4.0-1072.76","5.4.0-1073.77","5.4.0-1074.78","5.4.0-1075.79","5.4.0-1076.80","5.4.0-1077.81","5.4.0-1078.82","5.4.0-1079.83","5.4.0-1080.84","5.4.0-1081.85","5.4.0-1083.87","5.4.0-1084.88","5.4.0-1085.89","5.4.0-1086.90","5.4.0-1087.91","5.4.0-1088.92","5.4.0-1089.93","5.4.0-1090.94","5.4.0-1091.95","5.4.0-1092.96","5.4.0-1093.97","5.4.0-1094.98","5.4.0-1095.99","5.4.0-1096.100","5.4.0-1097.101","5.4.0-1098.102","5.4.0-1099.103","5.4.0-1100.104","5.4.0-1101.105","5.4.0-1102.106"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gkeop-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1003.5~20.04.2","5.15.0-1005.7~20.04.1","5.15.0-1007.10~20.04.1","5.15.0-1008.12~20.04.1","5.15.0-1011.15~20.04.2","5.15.0-1012.16~20.04.1","5.15.0-1013.17~20.04.1","5.15.0-1015.19~20.04.1","5.15.0-1016.21~20.04.1","5.15.0-1017.22~20.04.1","5.15.0-1018.23~20.04.1","5.15.0-1019.24~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1021.26~20.04.1","5.15.0-1022.27~20.04.1","5.15.0-1023.28~20.04.1","5.15.0-1024.29~20.04.1","5.15.0-1025.30~20.04.1","5.15.0-1026.31~20.04.1","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1030.35~20.04.1","5.15.0-1031.37~20.04.1","5.15.0-1032.38~20.04.1","5.15.0-1033.39~20.04.1","5.15.0-1034.40~20.04.1","5.15.0-1035.41~20.04.1","5.15.0-1036.42~20.04.1","5.15.0-1037.43~20.04.1","5.15.0-1038.44~20.04.1","5.15.0-1039.45~20.04.1","5.15.0-1040.46~20.04.1","5.15.0-1043.50~20.04.1","5.15.0-1044.51~20.04.1","5.15.0-1045.52~20.04.1","5.15.0-1046.53~20.04.1","5.15.0-1047.54~20.04.1","5.15.0-1048.55~20.04.1","5.15.0-1049.56~20.04.1","5.15.0-1050.57~20.04.1","5.15.0-1051.58~20.04.1","5.15.0-1052.59~20.04.1","5.15.0-1053.60~20.04.1","5.15.0-1054.61~20.04.1","5.15.0-1055.62~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1004.4","6.5.0-1007.7","6.5.0-1013.13","6.5.0-1014.14","6.5.0-1015.15","6.5.0-1018.18","6.5.0-1019.19","6.5.0-1021.22","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.1-1015.16"]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56686","tags":["advisory"]},{"url":"https://git.kernel.org/stable/c/25a5acf88fed59e060405bbb48098f4a3a2c2adc","tags":["report"]},{"url":"https://git.kernel.org/stable/c/2f3d93e210b9c2866c8b3662adae427d5bf511ec","tags":["report"]},{"url":"https://git.kernel.org/stable/c/61832ee7fa2fbd569d129379e795038abfb0d128","tags":["report"]},{"url":"https://git.kernel.org/stable/c/77035e4d27e15f87ea55929c8bb8fb1970129e2f","tags":["report"]},{"url":"https://github.com/advisories/GHSA-4rq6-qv3v-654p"},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47730","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50264","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53155","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53158","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53173","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53185","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53187","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53194","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53217","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53218","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53227","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56538","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56562","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56572","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56583","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56584","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56586","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56596","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56604","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56605","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56700","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56748","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56756","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56763","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49856","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53171","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56722","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1037","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1110","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-46832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-48873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50051","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52332","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53056","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53096","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53105","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56369","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57791","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57882","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57916","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57939","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57947","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21684","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-56686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56686","tags":["report"]},{"url":"https://git.kernel.org/linus/2f3d93e210b9c2866c8b3662adae427d5bf511ec","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-56686","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2024-12-28T09:46:13.429Z","modified":"2025-01-07T08:47:17.142Z","updated_at":"2026-11-02T14:33:57.983942Z"}],"euvd":[{"id":"EUVD-2024-53334","description":"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"published","published":"2024-12-28T09:46:13Z","modified":"2025-01-07T08:47:17Z","updated_at":"2026-11-03T00:04:25.174818Z"}],"ghsa":[{"id":"GHSA-4rq6-qv3v-654p","title":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race in...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix race in buffer_head read fault injection\n\nWhen I enabled ext4 debug for fault injection testing, I encountered the\nfollowing warning:\n\n  EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:\n         Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051\n  WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0\n\nThe root cause of the issue lies in the improper implementation of ext4's\nbuffer_head read fault injection. The actual completion of buffer_head\nread and the buffer_head fault injection are not atomic, which can lead\nto the uptodate flag being cleared on normally used buffer_heads in race\nconditions.\n\n[CPU0]           [CPU1]         [CPU2]\next4_read_inode_bitmap\n  ext4_read_bh()\n  \u003cbh read complete\u003e\n                 ext4_read_inode_bitmap\n                   if (buffer_uptodate(bh))\n                     return bh\n                               jbd2_journal_commit_transaction\n                                 __jbd2_journal_refile_buffer\n                                   __jbd2_journal_unfile_buffer\n                                     __jbd2_journal_temp_unlink_buffer\n  ext4_simulate_fail_bh()\n    clear_buffer_uptodate\n                                      mark_buffer_dirty\n                                        \u003creport warning\u003e\n                                        WARN_ON_ONCE(!buffer_uptodate(bh))\n\nThe best approach would be to perform fault injection in the IO completion\ncallback function, rather than after IO completion. However, the IO\ncompletion callback function cannot get the fault injection code in sb.\n\nFix it by passing the result of fault injection into the bh read function,\nwe simulate faults within the bh read function itself. This requires adding\nan extra parameter to the bh read functions that need fault injection.","status":"published","published":"2024-12-28T12:30:47Z","modified":"2024-12-28T12:30:53Z","updated_at":"2026-11-02T14:59:17.039565Z"}],"nvd":[{"id":"CVE-2024-56686","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"rejected","published":"2024-12-28T10:15:11.827Z","modified":"2026-10-16T14:10:00.12Z","updated_at":"2026-11-02T14:10:41.091507Z"}],"osv":[{"id":"OESA-2025-1033","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK  When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.  [    3.052463] ------------[ cut here ]------------ [    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [    3.070072] Modules linked in: efivarfs autofs4 [    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000 [    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [    3.195868]         ... [    3.199917] Call Trace: [    3.203941] [\u0026lt;90000000002086d8\u0026gt;] show_stack+0x38/0x14c [    3.210666] [\u0026lt;9000000000cf846c\u0026gt;] dump_stack_lvl+0x60/0x88 [    3.217625] [\u0026lt;900000000023d268\u0026gt;] __warn+0xd0/0x100 [    3.223958] [\u0026lt;9000000000cf3c90\u0026gt;] warn_slowpath_fmt+0x7c/0xcc [    3.231150] [\u0026lt;9000000000210220\u0026gt;] show_cpuinfo+0x5e8/0x5f0 [    3.238080] [\u0026lt;90000000004f578c\u0026gt;] seq_read_iter+0x354/0x4b4 [    3.245098] [\u0026lt;90000000004c2e90\u0026gt;] new_sync_read+0x17c/0x1c4 [    3.252114] [\u0026lt;90000000004c5174\u0026gt;] vfs_read+0x138/0x1d0 [    3.258694] [\u0026lt;90000000004c55f8\u0026gt;] ksys_read+0x70/0x100 [    3.265265] [\u0026lt;9000000000cfde9c\u0026gt;] do_syscall+0x7c/0x94 [    3.271820] [\u0026lt;9000000000202fe4\u0026gt;] handle_syscall+0xc4/0x160 [    3.281824] ---[ end trace 8b484262b4b8c24c ]---(CVE-2022-49034)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/qm - inject error before stopping queue  The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.(CVE-2024-47730)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Check null pointers before using dc-\u0026gt;clk_mgr  [WHY \u0026amp; HOW] dc-\u0026gt;clk_mgr is null checked previously in the same function, indicating it might be null.  Passing \u0026quot;dc\u0026quot; to \u0026quot;dc-\u0026gt;hwss.apply_idle_power_optimizations\u0026quot;, which dereferences null \u0026quot;dc-\u0026gt;clk_mgr\u0026quot;. (The function pointer resolves to \u0026quot;dcn35_apply_idle_power_optimizations\u0026quot;.)  This fixes 1 FORWARD_NULL issue reported by Coverity.(CVE-2024-49907)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix error path in multi-packet WQE transmit  Remove the erroneous unmap in case no DMA mapping was established  The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can\u0026apos;t allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq\u0026apos;s FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.  The erroneous behavior was seen in a stress-test environment that created memory pressure.(CVE-2024-50001)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: phy: dp83869: fix memory corruption when enabling fiber  When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 \u0026lt;\u0026lt; 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.  Since the advertising flags are updated from supported at the end of the function the incorrect line isn\u0026apos;t needed at all and can be removed.(CVE-2024-50188)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()  In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout \u0026gt; (clk_get_rate(st-\u0026gt;mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value.(CVE-2024-50233)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  vsock/virtio: Initialization of the dangling pointer occurring in vsk-\u0026gt;trans  During loopback communication, a dangling pointer can be created in vsk-\u0026gt;trans, potentially leading to a Use-After-Free condition.  This issue is resolved by initializing vsk-\u0026gt;trans to NULL.(CVE-2024-50264)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent a potential integer overflow  If the tag length is \u0026gt;= U32_MAX - 3 then the \u0026quot;length + 4\u0026quot; addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.(CVE-2024-53146)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  exfat: fix out-of-bounds access of directory entries  In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei-\u0026gt;hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption.  This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty.(CVE-2024-53147)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: fix uninitialized value in ocfs2_file_read_iter()  Syzbot has reported the following KMSAN splat:  BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80  ocfs2_file_read_iter+0x9a4/0xf80  __io_read+0x8d4/0x20f0  io_read+0x3e/0xf0  io_issue_sqe+0x42b/0x22c0  io_wq_submit_work+0xaf9/0xdc0  io_worker_handle_work+0xd13/0x2110  io_wq_worker+0x447/0x1410  ret_from_fork+0x6f/0x90  ret_from_fork_asm+0x1a/0x30  Uninit was created at:  __alloc_pages_noprof+0x9a7/0xe00  alloc_pages_mpol_noprof+0x299/0x990  alloc_pages_noprof+0x1bf/0x1e0  allocate_slab+0x33a/0x1250  ___slab_alloc+0x12ef/0x35e0  kmem_cache_alloc_bulk_noprof+0x486/0x1330  __io_alloc_req_refill+0x84/0x560  io_submit_sqes+0x172f/0x2f30  __se_sys_io_uring_enter+0x406/0x41c0  __x64_sys_io_uring_enter+0x11f/0x1a0  x64_sys_call+0x2b54/0x3ba0  do_syscall_64+0xcd/0x1e0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Since an instance of \u0026apos;struct kiocb\u0026apos; may be passed from the block layer with \u0026apos;private\u0026apos; field uninitialized, introduce \u0026apos;ocfs2_iocb_init_rw_locked()\u0026apos; and use it from where \u0026apos;ocfs2_dio_end_io()\u0026apos; might take care, i.e. in \u0026apos;ocfs2_file_read_iter()\u0026apos; and \u0026apos;ocfs2_file_write_iter()\u0026apos;.(CVE-2024-53155)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()  This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration.  However, that check doesn\u0026apos;t make sense on the first iteration through the loop. It leads to reading before the start of these-\u0026gt;clk_perf_tbl[] array.(CVE-2024-53158)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  EDAC/bluefield: Fix potential integer overflow  The 64-bit argument for the \u0026quot;get DIMM info\u0026quot; SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.  The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.(CVE-2024-53161)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: intc: Fix use-after-free bug in register_intc_controller()  In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let\u0026apos;s only add it to the list after everything has succeeded.(CVE-2024-53165)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSv4.0: Fix a use-after-free problem in the asynchronous open()  Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() in nfs4_open_release() before the rpc_task is freed.(CVE-2024-53173)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  smb: client: fix NULL ptr deref in crypto_aead_setkey()  Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher.  See MS-SMB2 3.3.5.4.  Commit b0abcd65ec54 (\u0026quot;smb: client: fix UAF in async decryption\u0026quot;) added a @server-\u0026gt;cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server-\u0026gt;cipher_type is unset for SMB3.02.  Fix the following KASAN splat by setting @server-\u0026gt;cipher_type for SMB3.02 as well.  mount.cifs //srv/share /mnt -o vers=3.02,seal,...  BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x5d/0x80  ? crypto_aead_setkey+0x2c/0x130  kasan_report+0xda/0x110  ? crypto_aead_setkey+0x2c/0x130  crypto_aead_setkey+0x2c/0x130  crypt_message+0x258/0xec0 [cifs]  ? __asan_memset+0x23/0x50  ? __pfx_crypt_message+0x10/0x10 [cifs]  ? mark_lock+0xb0/0x6a0  ? hlock_class+0x32/0xb0  ? mark_lock+0xb0/0x6a0  smb3_init_transform_rq+0x352/0x3f0 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  smb_send_rqst+0x144/0x230 [cifs]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]  ? hlock_class+0x32/0xb0  ? smb2_setup_request+0x225/0x3a0 [cifs]  ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs]  compound_send_recv+0x59b/0x1140 [cifs]  ? __pfx_compound_send_recv+0x10/0x10 [cifs]  ? __create_object+0x5e/0x90  ? hlock_class+0x32/0xb0  ? do_raw_spin_unlock+0x9a/0xf0  cifs_send_recv+0x23/0x30 [cifs]  SMB2_tcon+0x3ec/0xb30 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? __pfx_lock_release+0x10/0x10  ? do_raw_spin_trylock+0xc6/0x120  ? lock_acquire+0x3f/0x90  ? _get_xid+0x16/0xd0 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs]  ? cifs_get_tcp_session+0xaa0/0xca0 [cifs]  cifs_mount_get_session+0x8a/0x210 [cifs]  dfs_mount_share+0x1b0/0x11d0 [cifs]  ? __pfx___lock_acquire+0x10/0x10  ? __pfx_dfs_mount_share+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? find_held_lock+0x8a/0xa0  ? hlock_class+0x32/0xb0  ? lock_release+0x203/0x5d0  cifs_mount+0xb3/0x3d0 [cifs]  ? do_raw_spin_trylock+0xc6/0x120  ? __pfx_cifs_mount+0x10/0x10 [cifs]  ? lock_acquire+0x3f/0x90  ? find_nls+0x16/0xa0  ? smb3_update_mnt_flags+0x372/0x3b0 [cifs]  cifs_smb3_do_mount+0x1e2/0xc80 [cifs]  ? __pfx_vfs_parse_fs_string+0x10/0x10  ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs]  smb3_get_tree+0x1bf/0x330 [cifs]  vfs_get_tree+0x4a/0x160  path_mount+0x3c1/0xfb0  ? kasan_quarantine_put+0xc7/0x1d0  ? __pfx_path_mount+0x10/0x10  ? kmem_cache_free+0x118/0x3e0  ? user_path_at+0x74/0xa0  __x64_sys_mount+0x1a6/0x1e0  ? __pfx___x64_sys_mount+0x10/0x10  ? mark_held_locks+0x1a/0x90  do_syscall_64+0xbb/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-53185)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check for overflows in io_pin_pages  WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace:  \u0026lt;TASK\u0026gt;  __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183  io_rings_map io_uring/io_uring.c:2611 [inline]  io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470  io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692  io_uring_setup io_uring/io_uring.c:3781 [inline]  ...  \u0026lt;/TASK\u0026gt;  io_pin_pages()\u0026apos;s uaddr parameter came directly from the user and can be garbage. Don\u0026apos;t just add size to it as it can overflow.(CVE-2024-53187)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  PCI: Fix use-after-free of slot-\u0026gt;bus on hot remove  Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.  Since commit 0fc70886569c (\u0026quot;thunderbolt: Reset USB4 v2 host router\u0026quot;) and commit 59a54c5f3dbd (\u0026quot;thunderbolt: Reset topology created by the boot firmware\u0026quot;), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver.  The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router\u0026apos;s Root Port and thus causes hot removal of the dock.  The crash occurs when pciehp is unbound from one of the dock\u0026apos;s Downstream Ports:  pciehp creates a pci_slot on bind and destroys it on unbind.  The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired.  The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot-\u0026gt;bus.  In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device().  However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device().  To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy:  It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device().  There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device().  In Dennis\u0026apos; case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices().  pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device().  Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free.  One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run.  However it seems risky that pci_slot points to pci_bus without holding a reference.  Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming.  If pci_slot has a need to access data in pci_bus, it ought to acquire a reference.  Amend pci_create_slot() accordingly.  Dennis reports that the crash is not reproducible with this change.  Abridged stacktrace:    pcieport 0000:00:07.0: PME: Signaling with IRQ 156   pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+   pci_bus 0000:20: dev 00, created physical slot 12   pcieport 0000:00:07.0: pciehp: Slot(12): Card not present   ...   pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0   Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI   CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1   RIP: 0010:dev_driver_string+0x12/0x40   pci_destroy_slot   pciehp_remove   pcie_port_remove_service   device_release_driver_internal   bus_remove_device   device_del   device_unregister   remove_iter   device_for_each_child   pcie_portdrv_remove   pci_device_remove   device_release_driver_internal   bus_remove_device   device_del   pci_remove_bus_device (recursive invocation)   pci_remove_bus_device   pciehp_unconfigure_device   pciehp_disable_slot   pciehp_handle_presence_or_link_change   pciehp_ist(CVE-2024-53194)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices  A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev-\u0026gt;config.  This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.(CVE-2024-53197)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent NULL dereference in nfsd4_process_cb_update()  @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault.(CVE-2024-53217)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix race in concurrent f2fs_stop_gc_thread  In my test case, concurrent calls to f2fs shutdown report the following stack trace:   Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI  CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85  Call Trace:   \u0026lt;TASK\u0026gt;   ? show_regs+0x8b/0xa0   ? __die_body+0x26/0xa0   ? die_addr+0x54/0x90   ? exc_general_protection+0x24b/0x5c0   ? asm_exc_general_protection+0x26/0x30   ? kthread_stop+0x46/0x390   f2fs_stop_gc_thread+0x6c/0x110   f2fs_do_shutdown+0x309/0x3a0   f2fs_ioc_shutdown+0x150/0x1c0   __f2fs_ioctl+0xffd/0x2ac0   f2fs_ioctl+0x76/0xe0   vfs_ioctl+0x23/0x60   __x64_sys_ioctl+0xce/0xf0   x64_sys_call+0x2b1b/0x4540   do_syscall_64+0xa7/0x240   entry_SYSCALL_64_after_hwframe+0x76/0x7e  The root cause is a race condition in f2fs_stop_gc_thread() called from different f2fs shutdown paths:    [CPU0]                       [CPU1]   ----------------------       -----------------------   f2fs_stop_gc_thread          f2fs_stop_gc_thread                                  gc_th = sbi-\u0026gt;gc_thread     gc_th = sbi-\u0026gt;gc_thread     kfree(gc_th)     sbi-\u0026gt;gc_thread = NULL                                  \u0026lt; gc_th != NULL \u0026gt;                                  kthread_stop(gc_th-\u0026gt;f2fs_gc_task) //UAF  The commit c7f114d864ac (\u0026quot;f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\u0026quot;) attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions.  Fix it by converting to write lock of s_umount in f2fs_do_shutdown().(CVE-2024-53218)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  virtiofs: use pages instead of pointer for kernel direct IO  When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported:    ------------[ cut here ]------------   WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ......   Modules linked in:   CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......   RIP: 0010:__alloc_pages+0x2bf/0x380   ......   Call Trace:    \u0026lt;TASK\u0026gt;    ? __warn+0x8e/0x150    ? __alloc_pages+0x2bf/0x380    __kmalloc_large_node+0x86/0x160    __kmalloc+0x33c/0x480    virtio_fs_enqueue_req+0x240/0x6d0    virtio_fs_wake_pending_and_unlock+0x7f/0x190    queue_request_and_unlock+0x55/0x60    fuse_simple_request+0x152/0x2b0    fuse_direct_io+0x5d2/0x8c0    fuse_file_read_iter+0x121/0x160    __kernel_read+0x151/0x2d0    kernel_read+0x45/0x50    kernel_read_file+0x1a9/0x2a0    init_module_from_file+0x6a/0xe0    idempotent_init_module+0x175/0x230    __x64_sys_finit_module+0x5d/0xb0    x64_sys_call+0x1c3/0x9e0    do_syscall_64+0x3d/0xc0    entry_SYSCALL_64_after_hwframe+0x4b/0x53    ......    \u0026lt;/TASK\u0026gt;   ---[ end trace 0000000000000000 ]---  The warning is triggered as follows:  1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first.  2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter().  3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc-\u0026gt;max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn\u0026apos;t split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock().  4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages():   if (WARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp))   return NULL;  5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won\u0026apos;t help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever.  A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc-\u0026gt;max_write in kernel.  So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data.  After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations.  It may seem necessary to introduce another fie ---truncated---(CVE-2024-53219)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()  There\u0026apos;s issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace:  \u0026lt;TASK\u0026gt;  f2fs_submit_page_bio+0x126/0x8b0 [f2fs]  __get_meta_page+0x1d4/0x920 [f2fs]  get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs]  validate_checkpoint+0xac/0x290 [f2fs]  f2fs_get_valid_checkpoint+0x207/0x950 [f2fs]  f2fs_fill_super+0x1007/0x39b0 [f2fs]  mount_bdev+0x183/0x250  legacy_get_tree+0xf4/0x1e0  vfs_get_tree+0x88/0x340  do_new_mount+0x283/0x5e0  path_mount+0x2b2/0x15b0  __x64_sys_mount+0x1fe/0x270  do_syscall_64+0x5f/0x170  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Above issue happens as the biset of the f2fs file system is not initialized before register \u0026quot;f2fs_fs_type\u0026quot;. To address above issue just register \u0026quot;f2fs_fs_type\u0026quot; at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized.(CVE-2024-53221)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Move events notifier registration to be after device registration  Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events.  Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below.  BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 \u0026lt;4c\u0026gt; 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]---(CVE-2024-53224)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: bfa: Fix use-after-free in bfad_im_module_exit()  BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303  Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x95/0xe0  print_report+0xcb/0x620  kasan_report+0xbd/0xf0  __lock_acquire+0x2aca/0x3a20  lock_acquire+0x19b/0x520  _raw_spin_lock+0x2b/0x40  attribute_container_unregister+0x30/0x160  fc_release_transport+0x19/0x90 [scsi_transport_fc]  bfad_im_module_exit+0x23/0x60 [bfa]  bfad_init+0xdb/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  \u0026lt;/TASK\u0026gt;  Allocated by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  __kasan_kmalloc+0x7f/0x90  fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]  bfad_im_module_init+0x17/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3b/0x60  __kasan_slab_free+0x38/0x50  kfree+0x212/0x480  bfad_im_module_init+0x7e/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Above issue happens as follows:  bfad_init   error = bfad_im_module_init()     fc_release_transport(bfad_im_scsi_transport_template);   if (error)     goto ext;  ext:   bfad_im_module_exit();     fc_release_transport(bfad_im_scsi_transport_template);     --\u0026gt; Trigger double release  Don\u0026apos;t call bfad_im_module_exit() if bfad_im_module_init() failed.(CVE-2024-53227)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm: zynqmp_kms: Unplug DRM device before removal  Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver\u0026apos;s internals.(CVE-2024-56538)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  hfsplus: don\u0026apos;t query the device logical block size multiple times  Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.  While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.  Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.  Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.  The produced KASAN report before the fix looks like this:  [  419.944641] ================================================================== [  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [  419.947612] [  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [  419.950035] Call Trace: [  419.950384]  \u0026lt;TASK\u0026gt; [  419.950676]  dump_stack_lvl+0x57/0x78 [  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.951830]  print_report+0x14c/0x49e [  419.952361]  ? __virt_addr_valid+0x267/0x278 [  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d [  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.954231]  kasan_report+0x89/0xb0 [  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.955367]  hfsplus_read_wrapper+0x659/0xa0a [  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10 [  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9 [  419.957214]  ? _raw_spin_unlock+0x1a/0x2e [  419.957772]  hfsplus_fill_super+0x348/0x1590 [  419.958355]  ? hlock_class+0x4c/0x109 [  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.959499]  ? __pfx_string+0x10/0x10 [  419.960006]  ? lock_acquire+0x3e2/0x454 [  419.960532]  ? bdev_name.constprop.0+0xce/0x243 [  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10 [  419.961799]  ? pointer+0x3f0/0x62f [  419.962277]  ? __pfx_pointer+0x10/0x10 [  419.962761]  ? vsnprintf+0x6c4/0xfba [  419.963178]  ? __pfx_vsnprintf+0x10/0x10 [  419.963621]  ? setup_bdev_super+0x376/0x3b3 [  419.964029]  ? snprintf+0x9d/0xd2 [  419.964344]  ? __pfx_snprintf+0x10/0x10 [  419.964675]  ? lock_acquired+0x45c/0x5e9 [  419.965016]  ? set_blocksize+0x139/0x1c1 [  419.965381]  ? sb_set_blocksize+0x6d/0xae [  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.966179]  mount_bdev+0x12f/0x1bf [  419.966512]  ? __pfx_mount_bdev+0x10/0x10 [  419.966886]  ? vfs_parse_fs_string+0xce/0x111 [  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10 [  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10 [  419.968073]  legacy_get_tree+0x104/0x178 [  419.968414]  vfs_get_tree+0x86/0x296 [  419.968751]  path_mount+0xba3/0xd0b [  419.969157]  ? __pfx_path_mount+0x10/0x10 [  419.969594]  ? kmem_cache_free+0x1e2/0x260 [  419.970311]  do_mount+0x99/0xe0 [  419.970630]  ? __pfx_do_mount+0x10/0x10 [  419.971008]  __do_sys_mount+0x199/0x1c9 [  419.971397]  do_syscall_64+0xd0/0x135 [  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e [  419.972233] RIP: 0033:0x7c3cb812972e [  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: ---truncated---(CVE-2024-56548)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()  if (dev-\u0026gt;boardinfo \u0026amp;\u0026amp; dev-\u0026gt;boardinfo-\u0026gt;init_dyn_addr)                                       ^^^ here check \u0026quot;init_dyn_addr\u0026quot;  i3c_bus_set_addr_slot_status(\u0026amp;master-\u0026gt;bus, dev-\u0026gt;info.dyn_addr, ...)                    ^^^^        free \u0026quot;dyn_addr\u0026quot; Fix copy/paste error \u0026quot;dyn_addr\u0026quot; by replacing it with \u0026quot;init_dyn_addr\u0026quot;.(CVE-2024-56562)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ftrace: Fix regression with module command in stack_trace_filter  When executing the following command:      # echo \u0026quot;write*:mod:ext3\u0026quot; \u0026gt; /sys/kernel/tracing/stack_trace_filter  The current mod command causes a null pointer dereference. While commit 0f17976568b3f (\u0026quot;ftrace: Fix regression with module command in stack_trace_filter\u0026quot;) has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.(CVE-2024-56569)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ovl: Filter invalid inodes with missing lookup function  Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.(CVE-2024-56570)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()  The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here.  To mitigate this, free the buffer when allegro_alloc_buffer fails.(CVE-2024-56572)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: ref-verify: fix use-after-free after invalid ref action  At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable \u0026apos;ref\u0026apos;) into the respective block entry\u0026apos;s rbtree (local variable \u0026apos;be\u0026apos;), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry\u0026apos;s rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn\u0026apos;t remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.  Syzbot report this with the following stack traces:     BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314       btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]       btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23       btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482       btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293       vfs_unlink+0x365/0x650 fs/namei.c:4469       do_unlinkat+0x4ae/0x830 fs/namei.c:4533       __do_sys_unlinkat fs/namei.c:4576 [inline]       __se_sys_unlinkat fs/namei.c:4569 [inline]       __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569       do_syscall_x64 arch/x86/entry/common.c:52 [inline]       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83       entry_SYSCALL_64_after_hwframe+0x77/0x7f    BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1       __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521       update_ref_for_cow+0x96a/0x11f0       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]       __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137       __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171       btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313       prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586       relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611       btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081       btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377       __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161       btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538    BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_i ---truncated---(CVE-2024-56581)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sched/deadline: Fix warning in migrate_enable for boosted tasks  When running the following command:  while true; do     stress-ng --cyclic 30 --timeout 30s --minimize --quiet done  a warning is eventually triggered:  WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace:  \u0026lt;TASK\u0026gt;  ? show_trace_log_lvl+0x1c4/0x2df  ? enqueue_dl_entity+0x631/0x6e0  ? setup_new_dl_entity+0x13e/0x180  ? __warn+0x7e/0xd0  ? report_bug+0x11a/0x1a0  ? handle_bug+0x3c/0x70  ? exc_invalid_op+0x14/0x70  ? asm_exc_invalid_op+0x16/0x20  enqueue_dl_entity+0x631/0x6e0  enqueue_task_dl+0x7d/0x120  __do_set_cpus_allowed+0xe3/0x280  __set_cpus_allowed_ptr_locked+0x140/0x1d0  __set_cpus_allowed_ptr+0x54/0xa0  migrate_enable+0x7e/0x150  rt_spin_unlock+0x1c/0x90  group_send_sig_info+0xf7/0x1a0  ? kill_pid_info+0x1f/0x1d0  kill_pid_info+0x78/0x1d0  kill_proc_info+0x5b/0x110  __x64_sys_kill+0x93/0xc0  do_syscall_64+0x5c/0xf0  entry_SYSCALL_64_after_hwframe+0x6e/0x76  RIP: 0033:0x7f0dab31f92b  This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call.  Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that\u0026apos;s the case.(CVE-2024-56583)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/tctx: work around xa_store() allocation error issue  syzbot triggered the following WARN_ON:  WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51  which is the  WARN_ON_ONCE(!xa_empty(\u0026amp;tctx-\u0026gt;xa));  sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with -\u0026gt;head being non-NULL even though no entries exist in the xarray.  Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.(CVE-2024-56584)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.  creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace:  __die_body+0x15/0x60  die+0x33/0x50  do_trap+0x10a/0x120  f2fs_evict_inode+0x58c/0x610  do_error_trap+0x60/0x80  f2fs_evict_inode+0x58c/0x610  exc_invalid_op+0x53/0x60  f2fs_evict_inode+0x58c/0x610  asm_exc_invalid_op+0x16/0x20  f2fs_evict_inode+0x58c/0x610  evict+0x101/0x260  dispose_list+0x30/0x50  evict_inodes+0x140/0x190  generic_shutdown_super+0x2f/0x150  kill_block_super+0x11/0x40  kill_f2fs_super+0x7d/0x140  deactivate_locked_super+0x2a/0x70  cleanup_mnt+0xb3/0x140  task_work_run+0x61/0x90  The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows:  dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir  Let\u0026apos;s redirty inode when there is not free segments during checkpoint is disable.(CVE-2024-56586)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: hisi_sas: Add cond_resched() for no forced preemption model  For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, the following call trace may occur:  [  214.409199][  C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211] [  214.568533][  C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [  214.575224][  C240] pc : fput_many+0x8c/0xdc [  214.579480][  C240] lr : fput+0x1c/0xf0 [  214.583302][  C240] sp : ffff80002de2b900 [  214.587298][  C240] x29: ffff80002de2b900 x28: ffff1082aa412000 [  214.593291][  C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000 [  214.599284][  C240] x25: ffff1062bbac5c40 x24: 0000000000001000 [  214.605277][  C240] x23: 000000000000000a x22: 0000000000000001 [  214.611270][  C240] x21: 0000000000001000 x20: 0000000000000000 [  214.617262][  C240] x19: ffff3062a41ae580 x18: 0000000000010000 [  214.623255][  C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0 [  214.629248][  C240] x15: ffffffffffffffff x14: 0000000003ffffff [  214.635241][  C240] x13: 000000000000ffff x12: 000000000000029c [  214.641234][  C240] x11: 0000000000000006 x10: ffff80003a9f7fd0 [  214.647226][  C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001 [  214.653219][  C240] x7 : 0000000000000002 x6 : 0000000000000080 [  214.659212][  C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554 [  214.665205][  C240] x3 : 0000000000000002 x2 : 0000000000000020 [  214.671198][  C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8 [  214.677191][  C240] Call trace: [  214.680320][  C240]  fput_many+0x8c/0xdc [  214.684230][  C240]  fput+0x1c/0xf0 [  214.687707][  C240]  aio_complete_rw+0xd8/0x1fc [  214.692225][  C240]  blkdev_bio_end_io+0x98/0x140 [  214.696917][  C240]  bio_endio+0x160/0x1bc [  214.701001][  C240]  blk_update_request+0x1c8/0x3bc [  214.705867][  C240]  scsi_end_request+0x3c/0x1f0 [  214.710471][  C240]  scsi_io_completion+0x7c/0x1a0 [  214.715249][  C240]  scsi_finish_command+0x104/0x140 [  214.720200][  C240]  scsi_softirq_done+0x90/0x180 [  214.724892][  C240]  blk_mq_complete_request+0x5c/0x70 [  214.730016][  C240]  scsi_mq_done+0x48/0xac [  214.734194][  C240]  sas_scsi_task_done+0xbc/0x16c [libsas] [  214.739758][  C240]  slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw] [  214.746185][  C240]  cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw] [  214.752179][  C240]  irq_thread_fn+0x34/0xa4 [  214.756435][  C240]  irq_thread+0xc4/0x130 [  214.760520][  C240]  kthread+0x108/0x13c [  214.764430][  C240]  ret_from_fork+0x10/0x18  This is because in the hisi_sas driver, both the hardware interrupt handler and the interrupt thread are executed on the same CPU. In the performance test scenario, function irq_wait_for_interrupt() will always return 0 if lots of interrupts occurs and the CPU will be continuously consumed. As a result, the CPU cannot run the watchdog thread. When the watchdog time exceeds the specified time, call trace occurs.  To fix it, add cond_resched() to execute the watchdog thread.(CVE-2024-56589)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: set the right AMDGPU sg segment limitation  The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following:  WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [  364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [  364.049532]  ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [  364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G           OE      6.10.0-custom #492 [  364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [  364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [  364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff \u0026lt;0f\u0026gt; 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [  364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [  364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [  364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [  364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [  364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [  364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [  364.049599] FS:  00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [  364.049601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [  364.049605] Call Trace: [  364.049607]  \u0026lt;TASK\u0026gt; [  364.049609]  ? show_regs+0x6d/0x80 [  364.049614]  ? __warn+0x8c/0x140 [  364.049618]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049621]  ? report_bug+0x193/0x1a0 [  364.049627]  ? handle_bug+0x46/0x80 [  364.049631]  ? exc_invalid_op+0x1d/0x80 [  364.049635]  ? asm_exc_invalid_op+0x1f/0x30 [  364.049642]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049647]  __dma_map_sg_attrs+0x90/0xe0 [  364.049651]  dma_map_sgtable+0x25/0x40 [  364.049654]  amdgpu_bo_move+0x59a/0x850 [amdgpu] [  364.049935]  ? srso_return_thunk+0x5/0x5f [  364.049939]  ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [  364.050095]  ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [  364.050103]  ttm_bo_validate+0xc1/0x160 [ttm] [  364.050108]  ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [  364.050263]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [  364.050473]  kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [  364.050680]  kfd_ioctl+0x3c2/0x530 [amdgpu] [  364.050866]  ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [  364.05105 ---truncated---(CVE-2024-56594)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: fix array-index-out-of-bounds in jfs_readdir  The stbl might contain some invalid values. Added a check to return error code in that case.(CVE-2024-56596)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: array-index-out-of-bounds fix in dtReadFirst  The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.(CVE-2024-56598)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()  bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free.  Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().(CVE-2024-56604)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()  bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.(CVE-2024-56605)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Fix out-of-bounds access in \u0026apos;dcn21_link_encoder_create\u0026apos;  An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array\u0026apos;s bounds before accessing it.  This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior.  References:  [   65.920507] ------------[ cut here ]------------ [   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [   65.920519] index 7 is out of range for type \u0026apos;dcn10_link_enc_hpd_registers [5]\u0026apos; [   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [   65.920527] Call Trace: [   65.920529]  \u0026lt;TASK\u0026gt; [   65.920532]  dump_stack_lvl+0x48/0x70 [   65.920541]  dump_stack+0x10/0x20 [   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0 [   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [   65.921009]  link_create+0x6d3/0xed0 [amdgpu] [   65.921355]  create_links+0x18a/0x4e0 [amdgpu] [   65.921679]  dc_create+0x360/0x720 [amdgpu] [   65.921999]  ? dmi_matches+0xa0/0x220 [   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [   65.922342]  ? console_unlock+0x77/0x120 [   65.922348]  ? dev_printk_emit+0x86/0xb0 [   65.922354]  dm_hw_init+0x15/0x40 [amdgpu] [   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [   65.923087]  local_pci_probe+0x4b/0xb0 [   65.923087]  pci_device_probe+0xc8/0x280 [   65.923087]  really_probe+0x187/0x300 [   65.923087]  __driver_probe_device+0x85/0x130 [   65.923087]  driver_probe_device+0x24/0x110 [   65.923087]  __driver_attach+0xac/0x1d0 [   65.923087]  ? __pfx___driver_attach+0x10/0x10 [   65.923087]  bus_for_each_dev+0x7d/0xd0 [   65.923087]  driver_attach+0x1e/0x30 [   65.923087]  bus_add_driver+0xf2/0x200 [   65.923087]  driver_register+0x64/0x130 [   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [   65.923087]  __pci_register_driver+0x61/0x70 [   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu] [   65.923087]  do_one_initcall+0x49/0x310 [   65.923087]  ? kmalloc_trace+0x136/0x360 [   65.923087]  do_init_module+0x6a/0x270 [   65.923087]  load_module+0x1fce/0x23a0 [   65.923087]  init_module_from_file+0x9c/0xe0 [   65.923087]  ? init_module_from_file+0x9c/0xe0 [   65.923087]  idempotent_init_module+0x179/0x230 [   65.923087]  __x64_sys_finit_module+0x5d/0xa0 [   65.923087]  do_syscall_64+0x76/0x120 [   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76 [   65.923087] RIP: 0033:0x7f2d80f1e88d [   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [   65.923087]  \u0026lt;/TASK\u0026gt; [   65.923927] ---[ end trace ]---(CVE-2024-56608)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: fix OOB devmap writes when deleting elements  Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed.  When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32.  Example splat below:  [  160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [  160.731662] #PF: supervisor read access in kernel mode [  160.736876] #PF: error_code(0x0000) - not-present page [  160.742095] PGD 0 P4D 0 [  160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [  160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [  160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [  160.767642] Workqueue: events_unbound bpf_map_free_deferred [  160.773308] RIP: 0010:dev_map_free+0x77/0x170 [  160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 \u0026lt;48\u0026gt; 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [  160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [  160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [  160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [  160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [  160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [  160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [  160.838310] FS:  0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [  160.846528] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [  160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [  160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [  160.874092] PKRU: 55555554 [  160.876847] Call Trace: [  160.879338]  \u0026lt;TASK\u0026gt; [  160.881477]  ? __die+0x20/0x60 [  160.884586]  ? page_fault_oops+0x15a/0x450 [  160.888746]  ? search_extable+0x22/0x30 [  160.892647]  ? search_bpf_extables+0x5f/0x80 [  160.896988]  ? exc_page_fault+0xa9/0x140 [  160.900973]  ? asm_exc_page_fault+0x22/0x30 [  160.905232]  ? dev_map_free+0x77/0x170 [  160.909043]  ? dev_map_free+0x58/0x170 [  160.912857]  bpf_map_free_deferred+0x51/0x90 [  160.917196]  process_one_work+0x142/0x370 [  160.921272]  worker_thread+0x29e/0x3b0 [  160.925082]  ? rescuer_thread+0x4b0/0x4b0 [  160.929157]  kthread+0xd4/0x110 [  160.932355]  ? kthread_park+0x80/0x80 [  160.936079]  ret_from_fork+0x2d/0x50 [  160.943396]  ? kthread_park+0x80/0x80 [  160.950803]  ret_from_fork_asm+0x11/0x20 [  160.958482]  \u0026lt;/TASK\u0026gt;(CVE-2024-56615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()  Syzbot reported that when searching for records in a directory where the inode\u0026apos;s i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled.  This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned.  This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size.  Fix this issue by changing the type of the local variable causing the bit loss from \u0026quot;unsigned int\u0026quot; to \u0026quot;u64\u0026quot;.  The return value of nilfs_last_byte() is also of type \u0026quot;unsigned int\u0026quot;, but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.(CVE-2024-56619)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read  An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting \u0026apos;vfs objects = streams_xattr parameter\u0026apos; in ksmbd.conf.(CVE-2024-56627)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix when get product name maybe null pointer  Due to incorrect dev-\u0026gt;product reporting by certain devices, null pointer dereferences occur when dev-\u0026gt;product is empty, leading to potential system crashes.  This issue was found on EXCELSIOR DL37-D05 device with Loongson-LS3A6000-7A2000-DL37 motherboard.  Kernel logs: [   56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci [   56.671638] usb 4-3: string descriptor 0 read error: -22 [   56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07 [   56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [   56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0 [   56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80 [   56.697732] Oops[#1]: [   56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G           OE      6.6.0-loong64-desktop #25.00.2000.015 [   56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024 [   56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0 [   56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000 [   56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000 [   56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005 [   56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000 [   56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028 [   56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000 [   56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000 [   56.697753]    ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom] [   56.697802]   ERA: 90000000066e35c8 strstr+0x28/0x120 [   56.697806]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [   56.697816]  PRMD: 0000000c (PPLV0 +PIE +PWE) [   56.697821]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [   56.697827]  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [   56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [   56.697835]  BADV: 0000000000000000 [   56.697836]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [   56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit [   56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3) [   56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000 [   56.697896]         0000000000000000 00000011fffffffd 0000000000000000 0000000000000000 [   56.697901]         0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0 [   56.697906]         90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c [   56.697911]         90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440 [   56.697916]         ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0 [   56.697921]         0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c [   56.697926]         ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000 [   56.697931]         90000001000bb8d0  ---truncated---(CVE-2024-56629)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: Fix UAF in blkcg_unpin_online()  blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:    ==================================================================   BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270   Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117    CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022   Workqueue: cgwb_release cgwb_release_workfn   Call Trace:    \u0026lt;TASK\u0026gt;    dump_stack_lvl+0x27/0x80    print_report+0x151/0x710    kasan_report+0xc0/0x100    blkcg_unpin_online+0x15a/0x270    cgwb_release_workfn+0x194/0x480    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30    \u0026lt;/TASK\u0026gt;   ...   Freed by task 1944:    kasan_save_track+0x2b/0x70    kasan_save_free_info+0x3c/0x50    __kasan_slab_free+0x33/0x50    kfree+0x10c/0x330    css_free_rwork_fn+0xe6/0xb30    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30  Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().  Fix it by reading the parent pointer before destroying the blkcg\u0026apos;s blkg\u0026apos;s.(CVE-2024-56672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: bcm - add error check in the ahash_hmac_init function  The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.(CVE-2024-56681)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ext4: fix race in buffer_head read fault injection  When I enabled ext4 debug for fault injection testing, I encountered the following warning:    EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:          Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051   WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0  The root cause of the issue lies in the improper implementation of ext4\u0026apos;s buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions.  [CPU0]           [CPU1]         [CPU2] ext4_read_inode_bitmap   ext4_read_bh()   \u0026lt;bh read complete\u0026gt;                  ext4_read_inode_bitmap                    if (buffer_uptodate(bh))                      return bh                                jbd2_journal_commit_transaction                                  __jbd2_journal_refile_buffer                                    __jbd2_journal_unfile_buffer                                      __jbd2_journal_temp_unlink_buffer   ext4_simulate_fail_bh()     clear_buffer_uptodate                                       mark_buffer_dirty                                         \u0026lt;report warning\u0026gt;                                         WARN_ON_ONCE(!buffer_uptodate(bh))  The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb.  Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection.(CVE-2024-56686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device  While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).  Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.(CVE-2024-56691)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on node blkaddr in truncate_node()  syzbot reports a f2fs bug as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace:  truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909  f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288  f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856  evict+0x4e8/0x9b0 fs/inode.c:723  f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986  f2fs_create+0x357/0x530 fs/f2fs/namei.c:394  lookup_open fs/namei.c:3595 [inline]  open_last_lookups fs/namei.c:3694 [inline]  path_openat+0x1c03/0x3590 fs/namei.c:3930  do_filp_open+0x235/0x490 fs/namei.c:3960  do_sys_openat2+0x13e/0x1d0 fs/open.c:1415  do_sys_open fs/open.c:1430 [inline]  __do_sys_openat fs/open.c:1446 [inline]  __se_sys_openat fs/open.c:1441 [inline]  __x64_sys_openat+0x247/0x2a0 fs/open.c:1441  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534  The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let\u0026apos;s add sanity check on nat blkaddr in truncate_node().(CVE-2024-56692)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: wl128x: Fix atomicity violation in fmc_send_cmd()  Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev-\u0026gt;resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev-\u0026gt;resp_skb variable is assigned a null value. This results in an invalid fmdev-\u0026gt;resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev-\u0026gt;resp_skb; when the invalid fmdev-\u0026gt;resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb-\u0026gt;data;  To address this issue, it is recommended to include the validity check of fmdev-\u0026gt;resp_skb within the locked section of the function. This modification ensures that the value of fmdev-\u0026gt;resp_skb does not change during the validation process, thereby maintaining its validity.  This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.(CVE-2024-56700)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check if iowq is killed before queuing  task work can be executed after the task has gone through io_uring termination, whether it\u0026apos;s the final task_work run or the fallback path. In this case, task work will find -\u0026gt;io_wq being already killed and null\u0026apos;ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case.  Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case -\u0026gt;iowq check would race.(CVE-2024-56709)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()  If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware.  When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc-\u0026gt;timerqueue, they will continually expire, may causing kernel softlockup.(CVE-2024-56739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  apparmor: test: Fix memory leak for aa_unpack_strdup()  The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it.   unreferenced object 0xffffff80c6af8a50 (size 8):    comm \u0026quot;kunit_try_catch\u0026quot;, pid 225, jiffies 4294894407    hex dump (first 8 bytes):      74 65 73 74 69 6e 67 00                          testing.    backtrace (crc 5eab668b):      [\u0026lt;0000000001e3714d\u0026gt;] kmemleak_alloc+0x34/0x40      [\u0026lt;000000006e6c7776\u0026gt;] __kmalloc_node_track_caller_noprof+0x300/0x3e0      [\u0026lt;000000006870467c\u0026gt;] kmemdup_noprof+0x34/0x60      [\u0026lt;000000001176bb03\u0026gt;] aa_unpack_strdup+0xd0/0x18c      [\u0026lt;000000008ecde918\u0026gt;] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec      [\u0026lt;0000000032ef8f77\u0026gt;] kunit_try_run_case+0x13c/0x3ac      [\u0026lt;00000000f3edea23\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec      [\u0026lt;00000000adf936cf\u0026gt;] kthread+0x2e8/0x374      [\u0026lt;0000000041bb1628\u0026gt;] ret_from_fork+0x10/0x20  unreferenced object 0xffffff80c2a29090 (size 8):    comm \u0026quot;kunit_try_catch\u0026quot;, pid 227, jiffies 4294894409    hex dump (first 8 bytes):      74 65 73 74 69 6e 67 00                          testing.    backtrace (crc 5eab668b):      [\u0026lt;0000000001e3714d\u0026gt;] kmemleak_alloc+0x34/0x40      [\u0026lt;000000006e6c7776\u0026gt;] __kmalloc_node_track_caller_noprof+0x300/0x3e0      [\u0026lt;000000006870467c\u0026gt;] kmemdup_noprof+0x34/0x60      [\u0026lt;000000001176bb03\u0026gt;] aa_unpack_strdup+0xd0/0x18c      [\u0026lt;0000000046a45c1a\u0026gt;] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4      [\u0026lt;0000000032ef8f77\u0026gt;] kunit_try_run_case+0x13c/0x3ac      [\u0026lt;00000000f3edea23\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec      [\u0026lt;00000000adf936cf\u0026gt;] kthread+0x2e8/0x374      [\u0026lt;0000000041bb1628\u0026gt;] ret_from_fork+0x10/0x20(CVE-2024-56741)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()  Hook \u0026quot;qedi_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()  Hook \u0026quot;qed_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56748)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nvme-pci: fix freeing of the HMB descriptor table  The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.  In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.(CVE-2024-56756)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tracing: Prevent bad count for tracing_cpumask_write  If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.(CVE-2024-56763)","status":"published","published":"2025-01-10T11:08:07Z","modified":"2026-08-18T01:18:44.704754969Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1035","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()  for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL.  If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the error path to avoid reference count leak.(CVE-2022-49002)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK  When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.  [    3.052463] ------------[ cut here ]------------ [    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [    3.070072] Modules linked in: efivarfs autofs4 [    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000 [    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [    3.195868]         ... [    3.199917] Call Trace: [    3.203941] [\u0026lt;90000000002086d8\u0026gt;] show_stack+0x38/0x14c [    3.210666] [\u0026lt;9000000000cf846c\u0026gt;] dump_stack_lvl+0x60/0x88 [    3.217625] [\u0026lt;900000000023d268\u0026gt;] __warn+0xd0/0x100 [    3.223958] [\u0026lt;9000000000cf3c90\u0026gt;] warn_slowpath_fmt+0x7c/0xcc [    3.231150] [\u0026lt;9000000000210220\u0026gt;] show_cpuinfo+0x5e8/0x5f0 [    3.238080] [\u0026lt;90000000004f578c\u0026gt;] seq_read_iter+0x354/0x4b4 [    3.245098] [\u0026lt;90000000004c2e90\u0026gt;] new_sync_read+0x17c/0x1c4 [    3.252114] [\u0026lt;90000000004c5174\u0026gt;] vfs_read+0x138/0x1d0 [    3.258694] [\u0026lt;90000000004c55f8\u0026gt;] ksys_read+0x70/0x100 [    3.265265] [\u0026lt;9000000000cfde9c\u0026gt;] do_syscall+0x7c/0x94 [    3.271820] [\u0026lt;9000000000202fe4\u0026gt;] handle_syscall+0xc4/0x160 [    3.281824] ---[ end trace 8b484262b4b8c24c ]---(CVE-2022-49034)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE  I expect that the hardware will have limited this to 16, but just in case it hasn\u0026apos;t, check for this corner case.(CVE-2022-49035)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/qm - inject error before stopping queue  The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.(CVE-2024-47730)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  x86/sgx: Fix deadlock in SGX NUMA node search  When the current node doesn\u0026apos;t have an EPC section configured by firmware and all other EPC sections are used up, CPU can get stuck inside the while loop that looks for an available EPC page from remote nodes indefinitely, leading to a soft lockup. Note how nid_of_current will never be equal to nid in that while loop because nid_of_current is not set in sgx_numa_mask.  Also worth mentioning is that it\u0026apos;s perfectly fine for the firmware not to setup an EPC section on a node. While setting up an EPC section on each node can enhance performance, it is not a requirement for functionality.  Rework the loop to start and end on *a* node that has SGX memory. This avoids the deadlock looking for the current SGX-lacking node to show up in the loop when it never will.(CVE-2024-49856)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Check null pointers before using dc-\u0026gt;clk_mgr  [WHY \u0026amp; HOW] dc-\u0026gt;clk_mgr is null checked previously in the same function, indicating it might be null.  Passing \u0026quot;dc\u0026quot; to \u0026quot;dc-\u0026gt;hwss.apply_idle_power_optimizations\u0026quot;, which dereferences null \u0026quot;dc-\u0026gt;clk_mgr\u0026quot;. (The function pointer resolves to \u0026quot;dcn35_apply_idle_power_optimizations\u0026quot;.)  This fixes 1 FORWARD_NULL issue reported by Coverity.(CVE-2024-49907)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix error path in multi-packet WQE transmit  Remove the erroneous unmap in case no DMA mapping was established  The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can\u0026apos;t allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq\u0026apos;s FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.  The erroneous behavior was seen in a stress-test environment that created memory pressure.(CVE-2024-50001)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: phy: dp83869: fix memory corruption when enabling fiber  When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 \u0026lt;\u0026lt; 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.  Since the advertising flags are updated from supported at the end of the function the incorrect line isn\u0026apos;t needed at all and can be removed.(CVE-2024-50188)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()  In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout \u0026gt; (clk_get_rate(st-\u0026gt;mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value.(CVE-2024-50233)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  vsock/virtio: Initialization of the dangling pointer occurring in vsk-\u0026gt;trans  During loopback communication, a dangling pointer can be created in vsk-\u0026gt;trans, potentially leading to a Use-After-Free condition.  This issue is resolved by initializing vsk-\u0026gt;trans to NULL.(CVE-2024-50264)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: v4l2-tpg: prevent the risk of a division by zero  As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero.  Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation.(CVE-2024-50287)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  exfat: fix out-of-bounds access of directory entries  In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei-\u0026gt;hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption.  This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty.(CVE-2024-53147)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: fix uninitialized value in ocfs2_file_read_iter()  Syzbot has reported the following KMSAN splat:  BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80  ocfs2_file_read_iter+0x9a4/0xf80  __io_read+0x8d4/0x20f0  io_read+0x3e/0xf0  io_issue_sqe+0x42b/0x22c0  io_wq_submit_work+0xaf9/0xdc0  io_worker_handle_work+0xd13/0x2110  io_wq_worker+0x447/0x1410  ret_from_fork+0x6f/0x90  ret_from_fork_asm+0x1a/0x30  Uninit was created at:  __alloc_pages_noprof+0x9a7/0xe00  alloc_pages_mpol_noprof+0x299/0x990  alloc_pages_noprof+0x1bf/0x1e0  allocate_slab+0x33a/0x1250  ___slab_alloc+0x12ef/0x35e0  kmem_cache_alloc_bulk_noprof+0x486/0x1330  __io_alloc_req_refill+0x84/0x560  io_submit_sqes+0x172f/0x2f30  __se_sys_io_uring_enter+0x406/0x41c0  __x64_sys_io_uring_enter+0x11f/0x1a0  x64_sys_call+0x2b54/0x3ba0  do_syscall_64+0xcd/0x1e0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Since an instance of \u0026apos;struct kiocb\u0026apos; may be passed from the block layer with \u0026apos;private\u0026apos; field uninitialized, introduce \u0026apos;ocfs2_iocb_init_rw_locked()\u0026apos; and use it from where \u0026apos;ocfs2_dio_end_io()\u0026apos; might take care, i.e. in \u0026apos;ocfs2_file_read_iter()\u0026apos; and \u0026apos;ocfs2_file_write_iter()\u0026apos;.(CVE-2024-53155)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()  This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration.  However, that check doesn\u0026apos;t make sense on the first iteration through the loop. It leads to reading before the start of these-\u0026gt;clk_perf_tbl[] array.(CVE-2024-53158)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  EDAC/bluefield: Fix potential integer overflow  The 64-bit argument for the \u0026quot;get DIMM info\u0026quot; SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.  The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.(CVE-2024-53161)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: intc: Fix use-after-free bug in register_intc_controller()  In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let\u0026apos;s only add it to the list after everything has succeeded.(CVE-2024-53165)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit  After an insertion in TNC, the tree might split and cause a node to change its `znode-\u0026gt;parent`. A further deletion of other nodes in the tree (which also could free the nodes), the aforementioned node\u0026apos;s `znode-\u0026gt;cparent` could still point to a freed node. This `znode-\u0026gt;cparent` may not be updated when getting nodes to commit in `ubifs_tnc_start_commit()`. This could then trigger a use-after-free when accessing the `znode-\u0026gt;cparent` in `write_index()` in `ubifs_tnc_end_commit()`.  This can be triggered by running    rm -f /etc/test-file.bin   dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync  in a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then reports:    BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950   Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153    Call trace:    dump_backtrace+0x0/0x340    show_stack+0x18/0x24    dump_stack_lvl+0x9c/0xbc    print_address_description.constprop.0+0x74/0x2b0    kasan_report+0x1d8/0x1f0    kasan_check_range+0xf8/0x1a0    memcpy+0x84/0xf4    ubifs_tnc_end_commit+0xa5c/0x1950    do_commit+0x4e0/0x1340    ubifs_bg_thread+0x234/0x2e0    kthread+0x36c/0x410    ret_from_fork+0x10/0x20    Allocated by task 401:    kasan_save_stack+0x38/0x70    __kasan_kmalloc+0x8c/0xd0    __kmalloc+0x34c/0x5bc    tnc_insert+0x140/0x16a4    ubifs_tnc_add+0x370/0x52c    ubifs_jnl_write_data+0x5d8/0x870    do_writepage+0x36c/0x510    ubifs_writepage+0x190/0x4dc    __writepage+0x58/0x154    write_cache_pages+0x394/0x830    do_writepages+0x1f0/0x5b0    filemap_fdatawrite_wbc+0x170/0x25c    file_write_and_wait_range+0x140/0x190    ubifs_fsync+0xe8/0x290    vfs_fsync_range+0xc0/0x1e4    do_fsync+0x40/0x90    __arm64_sys_fsync+0x34/0x50    invoke_syscall.constprop.0+0xa8/0x260    do_el0_svc+0xc8/0x1f0    el0_svc+0x34/0x70    el0t_64_sync_handler+0x108/0x114    el0t_64_sync+0x1a4/0x1a8    Freed by task 403:    kasan_save_stack+0x38/0x70    kasan_set_track+0x28/0x40    kasan_set_free_info+0x28/0x4c    __kasan_slab_free+0xd4/0x13c    kfree+0xc4/0x3a0    tnc_delete+0x3f4/0xe40    ubifs_tnc_remove_range+0x368/0x73c    ubifs_tnc_remove_ino+0x29c/0x2e0    ubifs_jnl_delete_inode+0x150/0x260    ubifs_evict_inode+0x1d4/0x2e4    evict+0x1c8/0x450    iput+0x2a0/0x3c4    do_unlinkat+0x2cc/0x490    __arm64_sys_unlinkat+0x90/0x100    invoke_syscall.constprop.0+0xa8/0x260    do_el0_svc+0xc8/0x1f0    el0_svc+0x34/0x70    el0t_64_sync_handler+0x108/0x114    el0t_64_sync+0x1a4/0x1a8  The offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free when a node becomes root in TNC but still has a `cparent` to an already freed node. More specifically, consider the following TNC:           zroot          /         /       zp1       /      /     zn  Inserting a new node `zn_new` with a key smaller then `zn` will trigger a split in `tnc_insert()` if `zp1` is full:           zroot          /   \\         /     \\       zp1     zp2       /         \\      /           \\   zn_new          zn  `zn-\u0026gt;parent` has now been moved to `zp2`, *but* `zn-\u0026gt;cparent` still points to `zp1`.  Now, consider a removal of all the nodes _except_ `zn`. Just when `tnc_delete()` is about to delete `zroot` and `zp2`:           zroot              \\               \\               zp2                 \\                  \\                  zn  `zroot` and `zp2` get freed and the tree collapses:             zn  `zn` now becomes the new `zroot`.  `get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and `write_index()` will check its `znode-\u0026gt;cparent` that wrongly points to the already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called with `znode-\u0026gt;cparent-\u0026gt;zbranch[znode-\u0026gt;iip].hash` that triggers the use-after-free!  Fix this by explicitly setting `znode-\u0026gt;cparent` to `NULL` in `get_znodes_to_commit()` for the root node. The search for the dirty nodes ---truncated---(CVE-2024-53171)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  smb: client: fix NULL ptr deref in crypto_aead_setkey()  Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher.  See MS-SMB2 3.3.5.4.  Commit b0abcd65ec54 (\u0026quot;smb: client: fix UAF in async decryption\u0026quot;) added a @server-\u0026gt;cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server-\u0026gt;cipher_type is unset for SMB3.02.  Fix the following KASAN splat by setting @server-\u0026gt;cipher_type for SMB3.02 as well.  mount.cifs //srv/share /mnt -o vers=3.02,seal,...  BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x5d/0x80  ? crypto_aead_setkey+0x2c/0x130  kasan_report+0xda/0x110  ? crypto_aead_setkey+0x2c/0x130  crypto_aead_setkey+0x2c/0x130  crypt_message+0x258/0xec0 [cifs]  ? __asan_memset+0x23/0x50  ? __pfx_crypt_message+0x10/0x10 [cifs]  ? mark_lock+0xb0/0x6a0  ? hlock_class+0x32/0xb0  ? mark_lock+0xb0/0x6a0  smb3_init_transform_rq+0x352/0x3f0 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  smb_send_rqst+0x144/0x230 [cifs]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]  ? hlock_class+0x32/0xb0  ? smb2_setup_request+0x225/0x3a0 [cifs]  ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs]  compound_send_recv+0x59b/0x1140 [cifs]  ? __pfx_compound_send_recv+0x10/0x10 [cifs]  ? __create_object+0x5e/0x90  ? hlock_class+0x32/0xb0  ? do_raw_spin_unlock+0x9a/0xf0  cifs_send_recv+0x23/0x30 [cifs]  SMB2_tcon+0x3ec/0xb30 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? __pfx_lock_release+0x10/0x10  ? do_raw_spin_trylock+0xc6/0x120  ? lock_acquire+0x3f/0x90  ? _get_xid+0x16/0xd0 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs]  ? cifs_get_tcp_session+0xaa0/0xca0 [cifs]  cifs_mount_get_session+0x8a/0x210 [cifs]  dfs_mount_share+0x1b0/0x11d0 [cifs]  ? __pfx___lock_acquire+0x10/0x10  ? __pfx_dfs_mount_share+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? find_held_lock+0x8a/0xa0  ? hlock_class+0x32/0xb0  ? lock_release+0x203/0x5d0  cifs_mount+0xb3/0x3d0 [cifs]  ? do_raw_spin_trylock+0xc6/0x120  ? __pfx_cifs_mount+0x10/0x10 [cifs]  ? lock_acquire+0x3f/0x90  ? find_nls+0x16/0xa0  ? smb3_update_mnt_flags+0x372/0x3b0 [cifs]  cifs_smb3_do_mount+0x1e2/0xc80 [cifs]  ? __pfx_vfs_parse_fs_string+0x10/0x10  ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs]  smb3_get_tree+0x1bf/0x330 [cifs]  vfs_get_tree+0x4a/0x160  path_mount+0x3c1/0xfb0  ? kasan_quarantine_put+0xc7/0x1d0  ? __pfx_path_mount+0x10/0x10  ? kmem_cache_free+0x118/0x3e0  ? user_path_at+0x74/0xa0  __x64_sys_mount+0x1a6/0x1e0  ? __pfx___x64_sys_mount+0x10/0x10  ? mark_held_locks+0x1a/0x90  do_syscall_64+0xbb/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-53185)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check for overflows in io_pin_pages  WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace:  \u0026lt;TASK\u0026gt;  __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183  io_rings_map io_uring/io_uring.c:2611 [inline]  io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470  io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692  io_uring_setup io_uring/io_uring.c:3781 [inline]  ...  \u0026lt;/TASK\u0026gt;  io_pin_pages()\u0026apos;s uaddr parameter came directly from the user and can be garbage. Don\u0026apos;t just add size to it as it can overflow.(CVE-2024-53187)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  PCI: Fix use-after-free of slot-\u0026gt;bus on hot remove  Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.  Since commit 0fc70886569c (\u0026quot;thunderbolt: Reset USB4 v2 host router\u0026quot;) and commit 59a54c5f3dbd (\u0026quot;thunderbolt: Reset topology created by the boot firmware\u0026quot;), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver.  The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router\u0026apos;s Root Port and thus causes hot removal of the dock.  The crash occurs when pciehp is unbound from one of the dock\u0026apos;s Downstream Ports:  pciehp creates a pci_slot on bind and destroys it on unbind.  The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired.  The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot-\u0026gt;bus.  In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device().  However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device().  To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy:  It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device().  There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device().  In Dennis\u0026apos; case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices().  pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device().  Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free.  One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run.  However it seems risky that pci_slot points to pci_bus without holding a reference.  Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming.  If pci_slot has a need to access data in pci_bus, it ought to acquire a reference.  Amend pci_create_slot() accordingly.  Dennis reports that the crash is not reproducible with this change.  Abridged stacktrace:    pcieport 0000:00:07.0: PME: Signaling with IRQ 156   pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+   pci_bus 0000:20: dev 00, created physical slot 12   pcieport 0000:00:07.0: pciehp: Slot(12): Card not present   ...   pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0   Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI   CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1   RIP: 0010:dev_driver_string+0x12/0x40   pci_destroy_slot   pciehp_remove   pcie_port_remove_service   device_release_driver_internal   bus_remove_device   device_del   device_unregister   remove_iter   device_for_each_child   pcie_portdrv_remove   pci_device_remove   device_release_driver_internal   bus_remove_device   device_del   pci_remove_bus_device (recursive invocation)   pci_remove_bus_device   pciehp_unconfigure_device   pciehp_disable_slot   pciehp_handle_presence_or_link_change   pciehp_ist(CVE-2024-53194)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices  A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev-\u0026gt;config.  This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.(CVE-2024-53197)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  virtiofs: use pages instead of pointer for kernel direct IO  When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported:    ------------[ cut here ]------------   WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ......   Modules linked in:   CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......   RIP: 0010:__alloc_pages+0x2bf/0x380   ......   Call Trace:    \u0026lt;TASK\u0026gt;    ? __warn+0x8e/0x150    ? __alloc_pages+0x2bf/0x380    __kmalloc_large_node+0x86/0x160    __kmalloc+0x33c/0x480    virtio_fs_enqueue_req+0x240/0x6d0    virtio_fs_wake_pending_and_unlock+0x7f/0x190    queue_request_and_unlock+0x55/0x60    fuse_simple_request+0x152/0x2b0    fuse_direct_io+0x5d2/0x8c0    fuse_file_read_iter+0x121/0x160    __kernel_read+0x151/0x2d0    kernel_read+0x45/0x50    kernel_read_file+0x1a9/0x2a0    init_module_from_file+0x6a/0xe0    idempotent_init_module+0x175/0x230    __x64_sys_finit_module+0x5d/0xb0    x64_sys_call+0x1c3/0x9e0    do_syscall_64+0x3d/0xc0    entry_SYSCALL_64_after_hwframe+0x4b/0x53    ......    \u0026lt;/TASK\u0026gt;   ---[ end trace 0000000000000000 ]---  The warning is triggered as follows:  1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first.  2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter().  3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc-\u0026gt;max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn\u0026apos;t split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock().  4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages():   if (WARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp))   return NULL;  5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won\u0026apos;t help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever.  A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc-\u0026gt;max_write in kernel.  So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data.  After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations.  It may seem necessary to introduce another fie ---truncated---(CVE-2024-53219)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()  There\u0026apos;s issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace:  \u0026lt;TASK\u0026gt;  f2fs_submit_page_bio+0x126/0x8b0 [f2fs]  __get_meta_page+0x1d4/0x920 [f2fs]  get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs]  validate_checkpoint+0xac/0x290 [f2fs]  f2fs_get_valid_checkpoint+0x207/0x950 [f2fs]  f2fs_fill_super+0x1007/0x39b0 [f2fs]  mount_bdev+0x183/0x250  legacy_get_tree+0xf4/0x1e0  vfs_get_tree+0x88/0x340  do_new_mount+0x283/0x5e0  path_mount+0x2b2/0x15b0  __x64_sys_mount+0x1fe/0x270  do_syscall_64+0x5f/0x170  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Above issue happens as the biset of the f2fs file system is not initialized before register \u0026quot;f2fs_fs_type\u0026quot;. To address above issue just register \u0026quot;f2fs_fs_type\u0026quot; at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized.(CVE-2024-53221)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Move events notifier registration to be after device registration  Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events.  Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below.  BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 \u0026lt;4c\u0026gt; 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]---(CVE-2024-53224)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: bfa: Fix use-after-free in bfad_im_module_exit()  BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303  Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x95/0xe0  print_report+0xcb/0x620  kasan_report+0xbd/0xf0  __lock_acquire+0x2aca/0x3a20  lock_acquire+0x19b/0x520  _raw_spin_lock+0x2b/0x40  attribute_container_unregister+0x30/0x160  fc_release_transport+0x19/0x90 [scsi_transport_fc]  bfad_im_module_exit+0x23/0x60 [bfa]  bfad_init+0xdb/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  \u0026lt;/TASK\u0026gt;  Allocated by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  __kasan_kmalloc+0x7f/0x90  fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]  bfad_im_module_init+0x17/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3b/0x60  __kasan_slab_free+0x38/0x50  kfree+0x212/0x480  bfad_im_module_init+0x7e/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Above issue happens as follows:  bfad_init   error = bfad_im_module_init()     fc_release_transport(bfad_im_scsi_transport_template);   if (error)     goto ext;  ext:   bfad_im_module_exit();     fc_release_transport(bfad_im_scsi_transport_template);     --\u0026gt; Trigger double release  Don\u0026apos;t call bfad_im_module_exit() if bfad_im_module_init() failed.(CVE-2024-53227)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: 6fire: Release resources at card release  The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort().  But at this moment, the card object might be still in use (as we\u0026apos;re calling snd_card_free_when_closed()).  For avoid potential UAFs, move the release of resources to the card\u0026apos;s private_free instead of the manual call of usb6fire_chip_destroy() at the USB disconnect callback.(CVE-2024-53239)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm: zynqmp_kms: Unplug DRM device before removal  Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver\u0026apos;s internals.(CVE-2024-56538)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  hfsplus: don\u0026apos;t query the device logical block size multiple times  Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.  While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.  Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.  Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.  The produced KASAN report before the fix looks like this:  [  419.944641] ================================================================== [  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [  419.947612] [  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [  419.950035] Call Trace: [  419.950384]  \u0026lt;TASK\u0026gt; [  419.950676]  dump_stack_lvl+0x57/0x78 [  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.951830]  print_report+0x14c/0x49e [  419.952361]  ? __virt_addr_valid+0x267/0x278 [  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d [  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.954231]  kasan_report+0x89/0xb0 [  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.955367]  hfsplus_read_wrapper+0x659/0xa0a [  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10 [  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9 [  419.957214]  ? _raw_spin_unlock+0x1a/0x2e [  419.957772]  hfsplus_fill_super+0x348/0x1590 [  419.958355]  ? hlock_class+0x4c/0x109 [  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.959499]  ? __pfx_string+0x10/0x10 [  419.960006]  ? lock_acquire+0x3e2/0x454 [  419.960532]  ? bdev_name.constprop.0+0xce/0x243 [  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10 [  419.961799]  ? pointer+0x3f0/0x62f [  419.962277]  ? __pfx_pointer+0x10/0x10 [  419.962761]  ? vsnprintf+0x6c4/0xfba [  419.963178]  ? __pfx_vsnprintf+0x10/0x10 [  419.963621]  ? setup_bdev_super+0x376/0x3b3 [  419.964029]  ? snprintf+0x9d/0xd2 [  419.964344]  ? __pfx_snprintf+0x10/0x10 [  419.964675]  ? lock_acquired+0x45c/0x5e9 [  419.965016]  ? set_blocksize+0x139/0x1c1 [  419.965381]  ? sb_set_blocksize+0x6d/0xae [  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.966179]  mount_bdev+0x12f/0x1bf [  419.966512]  ? __pfx_mount_bdev+0x10/0x10 [  419.966886]  ? vfs_parse_fs_string+0xce/0x111 [  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10 [  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10 [  419.968073]  legacy_get_tree+0x104/0x178 [  419.968414]  vfs_get_tree+0x86/0x296 [  419.968751]  path_mount+0xba3/0xd0b [  419.969157]  ? __pfx_path_mount+0x10/0x10 [  419.969594]  ? kmem_cache_free+0x1e2/0x260 [  419.970311]  do_mount+0x99/0xe0 [  419.970630]  ? __pfx_do_mount+0x10/0x10 [  419.971008]  __do_sys_mount+0x199/0x1c9 [  419.971397]  do_syscall_64+0xd0/0x135 [  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e [  419.972233] RIP: 0033:0x7c3cb812972e [  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: ---truncated---(CVE-2024-56548)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()  if (dev-\u0026gt;boardinfo \u0026amp;\u0026amp; dev-\u0026gt;boardinfo-\u0026gt;init_dyn_addr)                                       ^^^ here check \u0026quot;init_dyn_addr\u0026quot;  i3c_bus_set_addr_slot_status(\u0026amp;master-\u0026gt;bus, dev-\u0026gt;info.dyn_addr, ...)                    ^^^^        free \u0026quot;dyn_addr\u0026quot; Fix copy/paste error \u0026quot;dyn_addr\u0026quot; by replacing it with \u0026quot;init_dyn_addr\u0026quot;.(CVE-2024-56562)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ad7780: fix division by zero in ad7780_write_raw()  In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is based on iio_info\u0026apos;s write_raw. While val is explicitly declared that can be zero (in read mode), val2 is not specified to be non-zero.(CVE-2024-56567)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ftrace: Fix regression with module command in stack_trace_filter  When executing the following command:      # echo \u0026quot;write*:mod:ext3\u0026quot; \u0026gt; /sys/kernel/tracing/stack_trace_filter  The current mod command causes a null pointer dereference. While commit 0f17976568b3f (\u0026quot;ftrace: Fix regression with module command in stack_trace_filter\u0026quot;) has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.(CVE-2024-56569)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ovl: Filter invalid inodes with missing lookup function  Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.(CVE-2024-56570)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: ref-verify: fix use-after-free after invalid ref action  At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable \u0026apos;ref\u0026apos;) into the respective block entry\u0026apos;s rbtree (local variable \u0026apos;be\u0026apos;), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry\u0026apos;s rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn\u0026apos;t remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.  Syzbot report this with the following stack traces:     BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314       btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]       btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23       btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482       btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293       vfs_unlink+0x365/0x650 fs/namei.c:4469       do_unlinkat+0x4ae/0x830 fs/namei.c:4533       __do_sys_unlinkat fs/namei.c:4576 [inline]       __se_sys_unlinkat fs/namei.c:4569 [inline]       __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569       do_syscall_x64 arch/x86/entry/common.c:52 [inline]       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83       entry_SYSCALL_64_after_hwframe+0x77/0x7f    BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1       __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521       update_ref_for_cow+0x96a/0x11f0       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]       __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137       __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171       btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313       prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586       relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611       btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081       btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377       __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161       btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538    BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_i ---truncated---(CVE-2024-56581)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sched/deadline: Fix warning in migrate_enable for boosted tasks  When running the following command:  while true; do     stress-ng --cyclic 30 --timeout 30s --minimize --quiet done  a warning is eventually triggered:  WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace:  \u0026lt;TASK\u0026gt;  ? show_trace_log_lvl+0x1c4/0x2df  ? enqueue_dl_entity+0x631/0x6e0  ? setup_new_dl_entity+0x13e/0x180  ? __warn+0x7e/0xd0  ? report_bug+0x11a/0x1a0  ? handle_bug+0x3c/0x70  ? exc_invalid_op+0x14/0x70  ? asm_exc_invalid_op+0x16/0x20  enqueue_dl_entity+0x631/0x6e0  enqueue_task_dl+0x7d/0x120  __do_set_cpus_allowed+0xe3/0x280  __set_cpus_allowed_ptr_locked+0x140/0x1d0  __set_cpus_allowed_ptr+0x54/0xa0  migrate_enable+0x7e/0x150  rt_spin_unlock+0x1c/0x90  group_send_sig_info+0xf7/0x1a0  ? kill_pid_info+0x1f/0x1d0  kill_pid_info+0x78/0x1d0  kill_proc_info+0x5b/0x110  __x64_sys_kill+0x93/0xc0  do_syscall_64+0x5c/0xf0  entry_SYSCALL_64_after_hwframe+0x6e/0x76  RIP: 0033:0x7f0dab31f92b  This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call.  Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that\u0026apos;s the case.(CVE-2024-56583)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/tctx: work around xa_store() allocation error issue  syzbot triggered the following WARN_ON:  WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51  which is the  WARN_ON_ONCE(!xa_empty(\u0026amp;tctx-\u0026gt;xa));  sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with -\u0026gt;head being non-NULL even though no entries exist in the xarray.  Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.(CVE-2024-56584)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.  creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace:  __die_body+0x15/0x60  die+0x33/0x50  do_trap+0x10a/0x120  f2fs_evict_inode+0x58c/0x610  do_error_trap+0x60/0x80  f2fs_evict_inode+0x58c/0x610  exc_invalid_op+0x53/0x60  f2fs_evict_inode+0x58c/0x610  asm_exc_invalid_op+0x16/0x20  f2fs_evict_inode+0x58c/0x610  evict+0x101/0x260  dispose_list+0x30/0x50  evict_inodes+0x140/0x190  generic_shutdown_super+0x2f/0x150  kill_block_super+0x11/0x40  kill_f2fs_super+0x7d/0x140  deactivate_locked_super+0x2a/0x70  cleanup_mnt+0xb3/0x140  task_work_run+0x61/0x90  The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows:  dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir  Let\u0026apos;s redirty inode when there is not free segments during checkpoint is disable.(CVE-2024-56586)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: set the right AMDGPU sg segment limitation  The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following:  WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [  364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [  364.049532]  ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [  364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G           OE      6.10.0-custom #492 [  364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [  364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [  364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff \u0026lt;0f\u0026gt; 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [  364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [  364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [  364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [  364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [  364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [  364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [  364.049599] FS:  00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [  364.049601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [  364.049605] Call Trace: [  364.049607]  \u0026lt;TASK\u0026gt; [  364.049609]  ? show_regs+0x6d/0x80 [  364.049614]  ? __warn+0x8c/0x140 [  364.049618]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049621]  ? report_bug+0x193/0x1a0 [  364.049627]  ? handle_bug+0x46/0x80 [  364.049631]  ? exc_invalid_op+0x1d/0x80 [  364.049635]  ? asm_exc_invalid_op+0x1f/0x30 [  364.049642]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049647]  __dma_map_sg_attrs+0x90/0xe0 [  364.049651]  dma_map_sgtable+0x25/0x40 [  364.049654]  amdgpu_bo_move+0x59a/0x850 [amdgpu] [  364.049935]  ? srso_return_thunk+0x5/0x5f [  364.049939]  ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [  364.050095]  ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [  364.050103]  ttm_bo_validate+0xc1/0x160 [ttm] [  364.050108]  ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [  364.050263]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [  364.050473]  kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [  364.050680]  kfd_ioctl+0x3c2/0x530 [amdgpu] [  364.050866]  ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [  364.05105 ---truncated---(CVE-2024-56594)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: fix array-index-out-of-bounds in jfs_readdir  The stbl might contain some invalid values. Added a check to return error code in that case.(CVE-2024-56596)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: array-index-out-of-bounds fix in dtReadFirst  The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.(CVE-2024-56598)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()  bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free.  Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().(CVE-2024-56604)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()  bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.(CVE-2024-56605)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Fix out-of-bounds access in \u0026apos;dcn21_link_encoder_create\u0026apos;  An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array\u0026apos;s bounds before accessing it.  This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior.  References:  [   65.920507] ------------[ cut here ]------------ [   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [   65.920519] index 7 is out of range for type \u0026apos;dcn10_link_enc_hpd_registers [5]\u0026apos; [   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [   65.920527] Call Trace: [   65.920529]  \u0026lt;TASK\u0026gt; [   65.920532]  dump_stack_lvl+0x48/0x70 [   65.920541]  dump_stack+0x10/0x20 [   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0 [   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [   65.921009]  link_create+0x6d3/0xed0 [amdgpu] [   65.921355]  create_links+0x18a/0x4e0 [amdgpu] [   65.921679]  dc_create+0x360/0x720 [amdgpu] [   65.921999]  ? dmi_matches+0xa0/0x220 [   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [   65.922342]  ? console_unlock+0x77/0x120 [   65.922348]  ? dev_printk_emit+0x86/0xb0 [   65.922354]  dm_hw_init+0x15/0x40 [amdgpu] [   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [   65.923087]  local_pci_probe+0x4b/0xb0 [   65.923087]  pci_device_probe+0xc8/0x280 [   65.923087]  really_probe+0x187/0x300 [   65.923087]  __driver_probe_device+0x85/0x130 [   65.923087]  driver_probe_device+0x24/0x110 [   65.923087]  __driver_attach+0xac/0x1d0 [   65.923087]  ? __pfx___driver_attach+0x10/0x10 [   65.923087]  bus_for_each_dev+0x7d/0xd0 [   65.923087]  driver_attach+0x1e/0x30 [   65.923087]  bus_add_driver+0xf2/0x200 [   65.923087]  driver_register+0x64/0x130 [   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [   65.923087]  __pci_register_driver+0x61/0x70 [   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu] [   65.923087]  do_one_initcall+0x49/0x310 [   65.923087]  ? kmalloc_trace+0x136/0x360 [   65.923087]  do_init_module+0x6a/0x270 [   65.923087]  load_module+0x1fce/0x23a0 [   65.923087]  init_module_from_file+0x9c/0xe0 [   65.923087]  ? init_module_from_file+0x9c/0xe0 [   65.923087]  idempotent_init_module+0x179/0x230 [   65.923087]  __x64_sys_finit_module+0x5d/0xa0 [   65.923087]  do_syscall_64+0x76/0x120 [   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76 [   65.923087] RIP: 0033:0x7f2d80f1e88d [   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [   65.923087]  \u0026lt;/TASK\u0026gt; [   65.923927] ---[ end trace ]---(CVE-2024-56608)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: fix OOB devmap writes when deleting elements  Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed.  When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32.  Example splat below:  [  160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [  160.731662] #PF: supervisor read access in kernel mode [  160.736876] #PF: error_code(0x0000) - not-present page [  160.742095] PGD 0 P4D 0 [  160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [  160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [  160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [  160.767642] Workqueue: events_unbound bpf_map_free_deferred [  160.773308] RIP: 0010:dev_map_free+0x77/0x170 [  160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 \u0026lt;48\u0026gt; 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [  160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [  160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [  160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [  160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [  160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [  160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [  160.838310] FS:  0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [  160.846528] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [  160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [  160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [  160.874092] PKRU: 55555554 [  160.876847] Call Trace: [  160.879338]  \u0026lt;TASK\u0026gt; [  160.881477]  ? __die+0x20/0x60 [  160.884586]  ? page_fault_oops+0x15a/0x450 [  160.888746]  ? search_extable+0x22/0x30 [  160.892647]  ? search_bpf_extables+0x5f/0x80 [  160.896988]  ? exc_page_fault+0xa9/0x140 [  160.900973]  ? asm_exc_page_fault+0x22/0x30 [  160.905232]  ? dev_map_free+0x77/0x170 [  160.909043]  ? dev_map_free+0x58/0x170 [  160.912857]  bpf_map_free_deferred+0x51/0x90 [  160.917196]  process_one_work+0x142/0x370 [  160.921272]  worker_thread+0x29e/0x3b0 [  160.925082]  ? rescuer_thread+0x4b0/0x4b0 [  160.929157]  kthread+0xd4/0x110 [  160.932355]  ? kthread_park+0x80/0x80 [  160.936079]  ret_from_fork+0x2d/0x50 [  160.943396]  ? kthread_park+0x80/0x80 [  160.950803]  ret_from_fork_asm+0x11/0x20 [  160.958482]  \u0026lt;/TASK\u0026gt;(CVE-2024-56615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()  Syzbot reported that when searching for records in a directory where the inode\u0026apos;s i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled.  This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned.  This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size.  Fix this issue by changing the type of the local variable causing the bit loss from \u0026quot;unsigned int\u0026quot; to \u0026quot;u64\u0026quot;.  The return value of nilfs_last_byte() is also of type \u0026quot;unsigned int\u0026quot;, but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.(CVE-2024-56619)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read  An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting \u0026apos;vfs objects = streams_xattr parameter\u0026apos; in ksmbd.conf.(CVE-2024-56627)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix when get product name maybe null pointer  Due to incorrect dev-\u0026gt;product reporting by certain devices, null pointer dereferences occur when dev-\u0026gt;product is empty, leading to potential system crashes.  This issue was found on EXCELSIOR DL37-D05 device with Loongson-LS3A6000-7A2000-DL37 motherboard.  Kernel logs: [   56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci [   56.671638] usb 4-3: string descriptor 0 read error: -22 [   56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07 [   56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [   56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0 [   56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80 [   56.697732] Oops[#1]: [   56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G           OE      6.6.0-loong64-desktop #25.00.2000.015 [   56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024 [   56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0 [   56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000 [   56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000 [   56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005 [   56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000 [   56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028 [   56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000 [   56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000 [   56.697753]    ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom] [   56.697802]   ERA: 90000000066e35c8 strstr+0x28/0x120 [   56.697806]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [   56.697816]  PRMD: 0000000c (PPLV0 +PIE +PWE) [   56.697821]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [   56.697827]  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [   56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [   56.697835]  BADV: 0000000000000000 [   56.697836]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [   56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit [   56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3) [   56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000 [   56.697896]         0000000000000000 00000011fffffffd 0000000000000000 0000000000000000 [   56.697901]         0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0 [   56.697906]         90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c [   56.697911]         90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440 [   56.697916]         ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0 [   56.697921]         0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c [   56.697926]         ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000 [   56.697931]         90000001000bb8d0  ---truncated---(CVE-2024-56629)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: free inode when ocfs2_get_init_inode() fails  syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 (\u0026quot;ocfs2: Handle error from dquot_initialize()\u0026quot;) forgot to call iput() when new_inode() succeeded and dquot_initialize() failed.(CVE-2024-56630)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: Fix UAF in blkcg_unpin_online()  blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:    ==================================================================   BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270   Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117    CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022   Workqueue: cgwb_release cgwb_release_workfn   Call Trace:    \u0026lt;TASK\u0026gt;    dump_stack_lvl+0x27/0x80    print_report+0x151/0x710    kasan_report+0xc0/0x100    blkcg_unpin_online+0x15a/0x270    cgwb_release_workfn+0x194/0x480    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30    \u0026lt;/TASK\u0026gt;   ...   Freed by task 1944:    kasan_save_track+0x2b/0x70    kasan_save_free_info+0x3c/0x50    __kasan_slab_free+0x33/0x50    kfree+0x10c/0x330    css_free_rwork_fn+0xe6/0xb30    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30  Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().  Fix it by reading the parent pointer before destroying the blkcg\u0026apos;s blkg\u0026apos;s.(CVE-2024-56672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: bcm - add error check in the ahash_hmac_init function  The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.(CVE-2024-56681)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ext4: fix race in buffer_head read fault injection  When I enabled ext4 debug for fault injection testing, I encountered the following warning:    EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:          Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051   WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0  The root cause of the issue lies in the improper implementation of ext4\u0026apos;s buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions.  [CPU0]           [CPU1]         [CPU2] ext4_read_inode_bitmap   ext4_read_bh()   \u0026lt;bh read complete\u0026gt;                  ext4_read_inode_bitmap                    if (buffer_uptodate(bh))                      return bh                                jbd2_journal_commit_transaction                                  __jbd2_journal_refile_buffer                                    __jbd2_journal_unfile_buffer                                      __jbd2_journal_temp_unlink_buffer   ext4_simulate_fail_bh()     clear_buffer_uptodate                                       mark_buffer_dirty                                         \u0026lt;report warning\u0026gt;                                         WARN_ON_ONCE(!buffer_uptodate(bh))  The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb.  Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection.(CVE-2024-56686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device  While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).  Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.(CVE-2024-56691)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on node blkaddr in truncate_node()  syzbot reports a f2fs bug as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace:  truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909  f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288  f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856  evict+0x4e8/0x9b0 fs/inode.c:723  f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986  f2fs_create+0x357/0x530 fs/f2fs/namei.c:394  lookup_open fs/namei.c:3595 [inline]  open_last_lookups fs/namei.c:3694 [inline]  path_openat+0x1c03/0x3590 fs/namei.c:3930  do_filp_open+0x235/0x490 fs/namei.c:3960  do_sys_openat2+0x13e/0x1d0 fs/open.c:1415  do_sys_open fs/open.c:1430 [inline]  __do_sys_openat fs/open.c:1446 [inline]  __se_sys_openat fs/open.c:1441 [inline]  __x64_sys_openat+0x247/0x2a0 fs/open.c:1441  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534  The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let\u0026apos;s add sanity check on nat blkaddr in truncate_node().(CVE-2024-56692)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: wl128x: Fix atomicity violation in fmc_send_cmd()  Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev-\u0026gt;resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev-\u0026gt;resp_skb variable is assigned a null value. This results in an invalid fmdev-\u0026gt;resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev-\u0026gt;resp_skb; when the invalid fmdev-\u0026gt;resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb-\u0026gt;data;  To address this issue, it is recommended to include the validity check of fmdev-\u0026gt;resp_skb within the locked section of the function. This modification ensures that the value of fmdev-\u0026gt;resp_skb does not change during the validation process, thereby maintaining its validity.  This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.(CVE-2024-56700)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check if iowq is killed before queuing  task work can be executed after the task has gone through io_uring termination, whether it\u0026apos;s the final task_work run or the fallback path. In this case, task work will find -\u0026gt;io_wq being already killed and null\u0026apos;ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case.  Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case -\u0026gt;iowq check would race.(CVE-2024-56709)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/hns: Fix cpu stuck caused by printings during reset  During reset, cmd to destroy resources such as qp, cq, and mr may fail, and error logs will be printed. When a large number of resources are destroyed, there will be lots of printings, and it may lead to a cpu stuck.  Delete some unnecessary printings and replace other printing functions in these paths with the ratelimited version.(CVE-2024-56722)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()  If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware.  When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc-\u0026gt;timerqueue, they will continually expire, may causing kernel softlockup.(CVE-2024-56739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()  Hook \u0026quot;qedi_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()  Hook \u0026quot;qed_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56748)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nvme-pci: fix freeing of the HMB descriptor table  The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.  In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.(CVE-2024-56756)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tracing: Prevent bad count for tracing_cpumask_write  If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.(CVE-2024-56763)","status":"published","published":"2025-01-10T11:08:07Z","modified":"2026-08-18T01:18:45.08468749Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1037","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK  When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as below when showing /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.  [    3.052463] ------------[ cut here ]------------ [    3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [    3.070072] Modules linked in: efivarfs autofs4 [    3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [    3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [    3.109127]         9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [    3.118774]         90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [    3.128412]         0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [    3.138056]         0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [    3.147711]         ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [    3.157364]         900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [    3.167012]         0000000000000009 000000000000006c 0000000000000000 0000000000000000 [    3.176641]         9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [    3.186260]         00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [    3.195868]         ... [    3.199917] Call Trace: [    3.203941] [\u0026lt;90000000002086d8\u0026gt;] show_stack+0x38/0x14c [    3.210666] [\u0026lt;9000000000cf846c\u0026gt;] dump_stack_lvl+0x60/0x88 [    3.217625] [\u0026lt;900000000023d268\u0026gt;] __warn+0xd0/0x100 [    3.223958] [\u0026lt;9000000000cf3c90\u0026gt;] warn_slowpath_fmt+0x7c/0xcc [    3.231150] [\u0026lt;9000000000210220\u0026gt;] show_cpuinfo+0x5e8/0x5f0 [    3.238080] [\u0026lt;90000000004f578c\u0026gt;] seq_read_iter+0x354/0x4b4 [    3.245098] [\u0026lt;90000000004c2e90\u0026gt;] new_sync_read+0x17c/0x1c4 [    3.252114] [\u0026lt;90000000004c5174\u0026gt;] vfs_read+0x138/0x1d0 [    3.258694] [\u0026lt;90000000004c55f8\u0026gt;] ksys_read+0x70/0x100 [    3.265265] [\u0026lt;9000000000cfde9c\u0026gt;] do_syscall+0x7c/0x94 [    3.271820] [\u0026lt;9000000000202fe4\u0026gt;] handle_syscall+0xc4/0x160 [    3.281824] ---[ end trace 8b484262b4b8c24c ]---(CVE-2022-49034)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: hisilicon/qm - inject error before stopping queue  The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the qm error to close the master ooo. Currently, the qm error is injected after stopping queue, memory may be released immediately after stopping queue, causing the device to access the released memory. Therefore, error is injected to close master ooo before stopping queue to ensure that the device does not access the released memory.(CVE-2024-47730)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Check null pointers before using dc-\u0026gt;clk_mgr  [WHY \u0026amp; HOW] dc-\u0026gt;clk_mgr is null checked previously in the same function, indicating it might be null.  Passing \u0026quot;dc\u0026quot; to \u0026quot;dc-\u0026gt;hwss.apply_idle_power_optimizations\u0026quot;, which dereferences null \u0026quot;dc-\u0026gt;clk_mgr\u0026quot;. (The function pointer resolves to \u0026quot;dcn35_apply_idle_power_optimizations\u0026quot;.)  This fixes 1 FORWARD_NULL issue reported by Coverity.(CVE-2024-49907)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix error path in multi-packet WQE transmit  Remove the erroneous unmap in case no DMA mapping was established  The multi-packet WQE transmit code attempts to obtain a DMA mapping for the skb. This could fail, e.g. under memory pressure, when the IOMMU driver just can\u0026apos;t allocate more memory for page tables. While the code tries to handle this in the path below the err_unmap label it erroneously unmaps one entry from the sq\u0026apos;s FIFO list of active mappings. Since the current map attempt failed this unmap is removing some random DMA mapping that might still be required. If the PCI function now presents that IOVA, the IOMMU may assumes a rogue DMA access and e.g. on s390 puts the PCI function in error state.  The erroneous behavior was seen in a stress-test environment that created memory pressure.(CVE-2024-50001)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  net: phy: dp83869: fix memory corruption when enabling fiber  When configuring the fiber port, the DP83869 PHY driver incorrectly calls linkmode_set_bit() with a bit mask (1 \u0026lt;\u0026lt; 10) rather than a bit number (10). This corrupts some other memory location -- in case of arm64 the priv pointer in the same structure.  Since the advertising flags are updated from supported at the end of the function the incorrect line isn\u0026apos;t needed at all and can be removed.(CVE-2024-50188)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()  In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout \u0026gt; (clk_get_rate(st-\u0026gt;mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value.(CVE-2024-50233)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  vsock/virtio: Initialization of the dangling pointer occurring in vsk-\u0026gt;trans  During loopback communication, a dangling pointer can be created in vsk-\u0026gt;trans, potentially leading to a Use-After-Free condition.  This issue is resolved by initializing vsk-\u0026gt;trans to NULL.(CVE-2024-50264)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent a potential integer overflow  If the tag length is \u0026gt;= U32_MAX - 3 then the \u0026quot;length + 4\u0026quot; addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.(CVE-2024-53146)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  exfat: fix out-of-bounds access of directory entries  In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei-\u0026gt;hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption.  This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty.(CVE-2024-53147)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ocfs2: fix uninitialized value in ocfs2_file_read_iter()  Syzbot has reported the following KMSAN splat:  BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80  ocfs2_file_read_iter+0x9a4/0xf80  __io_read+0x8d4/0x20f0  io_read+0x3e/0xf0  io_issue_sqe+0x42b/0x22c0  io_wq_submit_work+0xaf9/0xdc0  io_worker_handle_work+0xd13/0x2110  io_wq_worker+0x447/0x1410  ret_from_fork+0x6f/0x90  ret_from_fork_asm+0x1a/0x30  Uninit was created at:  __alloc_pages_noprof+0x9a7/0xe00  alloc_pages_mpol_noprof+0x299/0x990  alloc_pages_noprof+0x1bf/0x1e0  allocate_slab+0x33a/0x1250  ___slab_alloc+0x12ef/0x35e0  kmem_cache_alloc_bulk_noprof+0x486/0x1330  __io_alloc_req_refill+0x84/0x560  io_submit_sqes+0x172f/0x2f30  __se_sys_io_uring_enter+0x406/0x41c0  __x64_sys_io_uring_enter+0x11f/0x1a0  x64_sys_call+0x2b54/0x3ba0  do_syscall_64+0xcd/0x1e0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Since an instance of \u0026apos;struct kiocb\u0026apos; may be passed from the block layer with \u0026apos;private\u0026apos; field uninitialized, introduce \u0026apos;ocfs2_iocb_init_rw_locked()\u0026apos; and use it from where \u0026apos;ocfs2_dio_end_io()\u0026apos; might take care, i.e. in \u0026apos;ocfs2_file_read_iter()\u0026apos; and \u0026apos;ocfs2_file_write_iter()\u0026apos;.(CVE-2024-53155)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()  This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration.  However, that check doesn\u0026apos;t make sense on the first iteration through the loop. It leads to reading before the start of these-\u0026gt;clk_perf_tbl[] array.(CVE-2024-53158)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  EDAC/bluefield: Fix potential integer overflow  The 64-bit argument for the \u0026quot;get DIMM info\u0026quot; SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index.  With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument.  The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.(CVE-2024-53161)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sh: intc: Fix use-after-free bug in register_intc_controller()  In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let\u0026apos;s only add it to the list after everything has succeeded.(CVE-2024-53165)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSv4.0: Fix a use-after-free problem in the asynchronous open()  Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() in nfs4_open_release() before the rpc_task is freed.(CVE-2024-53173)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  smb: client: fix NULL ptr deref in crypto_aead_setkey()  Neither SMB3.0 or SMB3.02 supports encryption negotiate context, so when SMB2_GLOBAL_CAP_ENCRYPTION flag is set in the negotiate response, the client uses AES-128-CCM as the default cipher.  See MS-SMB2 3.3.5.4.  Commit b0abcd65ec54 (\u0026quot;smb: client: fix UAF in async decryption\u0026quot;) added a @server-\u0026gt;cipher_type check to conditionally call smb3_crypto_aead_allocate(), but that check would always be false as @server-\u0026gt;cipher_type is unset for SMB3.02.  Fix the following KASAN splat by setting @server-\u0026gt;cipher_type for SMB3.02 as well.  mount.cifs //srv/share /mnt -o vers=3.02,seal,...  BUG: KASAN: null-ptr-deref in crypto_aead_setkey+0x2c/0x130 Read of size 8 at addr 0000000000000020 by task mount.cifs/1095 CPU: 1 UID: 0 PID: 1095 Comm: mount.cifs Not tainted 6.12.0 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-3.fc41 04/01/2014 Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x5d/0x80  ? crypto_aead_setkey+0x2c/0x130  kasan_report+0xda/0x110  ? crypto_aead_setkey+0x2c/0x130  crypto_aead_setkey+0x2c/0x130  crypt_message+0x258/0xec0 [cifs]  ? __asan_memset+0x23/0x50  ? __pfx_crypt_message+0x10/0x10 [cifs]  ? mark_lock+0xb0/0x6a0  ? hlock_class+0x32/0xb0  ? mark_lock+0xb0/0x6a0  smb3_init_transform_rq+0x352/0x3f0 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  smb_send_rqst+0x144/0x230 [cifs]  ? __pfx_smb_send_rqst+0x10/0x10 [cifs]  ? hlock_class+0x32/0xb0  ? smb2_setup_request+0x225/0x3a0 [cifs]  ? __pfx_cifs_compound_last_callback+0x10/0x10 [cifs]  compound_send_recv+0x59b/0x1140 [cifs]  ? __pfx_compound_send_recv+0x10/0x10 [cifs]  ? __create_object+0x5e/0x90  ? hlock_class+0x32/0xb0  ? do_raw_spin_unlock+0x9a/0xf0  cifs_send_recv+0x23/0x30 [cifs]  SMB2_tcon+0x3ec/0xb30 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? __pfx_lock_release+0x10/0x10  ? do_raw_spin_trylock+0xc6/0x120  ? lock_acquire+0x3f/0x90  ? _get_xid+0x16/0xd0 [cifs]  ? __pfx_SMB2_tcon+0x10/0x10 [cifs]  ? cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  cifs_get_smb_ses+0xcdd/0x10a0 [cifs]  ? __pfx_cifs_get_smb_ses+0x10/0x10 [cifs]  ? cifs_get_tcp_session+0xaa0/0xca0 [cifs]  cifs_mount_get_session+0x8a/0x210 [cifs]  dfs_mount_share+0x1b0/0x11d0 [cifs]  ? __pfx___lock_acquire+0x10/0x10  ? __pfx_dfs_mount_share+0x10/0x10 [cifs]  ? lock_acquire.part.0+0xf4/0x2a0  ? find_held_lock+0x8a/0xa0  ? hlock_class+0x32/0xb0  ? lock_release+0x203/0x5d0  cifs_mount+0xb3/0x3d0 [cifs]  ? do_raw_spin_trylock+0xc6/0x120  ? __pfx_cifs_mount+0x10/0x10 [cifs]  ? lock_acquire+0x3f/0x90  ? find_nls+0x16/0xa0  ? smb3_update_mnt_flags+0x372/0x3b0 [cifs]  cifs_smb3_do_mount+0x1e2/0xc80 [cifs]  ? __pfx_vfs_parse_fs_string+0x10/0x10  ? __pfx_cifs_smb3_do_mount+0x10/0x10 [cifs]  smb3_get_tree+0x1bf/0x330 [cifs]  vfs_get_tree+0x4a/0x160  path_mount+0x3c1/0xfb0  ? kasan_quarantine_put+0xc7/0x1d0  ? __pfx_path_mount+0x10/0x10  ? kmem_cache_free+0x118/0x3e0  ? user_path_at+0x74/0xa0  __x64_sys_mount+0x1a6/0x1e0  ? __pfx___x64_sys_mount+0x10/0x10  ? mark_held_locks+0x1a/0x90  do_syscall_64+0xbb/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-53185)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check for overflows in io_pin_pages  WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180 io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted 6.12.0-next-20241118-syzkaller #0 Call Trace:  \u0026lt;TASK\u0026gt;  __io_uaddr_map+0xfb/0x2d0 io_uring/memmap.c:183  io_rings_map io_uring/io_uring.c:2611 [inline]  io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470  io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692  io_uring_setup io_uring/io_uring.c:3781 [inline]  ...  \u0026lt;/TASK\u0026gt;  io_pin_pages()\u0026apos;s uaddr parameter came directly from the user and can be garbage. Don\u0026apos;t just add size to it as it can overflow.(CVE-2024-53187)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  PCI: Fix use-after-free of slot-\u0026gt;bus on hot remove  Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock.  Since commit 0fc70886569c (\u0026quot;thunderbolt: Reset USB4 v2 host router\u0026quot;) and commit 59a54c5f3dbd (\u0026quot;thunderbolt: Reset topology created by the boot firmware\u0026quot;), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver.  The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router\u0026apos;s Root Port and thus causes hot removal of the dock.  The crash occurs when pciehp is unbound from one of the dock\u0026apos;s Downstream Ports:  pciehp creates a pci_slot on bind and destroys it on unbind.  The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired.  The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot-\u0026gt;bus.  In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device().  However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device().  To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy:  It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device().  There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device().  In Dennis\u0026apos; case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices().  pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device().  Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free.  One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run.  However it seems risky that pci_slot points to pci_bus without holding a reference.  Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming.  If pci_slot has a need to access data in pci_bus, it ought to acquire a reference.  Amend pci_create_slot() accordingly.  Dennis reports that the crash is not reproducible with this change.  Abridged stacktrace:    pcieport 0000:00:07.0: PME: Signaling with IRQ 156   pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+   pci_bus 0000:20: dev 00, created physical slot 12   pcieport 0000:00:07.0: pciehp: Slot(12): Card not present   ...   pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0   Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI   CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1   RIP: 0010:dev_driver_string+0x12/0x40   pci_destroy_slot   pciehp_remove   pcie_port_remove_service   device_release_driver_internal   bus_remove_device   device_del   device_unregister   remove_iter   device_for_each_child   pcie_portdrv_remove   pci_device_remove   device_release_driver_internal   bus_remove_device   device_del   pci_remove_bus_device (recursive invocation)   pci_remove_bus_device   pciehp_unconfigure_device   pciehp_disable_slot   pciehp_handle_presence_or_link_change   pciehp_ist(CVE-2024-53194)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices  A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev-\u0026gt;config.  This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration.(CVE-2024-53197)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  NFSD: Prevent NULL dereference in nfsd4_process_cb_update()  @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try to dereference @ses and segfault.(CVE-2024-53217)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix race in concurrent f2fs_stop_gc_thread  In my test case, concurrent calls to f2fs shutdown report the following stack trace:   Oops: general protection fault, probably for non-canonical address 0xc6cfff63bb5513fc: 0000 [#1] PREEMPT SMP PTI  CPU: 0 UID: 0 PID: 678 Comm: f2fs_rep_shutdo Not tainted 6.12.0-rc5-next-20241029-g6fb2fa9805c5-dirty #85  Call Trace:   \u0026lt;TASK\u0026gt;   ? show_regs+0x8b/0xa0   ? __die_body+0x26/0xa0   ? die_addr+0x54/0x90   ? exc_general_protection+0x24b/0x5c0   ? asm_exc_general_protection+0x26/0x30   ? kthread_stop+0x46/0x390   f2fs_stop_gc_thread+0x6c/0x110   f2fs_do_shutdown+0x309/0x3a0   f2fs_ioc_shutdown+0x150/0x1c0   __f2fs_ioctl+0xffd/0x2ac0   f2fs_ioctl+0x76/0xe0   vfs_ioctl+0x23/0x60   __x64_sys_ioctl+0xce/0xf0   x64_sys_call+0x2b1b/0x4540   do_syscall_64+0xa7/0x240   entry_SYSCALL_64_after_hwframe+0x76/0x7e  The root cause is a race condition in f2fs_stop_gc_thread() called from different f2fs shutdown paths:    [CPU0]                       [CPU1]   ----------------------       -----------------------   f2fs_stop_gc_thread          f2fs_stop_gc_thread                                  gc_th = sbi-\u0026gt;gc_thread     gc_th = sbi-\u0026gt;gc_thread     kfree(gc_th)     sbi-\u0026gt;gc_thread = NULL                                  \u0026lt; gc_th != NULL \u0026gt;                                  kthread_stop(gc_th-\u0026gt;f2fs_gc_task) //UAF  The commit c7f114d864ac (\u0026quot;f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()\u0026quot;) attempted to fix this issue by using a read semaphore to prevent races between shutdown and remount threads, but it fails to prevent all race conditions.  Fix it by converting to write lock of s_umount in f2fs_do_shutdown().(CVE-2024-53218)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  virtiofs: use pages instead of pointer for kernel direct IO  When trying to insert a 10MB kernel module kept in a virtio-fs with cache disabled, the following warning was reported:    ------------[ cut here ]------------   WARNING: CPU: 1 PID: 404 at mm/page_alloc.c:4551 ......   Modules linked in:   CPU: 1 PID: 404 Comm: insmod Not tainted 6.9.0-rc5+ #123   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......   RIP: 0010:__alloc_pages+0x2bf/0x380   ......   Call Trace:    \u0026lt;TASK\u0026gt;    ? __warn+0x8e/0x150    ? __alloc_pages+0x2bf/0x380    __kmalloc_large_node+0x86/0x160    __kmalloc+0x33c/0x480    virtio_fs_enqueue_req+0x240/0x6d0    virtio_fs_wake_pending_and_unlock+0x7f/0x190    queue_request_and_unlock+0x55/0x60    fuse_simple_request+0x152/0x2b0    fuse_direct_io+0x5d2/0x8c0    fuse_file_read_iter+0x121/0x160    __kernel_read+0x151/0x2d0    kernel_read+0x45/0x50    kernel_read_file+0x1a9/0x2a0    init_module_from_file+0x6a/0xe0    idempotent_init_module+0x175/0x230    __x64_sys_finit_module+0x5d/0xb0    x64_sys_call+0x1c3/0x9e0    do_syscall_64+0x3d/0xc0    entry_SYSCALL_64_after_hwframe+0x4b/0x53    ......    \u0026lt;/TASK\u0026gt;   ---[ end trace 0000000000000000 ]---  The warning is triggered as follows:  1) syscall finit_module() handles the module insertion and it invokes kernel_read_file() to read the content of the module first.  2) kernel_read_file() allocates a 10MB buffer by using vmalloc() and passes it to kernel_read(). kernel_read() constructs a kvec iter by using iov_iter_kvec() and passes it to fuse_file_read_iter().  3) virtio-fs disables the cache, so fuse_file_read_iter() invokes fuse_direct_io(). As for now, the maximal read size for kvec iter is only limited by fc-\u0026gt;max_read. For virtio-fs, max_read is UINT_MAX, so fuse_direct_io() doesn\u0026apos;t split the 10MB buffer. It saves the address and the size of the 10MB-sized buffer in out_args[0] of a fuse request and passes the fuse request to virtio_fs_wake_pending_and_unlock().  4) virtio_fs_wake_pending_and_unlock() uses virtio_fs_enqueue_req() to queue the request. Because virtiofs need DMA-able address, so virtio_fs_enqueue_req() uses kmalloc() to allocate a bounce buffer for all fuse args, copies these args into the bounce buffer and passed the physical address of the bounce buffer to virtiofsd. The total length of these fuse args for the passed fuse request is about 10MB, so copy_args_to_argbuf() invokes kmalloc() with a 10MB size parameter and it triggers the warning in __alloc_pages():   if (WARN_ON_ONCE_GFP(order \u0026gt; MAX_PAGE_ORDER, gfp))   return NULL;  5) virtio_fs_enqueue_req() will retry the memory allocation in a kworker, but it won\u0026apos;t help, because kmalloc() will always return NULL due to the abnormal size and finit_module() will hang forever.  A feasible solution is to limit the value of max_read for virtio-fs, so the length passed to kmalloc() will be limited. However it will affect the maximal read size for normal read. And for virtio-fs write initiated from kernel, it has the similar problem but now there is no way to limit fc-\u0026gt;max_write in kernel.  So instead of limiting both the values of max_read and max_write in kernel, introducing use_pages_for_kvec_io in fuse_conn and setting it as true in virtiofs. When use_pages_for_kvec_io is enabled, fuse will use pages instead of pointer to pass the KVEC_IO data.  After switching to pages for KVEC_IO data, these pages will be used for DMA through virtio-fs. If these pages are backed by vmalloc(), {flush|invalidate}_kernel_vmap_range() are necessary to flush or invalidate the cache before the DMA operation. So add two new fields in fuse_args_pages to record the base address of vmalloc area and the condition indicating whether invalidation is needed. Perform the flush in fuse_get_user_pages() for write operations and the invalidation in fuse_release_user_pages() for read operations.  It may seem necessary to introduce another fie ---truncated---(CVE-2024-53219)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix null-ptr-deref in f2fs_submit_page_bio()  There\u0026apos;s issue as follows when concurrently installing the f2fs.ko module and mounting the f2fs file system: KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:__bio_alloc+0x2fb/0x6c0 [f2fs] Call Trace:  \u0026lt;TASK\u0026gt;  f2fs_submit_page_bio+0x126/0x8b0 [f2fs]  __get_meta_page+0x1d4/0x920 [f2fs]  get_checkpoint_version.constprop.0+0x2b/0x3c0 [f2fs]  validate_checkpoint+0xac/0x290 [f2fs]  f2fs_get_valid_checkpoint+0x207/0x950 [f2fs]  f2fs_fill_super+0x1007/0x39b0 [f2fs]  mount_bdev+0x183/0x250  legacy_get_tree+0xf4/0x1e0  vfs_get_tree+0x88/0x340  do_new_mount+0x283/0x5e0  path_mount+0x2b2/0x15b0  __x64_sys_mount+0x1fe/0x270  do_syscall_64+0x5f/0x170  entry_SYSCALL_64_after_hwframe+0x76/0x7e  Above issue happens as the biset of the f2fs file system is not initialized before register \u0026quot;f2fs_fs_type\u0026quot;. To address above issue just register \u0026quot;f2fs_fs_type\u0026quot; at the last in init_f2fs_fs(). Ensure that all f2fs file system resources are initialized.(CVE-2024-53221)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  RDMA/mlx5: Move events notifier registration to be after device registration  Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events.  Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below.  BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 \u0026lt;4c\u0026gt; 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]---(CVE-2024-53224)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: bfa: Fix use-after-free in bfad_im_module_exit()  BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303  Call Trace:  \u0026lt;TASK\u0026gt;  dump_stack_lvl+0x95/0xe0  print_report+0xcb/0x620  kasan_report+0xbd/0xf0  __lock_acquire+0x2aca/0x3a20  lock_acquire+0x19b/0x520  _raw_spin_lock+0x2b/0x40  attribute_container_unregister+0x30/0x160  fc_release_transport+0x19/0x90 [scsi_transport_fc]  bfad_im_module_exit+0x23/0x60 [bfa]  bfad_init+0xdb/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  \u0026lt;/TASK\u0026gt;  Allocated by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  __kasan_kmalloc+0x7f/0x90  fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]  bfad_im_module_init+0x17/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 25303:  kasan_save_stack+0x24/0x50  kasan_save_track+0x14/0x30  kasan_save_free_info+0x3b/0x60  __kasan_slab_free+0x38/0x50  kfree+0x212/0x480  bfad_im_module_init+0x7e/0x80 [bfa]  bfad_init+0x23/0xff0 [bfa]  do_one_initcall+0xdc/0x550  do_init_module+0x22d/0x6b0  load_module+0x4e96/0x5ff0  init_module_from_file+0xcd/0x130  idempotent_init_module+0x330/0x620  __x64_sys_finit_module+0xb3/0x110  do_syscall_64+0xc1/0x1d0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Above issue happens as follows:  bfad_init   error = bfad_im_module_init()     fc_release_transport(bfad_im_scsi_transport_template);   if (error)     goto ext;  ext:   bfad_im_module_exit();     fc_release_transport(bfad_im_scsi_transport_template);     --\u0026gt; Trigger double release  Don\u0026apos;t call bfad_im_module_exit() if bfad_im_module_init() failed.(CVE-2024-53227)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm: zynqmp_kms: Unplug DRM device before removal  Prevent userspace accesses to the DRM device from causing use-after-frees by unplugging the device before we remove it. This causes any further userspace accesses to result in an error without further calls into this driver\u0026apos;s internals.(CVE-2024-56538)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  hfsplus: don\u0026apos;t query the device logical block size multiple times  Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE.  While this may cause other issues like IO being rejected, in the case of hfsplus, it will allocate a block by using that size and potentially write out-of-bounds when hfsplus_read_wrapper calls hfsplus_submit_bio and the latter function reads a different io_size.  Using a new min_io_size initally set to sb_min_blocksize works for the purposes of the original fix, since it will be set to the max between HFSPLUS_SECTOR_SIZE and the first seen logical block size. We still use the max between HFSPLUS_SECTOR_SIZE and min_io_size in case the latter is not initialized.  Tested by mounting an hfsplus filesystem with loop block sizes 512, 1024 and 4096.  The produced KASAN report before the fix looks like this:  [  419.944641] ================================================================== [  419.945655] BUG: KASAN: slab-use-after-free in hfsplus_read_wrapper+0x659/0xa0a [  419.946703] Read of size 2 at addr ffff88800721fc00 by task repro/10678 [  419.947612] [  419.947846] CPU: 0 UID: 0 PID: 10678 Comm: repro Not tainted 6.12.0-rc5-00008-gdf56e0f2f3ca #84 [  419.949007] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [  419.950035] Call Trace: [  419.950384]  \u0026lt;TASK\u0026gt; [  419.950676]  dump_stack_lvl+0x57/0x78 [  419.951212]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.951830]  print_report+0x14c/0x49e [  419.952361]  ? __virt_addr_valid+0x267/0x278 [  419.952979]  ? kmem_cache_debug_flags+0xc/0x1d [  419.953561]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.954231]  kasan_report+0x89/0xb0 [  419.954748]  ? hfsplus_read_wrapper+0x659/0xa0a [  419.955367]  hfsplus_read_wrapper+0x659/0xa0a [  419.955948]  ? __pfx_hfsplus_read_wrapper+0x10/0x10 [  419.956618]  ? do_raw_spin_unlock+0x59/0x1a9 [  419.957214]  ? _raw_spin_unlock+0x1a/0x2e [  419.957772]  hfsplus_fill_super+0x348/0x1590 [  419.958355]  ? hlock_class+0x4c/0x109 [  419.958867]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.959499]  ? __pfx_string+0x10/0x10 [  419.960006]  ? lock_acquire+0x3e2/0x454 [  419.960532]  ? bdev_name.constprop.0+0xce/0x243 [  419.961129]  ? __pfx_bdev_name.constprop.0+0x10/0x10 [  419.961799]  ? pointer+0x3f0/0x62f [  419.962277]  ? __pfx_pointer+0x10/0x10 [  419.962761]  ? vsnprintf+0x6c4/0xfba [  419.963178]  ? __pfx_vsnprintf+0x10/0x10 [  419.963621]  ? setup_bdev_super+0x376/0x3b3 [  419.964029]  ? snprintf+0x9d/0xd2 [  419.964344]  ? __pfx_snprintf+0x10/0x10 [  419.964675]  ? lock_acquired+0x45c/0x5e9 [  419.965016]  ? set_blocksize+0x139/0x1c1 [  419.965381]  ? sb_set_blocksize+0x6d/0xae [  419.965742]  ? __pfx_hfsplus_fill_super+0x10/0x10 [  419.966179]  mount_bdev+0x12f/0x1bf [  419.966512]  ? __pfx_mount_bdev+0x10/0x10 [  419.966886]  ? vfs_parse_fs_string+0xce/0x111 [  419.967293]  ? __pfx_vfs_parse_fs_string+0x10/0x10 [  419.967702]  ? __pfx_hfsplus_mount+0x10/0x10 [  419.968073]  legacy_get_tree+0x104/0x178 [  419.968414]  vfs_get_tree+0x86/0x296 [  419.968751]  path_mount+0xba3/0xd0b [  419.969157]  ? __pfx_path_mount+0x10/0x10 [  419.969594]  ? kmem_cache_free+0x1e2/0x260 [  419.970311]  do_mount+0x99/0xe0 [  419.970630]  ? __pfx_do_mount+0x10/0x10 [  419.971008]  __do_sys_mount+0x199/0x1c9 [  419.971397]  do_syscall_64+0xd0/0x135 [  419.971761]  entry_SYSCALL_64_after_hwframe+0x76/0x7e [  419.972233] RIP: 0033:0x7c3cb812972e [  419.972564] Code: 48 8b 0d f5 46 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 a5 00 00 00 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d c2 46 0d 00 f7 d8 64 89 01 48 [  419.974371] RSP: 002b:00007ffe30632548 EFLAGS: 00000286 ORIG_RAX: 00000000000000a5 [  419.975048] RAX: ffffffffffffffda RBX: 00007ffe306328d8 RCX: 00007c3cb812972e [  419.975701] RDX: 0000000020000000 RSI: 0000000020000c80 RDI: ---truncated---(CVE-2024-56548)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()  if (dev-\u0026gt;boardinfo \u0026amp;\u0026amp; dev-\u0026gt;boardinfo-\u0026gt;init_dyn_addr)                                       ^^^ here check \u0026quot;init_dyn_addr\u0026quot;  i3c_bus_set_addr_slot_status(\u0026amp;master-\u0026gt;bus, dev-\u0026gt;info.dyn_addr, ...)                    ^^^^        free \u0026quot;dyn_addr\u0026quot; Fix copy/paste error \u0026quot;dyn_addr\u0026quot; by replacing it with \u0026quot;init_dyn_addr\u0026quot;.(CVE-2024-56562)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ftrace: Fix regression with module command in stack_trace_filter  When executing the following command:      # echo \u0026quot;write*:mod:ext3\u0026quot; \u0026gt; /sys/kernel/tracing/stack_trace_filter  The current mod command causes a null pointer dereference. While commit 0f17976568b3f (\u0026quot;ftrace: Fix regression with module command in stack_trace_filter\u0026quot;) has addressed part of the issue, it left a corner case unhandled, which still results in a kernel crash.(CVE-2024-56569)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ovl: Filter invalid inodes with missing lookup function  Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.(CVE-2024-56570)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()  The buffer in the loop should be released under the exception path, otherwise there may be a memory leak here.  To mitigate this, free the buffer when allegro_alloc_buffer fails.(CVE-2024-56572)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  btrfs: ref-verify: fix use-after-free after invalid ref action  At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable \u0026apos;ref\u0026apos;) into the respective block entry\u0026apos;s rbtree (local variable \u0026apos;be\u0026apos;), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry\u0026apos;s rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn\u0026apos;t remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.  Syzbot report this with the following stack traces:     BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314       btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]       btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23       btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482       btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293       vfs_unlink+0x365/0x650 fs/namei.c:4469       do_unlinkat+0x4ae/0x830 fs/namei.c:4533       __do_sys_unlinkat fs/namei.c:4576 [inline]       __se_sys_unlinkat fs/namei.c:4569 [inline]       __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569       do_syscall_x64 arch/x86/entry/common.c:52 [inline]       do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83       entry_SYSCALL_64_after_hwframe+0x77/0x7f    BTRFS error (device loop0 state EA):   Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1       __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521       update_ref_for_cow+0x96a/0x11f0       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]       __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137       __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171       btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313       prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586       relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611       btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081       btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377       __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161       btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538    BTRFS error (device loop0 state EA):   Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615       __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523       update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512       btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594       btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754       btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116       btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411       __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030       btrfs_update_delayed_i ---truncated---(CVE-2024-56581)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  sched/deadline: Fix warning in migrate_enable for boosted tasks  When running the following command:  while true; do     stress-ng --cyclic 30 --timeout 30s --minimize --quiet done  a warning is eventually triggered:  WARNING: CPU: 43 PID: 2848 at kernel/sched/deadline.c:794 setup_new_dl_entity+0x13e/0x180 ... Call Trace:  \u0026lt;TASK\u0026gt;  ? show_trace_log_lvl+0x1c4/0x2df  ? enqueue_dl_entity+0x631/0x6e0  ? setup_new_dl_entity+0x13e/0x180  ? __warn+0x7e/0xd0  ? report_bug+0x11a/0x1a0  ? handle_bug+0x3c/0x70  ? exc_invalid_op+0x14/0x70  ? asm_exc_invalid_op+0x16/0x20  enqueue_dl_entity+0x631/0x6e0  enqueue_task_dl+0x7d/0x120  __do_set_cpus_allowed+0xe3/0x280  __set_cpus_allowed_ptr_locked+0x140/0x1d0  __set_cpus_allowed_ptr+0x54/0xa0  migrate_enable+0x7e/0x150  rt_spin_unlock+0x1c/0x90  group_send_sig_info+0xf7/0x1a0  ? kill_pid_info+0x1f/0x1d0  kill_pid_info+0x78/0x1d0  kill_proc_info+0x5b/0x110  __x64_sys_kill+0x93/0xc0  do_syscall_64+0x5c/0xf0  entry_SYSCALL_64_after_hwframe+0x6e/0x76  RIP: 0033:0x7f0dab31f92b  This warning occurs because set_cpus_allowed dequeues and enqueues tasks with the ENQUEUE_RESTORE flag set. If the task is boosted, the warning is triggered. A boosted task already had its parameters set by rt_mutex_setprio, and a new call to setup_new_dl_entity is unnecessary, hence the WARN_ON call.  Check if we are requeueing a boosted task and avoid calling setup_new_dl_entity if that\u0026apos;s the case.(CVE-2024-56583)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring/tctx: work around xa_store() allocation error issue  syzbot triggered the following WARN_ON:  WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:51  which is the  WARN_ON_ONCE(!xa_empty(\u0026amp;tctx-\u0026gt;xa));  sanity check in __io_uring_free() when a io_uring_task is going through its final put. The syzbot test case includes injecting memory allocation failures, and it very much looks like xa_store() can fail one of its memory allocations and end up with -\u0026gt;head being non-NULL even though no entries exist in the xarray.  Until this issue gets sorted out, work around it by attempting to iterate entries in our xarray, and WARN_ON_ONCE() if one is found.(CVE-2024-56584)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.  creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enable checkpoint again, and then unmount the filesystem triggers the f2fs_bug_on as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/inode.c:896! CPU: 2 UID: 0 PID: 1286 Comm: umount Not tainted 6.11.0-rc7-dirty #360 Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:f2fs_evict_inode+0x58c/0x610 Call Trace:  __die_body+0x15/0x60  die+0x33/0x50  do_trap+0x10a/0x120  f2fs_evict_inode+0x58c/0x610  do_error_trap+0x60/0x80  f2fs_evict_inode+0x58c/0x610  exc_invalid_op+0x53/0x60  f2fs_evict_inode+0x58c/0x610  asm_exc_invalid_op+0x16/0x20  f2fs_evict_inode+0x58c/0x610  evict+0x101/0x260  dispose_list+0x30/0x50  evict_inodes+0x140/0x190  generic_shutdown_super+0x2f/0x150  kill_block_super+0x11/0x40  kill_f2fs_super+0x7d/0x140  deactivate_locked_super+0x2a/0x70  cleanup_mnt+0xb3/0x140  task_work_run+0x61/0x90  The root cause is: creating large files during disable checkpoint period results in not enough free segments, so when writing back root inode will failed in f2fs_enable_checkpoint. When umount the file system after enabling checkpoint, the root inode is dirty in f2fs_evict_inode function, which triggers BUG_ON. The steps to reproduce are as follows:  dd if=/dev/zero of=f2fs.img bs=1M count=55 mount f2fs.img f2fs_dir -o checkpoint=disable:10% dd if=/dev/zero of=big bs=1M count=50 sync rm big mount -o remount,checkpoint=enable f2fs_dir umount f2fs_dir  Let\u0026apos;s redirty inode when there is not free segments during checkpoint is disable.(CVE-2024-56586)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: set the right AMDGPU sg segment limitation  The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following:  WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [  364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [  364.049532]  ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [  364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G           OE      6.10.0-custom #492 [  364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [  364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [  364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff \u0026lt;0f\u0026gt; 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [  364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [  364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [  364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [  364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [  364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [  364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [  364.049599] FS:  00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [  364.049601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [  364.049605] Call Trace: [  364.049607]  \u0026lt;TASK\u0026gt; [  364.049609]  ? show_regs+0x6d/0x80 [  364.049614]  ? __warn+0x8c/0x140 [  364.049618]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049621]  ? report_bug+0x193/0x1a0 [  364.049627]  ? handle_bug+0x46/0x80 [  364.049631]  ? exc_invalid_op+0x1d/0x80 [  364.049635]  ? asm_exc_invalid_op+0x1f/0x30 [  364.049642]  ? debug_dma_map_sg+0x2dc/0x370 [  364.049647]  __dma_map_sg_attrs+0x90/0xe0 [  364.049651]  dma_map_sgtable+0x25/0x40 [  364.049654]  amdgpu_bo_move+0x59a/0x850 [amdgpu] [  364.049935]  ? srso_return_thunk+0x5/0x5f [  364.049939]  ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [  364.050095]  ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [  364.050103]  ttm_bo_validate+0xc1/0x160 [ttm] [  364.050108]  ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [  364.050263]  amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [  364.050473]  kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [  364.050680]  kfd_ioctl+0x3c2/0x530 [amdgpu] [  364.050866]  ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [  364.05105 ---truncated---(CVE-2024-56594)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: fix array-index-out-of-bounds in jfs_readdir  The stbl might contain some invalid values. Added a check to return error code in that case.(CVE-2024-56596)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  jfs: array-index-out-of-bounds fix in dtReadFirst  The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.(CVE-2024-56598)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()  bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free.  Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().(CVE-2024-56604)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()  bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.(CVE-2024-56605)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  drm/amd/display: Fix out-of-bounds access in \u0026apos;dcn21_link_encoder_create\u0026apos;  An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array\u0026apos;s bounds before accessing it.  This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior.  References:  [   65.920507] ------------[ cut here ]------------ [   65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [   65.920519] index 7 is out of range for type \u0026apos;dcn10_link_enc_hpd_registers [5]\u0026apos; [   65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G           OE      6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [   65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [   65.920527] Call Trace: [   65.920529]  \u0026lt;TASK\u0026gt; [   65.920532]  dump_stack_lvl+0x48/0x70 [   65.920541]  dump_stack+0x10/0x20 [   65.920543]  __ubsan_handle_out_of_bounds+0xa2/0xe0 [   65.920549]  dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [   65.921009]  link_create+0x6d3/0xed0 [amdgpu] [   65.921355]  create_links+0x18a/0x4e0 [amdgpu] [   65.921679]  dc_create+0x360/0x720 [amdgpu] [   65.921999]  ? dmi_matches+0xa0/0x220 [   65.922004]  amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [   65.922342]  ? console_unlock+0x77/0x120 [   65.922348]  ? dev_printk_emit+0x86/0xb0 [   65.922354]  dm_hw_init+0x15/0x40 [amdgpu] [   65.922686]  amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [   65.922921]  amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [   65.923087]  amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [   65.923087]  local_pci_probe+0x4b/0xb0 [   65.923087]  pci_device_probe+0xc8/0x280 [   65.923087]  really_probe+0x187/0x300 [   65.923087]  __driver_probe_device+0x85/0x130 [   65.923087]  driver_probe_device+0x24/0x110 [   65.923087]  __driver_attach+0xac/0x1d0 [   65.923087]  ? __pfx___driver_attach+0x10/0x10 [   65.923087]  bus_for_each_dev+0x7d/0xd0 [   65.923087]  driver_attach+0x1e/0x30 [   65.923087]  bus_add_driver+0xf2/0x200 [   65.923087]  driver_register+0x64/0x130 [   65.923087]  ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [   65.923087]  __pci_register_driver+0x61/0x70 [   65.923087]  amdgpu_init+0x7d/0xff0 [amdgpu] [   65.923087]  do_one_initcall+0x49/0x310 [   65.923087]  ? kmalloc_trace+0x136/0x360 [   65.923087]  do_init_module+0x6a/0x270 [   65.923087]  load_module+0x1fce/0x23a0 [   65.923087]  init_module_from_file+0x9c/0xe0 [   65.923087]  ? init_module_from_file+0x9c/0xe0 [   65.923087]  idempotent_init_module+0x179/0x230 [   65.923087]  __x64_sys_finit_module+0x5d/0xa0 [   65.923087]  do_syscall_64+0x76/0x120 [   65.923087]  entry_SYSCALL_64_after_hwframe+0x6e/0x76 [   65.923087] RIP: 0033:0x7f2d80f1e88d [   65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [   65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [   65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [   65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [   65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [   65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [   65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [   65.923087]  \u0026lt;/TASK\u0026gt; [   65.923927] ---[ end trace ]---(CVE-2024-56608)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  bpf: fix OOB devmap writes when deleting elements  Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, causes the OOB writes. Fix is simple as changing the type from int to u32, however, when compared to XSKMAP case, one more thing needs to be addressed.  When map is released from system via dev_map_free(), we iterate through all of the entries and an iterator variable is also an int, which implies OOB accesses. Again, change it to be u32.  Example splat below:  [  160.724676] BUG: unable to handle page fault for address: ffffc8fc2c001000 [  160.731662] #PF: supervisor read access in kernel mode [  160.736876] #PF: error_code(0x0000) - not-present page [  160.742095] PGD 0 P4D 0 [  160.744678] Oops: Oops: 0000 [#1] PREEMPT SMP [  160.749106] CPU: 1 UID: 0 PID: 520 Comm: kworker/u145:12 Not tainted 6.12.0-rc1+ #487 [  160.757050] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [  160.767642] Workqueue: events_unbound bpf_map_free_deferred [  160.773308] RIP: 0010:dev_map_free+0x77/0x170 [  160.777735] Code: 00 e8 fd 91 ed ff e8 b8 73 ed ff 41 83 7d 18 19 74 6e 41 8b 45 24 49 8b bd f8 00 00 00 31 db 85 c0 74 48 48 63 c3 48 8d 04 c7 \u0026lt;48\u0026gt; 8b 28 48 85 ed 74 30 48 8b 7d 18 48 85 ff 74 05 e8 b3 52 fa ff [  160.796777] RSP: 0018:ffffc9000ee1fe38 EFLAGS: 00010202 [  160.802086] RAX: ffffc8fc2c001000 RBX: 0000000080000000 RCX: 0000000000000024 [  160.809331] RDX: 0000000000000000 RSI: 0000000000000024 RDI: ffffc9002c001000 [  160.816576] RBP: 0000000000000000 R08: 0000000000000023 R09: 0000000000000001 [  160.823823] R10: 0000000000000001 R11: 00000000000ee6b2 R12: dead000000000122 [  160.831066] R13: ffff88810c928e00 R14: ffff8881002df405 R15: 0000000000000000 [  160.838310] FS:  0000000000000000(0000) GS:ffff8897e0c40000(0000) knlGS:0000000000000000 [  160.846528] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  160.852357] CR2: ffffc8fc2c001000 CR3: 0000000005c32006 CR4: 00000000007726f0 [  160.859604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [  160.866847] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [  160.874092] PKRU: 55555554 [  160.876847] Call Trace: [  160.879338]  \u0026lt;TASK\u0026gt; [  160.881477]  ? __die+0x20/0x60 [  160.884586]  ? page_fault_oops+0x15a/0x450 [  160.888746]  ? search_extable+0x22/0x30 [  160.892647]  ? search_bpf_extables+0x5f/0x80 [  160.896988]  ? exc_page_fault+0xa9/0x140 [  160.900973]  ? asm_exc_page_fault+0x22/0x30 [  160.905232]  ? dev_map_free+0x77/0x170 [  160.909043]  ? dev_map_free+0x58/0x170 [  160.912857]  bpf_map_free_deferred+0x51/0x90 [  160.917196]  process_one_work+0x142/0x370 [  160.921272]  worker_thread+0x29e/0x3b0 [  160.925082]  ? rescuer_thread+0x4b0/0x4b0 [  160.929157]  kthread+0xd4/0x110 [  160.932355]  ? kthread_park+0x80/0x80 [  160.936079]  ret_from_fork+0x2d/0x50 [  160.943396]  ? kthread_park+0x80/0x80 [  160.950803]  ret_from_fork_asm+0x11/0x20 [  160.958482]  \u0026lt;/TASK\u0026gt;(CVE-2024-56615)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()  Syzbot reported that when searching for records in a directory where the inode\u0026apos;s i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled.  This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned.  This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size.  Fix this issue by changing the type of the local variable causing the bit loss from \u0026quot;unsigned int\u0026quot; to \u0026quot;u64\u0026quot;.  The return value of nilfs_last_byte() is also of type \u0026quot;unsigned int\u0026quot;, but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.(CVE-2024-56619)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read  An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is coming when setting \u0026apos;vfs objects = streams_xattr parameter\u0026apos; in ksmbd.conf.(CVE-2024-56627)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  HID: wacom: fix when get product name maybe null pointer  Due to incorrect dev-\u0026gt;product reporting by certain devices, null pointer dereferences occur when dev-\u0026gt;product is empty, leading to potential system crashes.  This issue was found on EXCELSIOR DL37-D05 device with Loongson-LS3A6000-7A2000-DL37 motherboard.  Kernel logs: [   56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci [   56.671638] usb 4-3: string descriptor 0 read error: -22 [   56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07 [   56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [   56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0 [   56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80 [   56.697732] Oops[#1]: [   56.697734] CPU: 2 PID: 2742 Comm: (udev-worker) Tainted: G           OE      6.6.0-loong64-desktop #25.00.2000.015 [   56.697737] Hardware name: Inspur CE520L2/C09901N000000000, BIOS 2.09.00 10/11/2024 [   56.697739] pc 90000000066e35c8 ra ffff800004f98a80 tp 9000000125478000 sp 900000012547b8a0 [   56.697741] a0 0000000000000000 a1 ffff800004818b28 a2 0000000000000000 a3 0000000000000000 [   56.697743] a4 900000012547b8f0 a5 0000000000000000 a6 0000000000000000 a7 0000000000000000 [   56.697745] t0 ffff800004818b2d t1 0000000000000000 t2 0000000000000003 t3 0000000000000005 [   56.697747] t4 0000000000000000 t5 0000000000000000 t6 0000000000000000 t7 0000000000000000 [   56.697748] t8 0000000000000000 u0 0000000000000000 s9 0000000000000000 s0 900000011aa48028 [   56.697750] s1 0000000000000000 s2 0000000000000000 s3 ffff800004818e80 s4 ffff800004810000 [   56.697751] s5 90000001000b98d0 s6 ffff800004811f88 s7 ffff800005470440 s8 0000000000000000 [   56.697753]    ra: ffff800004f98a80 wacom_update_name+0xe0/0x300 [wacom] [   56.697802]   ERA: 90000000066e35c8 strstr+0x28/0x120 [   56.697806]  CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [   56.697816]  PRMD: 0000000c (PPLV0 +PIE +PWE) [   56.697821]  EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [   56.697827]  ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) [   56.697831] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [   56.697835]  BADV: 0000000000000000 [   56.697836]  PRID: 0014d000 (Loongson-64bit, Loongson-3A6000) [   56.697838] Modules linked in: wacom(+) bnep bluetooth rfkill qrtr nls_iso8859_1 nls_cp437 snd_hda_codec_conexant snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm snd_timer snd soundcore input_leds mousedev led_class joydev deepin_netmonitor(OE) fuse nfnetlink dmi_sysfs ip_tables x_tables overlay amdgpu amdxcp drm_exec gpu_sched drm_buddy radeon drm_suballoc_helper i2c_algo_bit drm_ttm_helper r8169 ttm drm_display_helper spi_loongson_pci xhci_pci cec xhci_pci_renesas spi_loongson_core hid_generic realtek gpio_loongson_64bit [   56.697887] Process (udev-worker) (pid: 2742, threadinfo=00000000aee0d8b4, task=00000000a9eff1f3) [   56.697890] Stack : 0000000000000000 ffff800004817e00 0000000000000000 0000251c00000000 [   56.697896]         0000000000000000 00000011fffffffd 0000000000000000 0000000000000000 [   56.697901]         0000000000000000 1b67a968695184b9 0000000000000000 90000001000b98d0 [   56.697906]         90000001000bb8d0 900000011aa48028 0000000000000000 ffff800004f9d74c [   56.697911]         90000001000ba000 ffff800004f9ce58 0000000000000000 ffff800005470440 [   56.697916]         ffff800004811f88 90000001000b98d0 9000000100da2aa8 90000001000bb8d0 [   56.697921]         0000000000000000 90000001000ba000 900000011aa48028 ffff800004f9d74c [   56.697926]         ffff8000054704e8 90000001000bb8b8 90000001000ba000 0000000000000000 [   56.697931]         90000001000bb8d0  ---truncated---(CVE-2024-56629)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  blk-cgroup: Fix UAF in blkcg_unpin_online()  blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:    ==================================================================   BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270   Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117    CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022   Workqueue: cgwb_release cgwb_release_workfn   Call Trace:    \u0026lt;TASK\u0026gt;    dump_stack_lvl+0x27/0x80    print_report+0x151/0x710    kasan_report+0xc0/0x100    blkcg_unpin_online+0x15a/0x270    cgwb_release_workfn+0x194/0x480    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30    \u0026lt;/TASK\u0026gt;   ...   Freed by task 1944:    kasan_save_track+0x2b/0x70    kasan_save_free_info+0x3c/0x50    __kasan_slab_free+0x33/0x50    kfree+0x10c/0x330    css_free_rwork_fn+0xe6/0xb30    process_scheduled_works+0x71b/0xe20    worker_thread+0x82a/0xbd0    kthread+0x242/0x2c0    ret_from_fork+0x33/0x70    ret_from_fork_asm+0x1a/0x30  Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().  Fix it by reading the parent pointer before destroying the blkcg\u0026apos;s blkg\u0026apos;s.(CVE-2024-56672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  crypto: bcm - add error check in the ahash_hmac_init function  The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example, ahash_init will return -ENOMEM when allocation memory is error.(CVE-2024-56681)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  ext4: fix race in buffer_head read fault injection  When I enabled ext4 debug for fault injection testing, I encountered the following warning:    EXT4-fs error (device sda): ext4_read_inode_bitmap:201: comm fsstress:          Cannot read inode bitmap - block_group = 8, inode_bitmap = 1051   WARNING: CPU: 0 PID: 511 at fs/buffer.c:1181 mark_buffer_dirty+0x1b3/0x1d0  The root cause of the issue lies in the improper implementation of ext4\u0026apos;s buffer_head read fault injection. The actual completion of buffer_head read and the buffer_head fault injection are not atomic, which can lead to the uptodate flag being cleared on normally used buffer_heads in race conditions.  [CPU0]           [CPU1]         [CPU2] ext4_read_inode_bitmap   ext4_read_bh()   \u0026lt;bh read complete\u0026gt;                  ext4_read_inode_bitmap                    if (buffer_uptodate(bh))                      return bh                                jbd2_journal_commit_transaction                                  __jbd2_journal_refile_buffer                                    __jbd2_journal_unfile_buffer                                      __jbd2_journal_temp_unlink_buffer   ext4_simulate_fail_bh()     clear_buffer_uptodate                                       mark_buffer_dirty                                         \u0026lt;report warning\u0026gt;                                         WARN_ON_ONCE(!buffer_uptodate(bh))  The best approach would be to perform fault injection in the IO completion callback function, rather than after IO completion. However, the IO completion callback function cannot get the fault injection code in sb.  Fix it by passing the result of fault injection into the bh read function, we simulate faults within the bh read function itself. This requires adding an extra parameter to the bh read functions that need fault injection.(CVE-2024-56686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device  While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherited) flaws. This was unveiled when platform_get_irq() had started WARN() on IRQ 0 that is supposed to be a Linux IRQ number (also known as vIRQ).  Rework the driver to respect IRQ domain when creating each MFD device separately, as the domain is not the same for all of them.(CVE-2024-56691)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to do sanity check on node blkaddr in truncate_node()  syzbot reports a f2fs bug as below:  ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2534! RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534 Call Trace:  truncate_node+0x1ae/0x8c0 fs/f2fs/node.c:909  f2fs_remove_inode_page+0x5c2/0x870 fs/f2fs/node.c:1288  f2fs_evict_inode+0x879/0x15c0 fs/f2fs/inode.c:856  evict+0x4e8/0x9b0 fs/inode.c:723  f2fs_handle_failed_inode+0x271/0x2e0 fs/f2fs/inode.c:986  f2fs_create+0x357/0x530 fs/f2fs/namei.c:394  lookup_open fs/namei.c:3595 [inline]  open_last_lookups fs/namei.c:3694 [inline]  path_openat+0x1c03/0x3590 fs/namei.c:3930  do_filp_open+0x235/0x490 fs/namei.c:3960  do_sys_openat2+0x13e/0x1d0 fs/open.c:1415  do_sys_open fs/open.c:1430 [inline]  __do_sys_openat fs/open.c:1446 [inline]  __se_sys_openat fs/open.c:1441 [inline]  __x64_sys_openat+0x247/0x2a0 fs/open.c:1441  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0010:f2fs_invalidate_blocks+0x35f/0x370 fs/f2fs/segment.c:2534  The root cause is: on a fuzzed image, blkaddr in nat entry may be corrupted, then it will cause system panic when using it in f2fs_invalidate_blocks(), to avoid this, let\u0026apos;s add sanity check on nat blkaddr in truncate_node().(CVE-2024-56692)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  media: wl128x: Fix atomicity violation in fmc_send_cmd()  Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev-\u0026gt;resp_skb value. Consider a scenario where, after passing the validity check within the function, a non-null fmdev-\u0026gt;resp_skb variable is assigned a null value. This results in an invalid fmdev-\u0026gt;resp_skb variable passing the validity check. As seen in the later part of the function, skb = fmdev-\u0026gt;resp_skb; when the invalid fmdev-\u0026gt;resp_skb passes the check, a null pointer dereference error may occur at line 478, evt_hdr = (void *)skb-\u0026gt;data;  To address this issue, it is recommended to include the validity check of fmdev-\u0026gt;resp_skb within the locked section of the function. This modification ensures that the value of fmdev-\u0026gt;resp_skb does not change during the validation process, thereby maintaining its validity.  This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.(CVE-2024-56700)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  io_uring: check if iowq is killed before queuing  task work can be executed after the task has gone through io_uring termination, whether it\u0026apos;s the final task_work run or the fallback path. In this case, task work will find -\u0026gt;io_wq being already killed and null\u0026apos;ed, which is a problem if it then tries to forward the request to io_queue_iowq(). Make io_queue_iowq() fail requests in this case.  Note that it also checks PF_KTHREAD, because the user can first close a DEFER_TASKRUN ring and shortly after kill the task, in which case -\u0026gt;iowq check would race.(CVE-2024-56709)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  rtc: check if __rtc_read_time was successful in rtc_timer_do_work()  If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read from the RTC hardware.  When calling rtc_tm_to_ktime later, the result may be a very large value (possibly KTIME_MAX). If there are periodic timers in rtc-\u0026gt;timerqueue, they will continually expire, may causing kernel softlockup.(CVE-2024-56739)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  apparmor: test: Fix memory leak for aa_unpack_strdup()  The string allocated by kmemdup() in aa_unpack_strdup() is not freed and cause following memory leaks, free them to fix it.   unreferenced object 0xffffff80c6af8a50 (size 8):    comm \u0026quot;kunit_try_catch\u0026quot;, pid 225, jiffies 4294894407    hex dump (first 8 bytes):      74 65 73 74 69 6e 67 00                          testing.    backtrace (crc 5eab668b):      [\u0026lt;0000000001e3714d\u0026gt;] kmemleak_alloc+0x34/0x40      [\u0026lt;000000006e6c7776\u0026gt;] __kmalloc_node_track_caller_noprof+0x300/0x3e0      [\u0026lt;000000006870467c\u0026gt;] kmemdup_noprof+0x34/0x60      [\u0026lt;000000001176bb03\u0026gt;] aa_unpack_strdup+0xd0/0x18c      [\u0026lt;000000008ecde918\u0026gt;] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec      [\u0026lt;0000000032ef8f77\u0026gt;] kunit_try_run_case+0x13c/0x3ac      [\u0026lt;00000000f3edea23\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec      [\u0026lt;00000000adf936cf\u0026gt;] kthread+0x2e8/0x374      [\u0026lt;0000000041bb1628\u0026gt;] ret_from_fork+0x10/0x20  unreferenced object 0xffffff80c2a29090 (size 8):    comm \u0026quot;kunit_try_catch\u0026quot;, pid 227, jiffies 4294894409    hex dump (first 8 bytes):      74 65 73 74 69 6e 67 00                          testing.    backtrace (crc 5eab668b):      [\u0026lt;0000000001e3714d\u0026gt;] kmemleak_alloc+0x34/0x40      [\u0026lt;000000006e6c7776\u0026gt;] __kmalloc_node_track_caller_noprof+0x300/0x3e0      [\u0026lt;000000006870467c\u0026gt;] kmemdup_noprof+0x34/0x60      [\u0026lt;000000001176bb03\u0026gt;] aa_unpack_strdup+0xd0/0x18c      [\u0026lt;0000000046a45c1a\u0026gt;] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4      [\u0026lt;0000000032ef8f77\u0026gt;] kunit_try_run_case+0x13c/0x3ac      [\u0026lt;00000000f3edea23\u0026gt;] kunit_generic_run_threadfn_adapter+0x80/0xec      [\u0026lt;00000000adf936cf\u0026gt;] kthread+0x2e8/0x374      [\u0026lt;0000000041bb1628\u0026gt;] ret_from_fork+0x10/0x20(CVE-2024-56741)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()  Hook \u0026quot;qedi_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56747)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()  Hook \u0026quot;qed_ops-\u0026gt;common-\u0026gt;sb_init = qed_sb_init\u0026quot; does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().(CVE-2024-56748)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  nvme-pci: fix freeing of the HMB descriptor table  The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent.  In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page.(CVE-2024-56756)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:  tracing: Prevent bad count for tracing_cpumask_write  If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.(CVE-2024-56763)","status":"published","published":"2025-01-10T11:08:07Z","modified":"2026-08-18T01:18:44.709925898Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1110","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ni3c: Use i3cdev-\u0026gt;desc-\u0026gt;info instead of calling i3c_device_get_info() to avoid deadlock\n\nA deadlock may happen since the i3c_master_register() acquires\n\u0026amp;i3cbus-\u0026gt;lock twice. See the log below.\nUse i3cdev-\u0026gt;desc-\u0026gt;info instead of calling i3c_device_info() to\navoid acquiring the lock twice.\n\nv2:\n  - Modified the title and commit message\n\n============================================\nWARNING: possible recursive locking detected\n6.11.0-mainline\n--------------------------------------------\ninit/1 is trying to acquire lock:\nf1ffff80a6a40dc0 (\u0026amp;i3cbus-\u0026gt;lock){++++}-{3:3}, at: i3c_bus_normaluse_lock\n\nbut task is already holding lock:\nf1ffff80a6a40dc0 (\u0026amp;i3cbus-\u0026gt;lock){++++}-{3:3}, at: i3c_master_register\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n       CPU0\n       ----\n  lock(\u0026amp;i3cbus-\u0026gt;lock);\n  lock(\u0026amp;i3cbus-\u0026gt;lock);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n2 locks held by init/1:\n #0: fcffff809b6798f8 (\u0026amp;dev-\u0026gt;mutex){....}-{3:3}, at: __driver_attach\n #1: f1ffff80a6a40dc0 (\u0026amp;i3cbus-\u0026gt;lock){++++}-{3:3}, at: i3c_master_register\n\nstack backtrace:\nCPU: 6 UID: 0 PID: 1 Comm: init\nCall trace:\n dump_backtrace+0xfc/0x17c\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xc0\n dump_stack+0x18/0x24\n print_deadlock_bug+0x388/0x390\n __lock_acquire+0x18bc/0x32ec\n lock_acquire+0x134/0x2b0\n down_read+0x50/0x19c\n i3c_bus_normaluse_lock+0x14/0x24\n i3c_device_get_info+0x24/0x58\n i3c_device_uevent+0x34/0xa4\n dev_uevent+0x310/0x384\n kobject_uevent_env+0x244/0x414\n kobject_uevent+0x14/0x20\n device_add+0x278/0x460\n device_register+0x20/0x34\n i3c_master_register_new_i3c_devs+0x78/0x154\n i3c_master_register+0x6a0/0x6d4\n mtk_i3c_master_probe+0x3b8/0x4d8\n platform_probe+0xa0/0xe0\n really_probe+0x114/0x454\n __driver_probe_device+0xa0/0x15c\n driver_probe_device+0x3c/0x1ac\n __driver_attach+0xc4/0x1f0\n bus_for_each_dev+0x104/0x160\n driver_attach+0x24/0x34\n bus_add_driver+0x14c/0x294\n driver_register+0x68/0x104\n __platform_driver_register+0x20/0x30\n init_module+0x20/0xfe4\n do_one_initcall+0x184/0x464\n do_init_module+0x58/0x1ec\n load_module+0xefc/0x10c8\n __arm64_sys_finit_module+0x238/0x33c\n invoke_syscall+0x58/0x10c\n el0_svc_common+0xa8/0xdc\n do_el0_svc+0x1c/0x28\n el0_svc+0x50/0xac\n el0t_64_sync_handler+0x70/0xbc\n el0t_64_sync+0x1a8/0x1ac(CVE-2024-43098)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: cevt-r4k: Don\u0026apos;t call get_c0_compare_int if timer irq is installed\n\nThis avoids warning:\n\n[    0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283\n\nCaused by get_c0_compare_int on secondary CPU.\n\nWe also skipped saving IRQ number to struct clock_event_device *cd as\nit\u0026apos;s never used by clockevent core, as per comments it\u0026apos;s only meant\nfor \u0026quot;non CPU local devices\u0026quot;.(CVE-2024-46832)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinmux: Use sequential access to access desc-\u0026gt;pinmux data\n\nWhen two client of the same gpio call pinctrl_select_state() for the\nsame functionality, we are seeing NULL pointer issue while accessing\ndesc-\u0026gt;mux_owner.\n\nLet\u0026apos;s say two processes A, B executing in pin_request() for the same pin\nand process A updates the desc-\u0026gt;mux_usecount but not yet updated the\ndesc-\u0026gt;mux_owner while process B see the desc-\u0026gt;mux_usecount which got\nupdated by A path and further executes strcmp and while accessing\ndesc-\u0026gt;mux_owner it crashes with NULL pointer.\n\nSerialize the access to mux related setting with a mutex lock.\n\n\tcpu0 (process A)\t\t\tcpu1(process B)\n\npinctrl_select_state() {\t\t  pinctrl_select_state() {\n  pin_request() {\t\t\t\tpin_request() {\n  ...\n\t\t\t\t\t\t ....\n    } else {\n         desc-\u0026gt;mux_usecount++;\n    \t\t\t\t\t\tdesc-\u0026gt;mux_usecount \u0026amp;\u0026amp; strcmp(desc-\u0026gt;mux_owner, owner)) {\n\n         if (desc-\u0026gt;mux_usecount \u0026gt; 1)\n               return 0;\n         desc-\u0026gt;mux_owner = owner;\n\n  }\t\t\t\t\t\t}(CVE-2024-47141)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check smcd_v2_ext_offset when receiving proposal msg\n\nWhen receiving proposal msg in server, the field smcd_v2_ext_offset in\nproposal msg is from the remote client and can not be fully trusted.\nOnce the value of smcd_v2_ext_offset exceed the max value, there has\nthe chance to access wrong address, and crash may happen.\n\nThis patch checks the value of smcd_v2_ext_offset before using it.(CVE-2024-47408)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: check return value of ieee80211_probereq_get() for RNR\n\nThe return value of ieee80211_probereq_get() might be NULL, so check it\nbefore using to avoid NULL pointer access.\n\nAddresses-Coverity-ID: 1529805 (\u0026quot;Dereference null return value\u0026quot;)(CVE-2024-48873)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the fields v2_ext_offset/\neid_cnt/ism_gid_cnt in proposal msg are from the remote client\nand can not be fully trusted. Especially the field v2_ext_offset,\nonce exceed the max value, there has the chance to access wrong\naddress, and crash may happen.\n\nThis patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt\nbefore using them.(CVE-2024-49568)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the field iparea_offset\nand the field ipv6_prefixes_cnt in proposal msg are from the\nremote client and can not be fully trusted. Especially the\nfield iparea_offset, once exceed the max value, there has the\nchance to access wrong address, and crash may happen.\n\nThis patch checks iparea_offset and ipv6_prefixes_cnt before using them.(CVE-2024-49571)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: Add cancel_work_sync before module remove\n\nIf we remove the module which will call mpc52xx_spi_remove\nit will free \u0026apos;ms\u0026apos; through spi_unregister_controller.\nwhile the work ms-\u0026gt;work will be used. The sequence of operations\nthat may lead to a UAF bug.\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in mpc52xx_spi_remove.(CVE-2024-50051)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix potential invalid memory access in igb_init_module()\n\nThe pci_register_driver() can fail and when this happened, the dca_notifier\nneeds to be unregistered, otherwise the dca_notifier can be called when\nigb fails to install, resulting to invalid memory access.(CVE-2024-52332)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix potential NULL dereference in mtk_crtc_destroy()\n\nIn mtk_crtc_create(), if the call to mbox_request_channel() fails then we\nset the \u0026quot;mtk_crtc-\u0026gt;cmdq_client.chan\u0026quot; pointer to NULL.  In that situation,\nwe do not call cmdq_pkt_create().\n\nDuring the cleanup, we need to check if the \u0026quot;mtk_crtc-\u0026gt;cmdq_client.chan\u0026quot;\nis NULL first before calling cmdq_pkt_destroy().  Calling\ncmdq_pkt_destroy() is unnecessary if we didn\u0026apos;t call cmdq_pkt_create() and\nit will result in a NULL pointer dereference.(CVE-2024-53056)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: resolve faulty mmap_region() error path behaviour\n\nThe mmap_region() function is somewhat terrifying, with spaghetti-like\ncontrol flow and numerous means by which issues can arise and incomplete\nstate, memory leaks and other unpleasantness can occur.\n\nA large amount of the complexity arises from trying to handle errors late\nin the process of mapping a VMA, which forms the basis of recently\nobserved issues with resource leaks and observable inconsistent state.\n\nTaking advantage of previous patches in this series we move a number of\nchecks earlier in the code, simplifying things by moving the core of the\nlogic into a static internal function __mmap_region().\n\nDoing this allows us to perform a number of checks up front before we do\nany real work, and allows us to unwind the writable unmap check\nunconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE\nvalidation unconditionally also.\n\nWe move a number of things here:\n\n1. We preallocate memory for the iterator before we call the file-backed\n   memory hook, allowing us to exit early and avoid having to perform\n   complicated and error-prone close/free logic. We carefully free\n   iterator state on both success and error paths.\n\n2. The enclosing mmap_region() function handles the mapping_map_writable()\n   logic early. Previously the logic had the mapping_map_writable() at the\n   point of mapping a newly allocated file-backed VMA, and a matching\n   mapping_unmap_writable() on success and error paths.\n\n   We now do this unconditionally if this is a file-backed, shared writable\n   mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however\n   doing so does not invalidate the seal check we just performed, and we in\n   any case always decrement the counter in the wrapper.\n\n   We perform a debug assert to ensure a driver does not attempt to do the\n   opposite.\n\n3. We also move arch_validate_flags() up into the mmap_region()\n   function. This is only relevant on arm64 and sparc64, and the check is\n   only meaningful for SPARC with ADI enabled. We explicitly add a warning\n   for this arch if a driver invalidates this check, though the code ought\n   eventually to be fixed to eliminate the need for this.\n\nWith all of these measures in place, we no longer need to explicitly close\nthe VMA on error paths, as we place all checks which might fail prior to a\ncall to any driver mmap hook.\n\nThis eliminates an entire class of errors, makes the code easier to reason\nabout and more robust.(CVE-2024-53096)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmm: page_alloc: move mlocked flag clearance into free_pages_prepare()\n\nSyzbot reported a bad page state problem caused by a page being freed\nusing free_page() still having a mlocked flag at free_pages_prepare()\nstage:\n\n  BUG: Bad page state in process syz.5.504  pfn:61f45\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45\n  flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff)\n  raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n  page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set\n  page_owner tracks the page as allocated\n  page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394\n   set_page_owner include/linux/page_owner.h:32 [inline]\n   post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537\n   prep_new_page mm/page_alloc.c:1545 [inline]\n   get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457\n   __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733\n   alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265\n   kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99\n   kvm_create_vm virt/kvm/kvm_main.c:1235 [inline]\n   kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline]\n   kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530\n   __do_compat_sys_ioctl fs/ioctl.c:1007 [inline]\n   __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950\n   do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n   __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386\n   do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411\n   entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n  page last free pid 8399 tgid 8399 stack trace:\n   reset_page_owner include/linux/page_owner.h:25 [inline]\n   free_pages_prepare mm/page_alloc.c:1108 [inline]\n   free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686\n   folios_put_refs+0x76c/0x860 mm/swap.c:1007\n   free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335\n   __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]\n   tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]\n   tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]\n   tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373\n   tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465\n   exit_mmap+0x496/0xc40 mm/mmap.c:1926\n   __mmput+0x115/0x390 kernel/fork.c:1348\n   exit_mm+0x220/0x310 kernel/exit.c:571\n   do_exit+0x9b2/0x28e0 kernel/exit.c:926\n   do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n   __do_sys_exit_group kernel/exit.c:1099 [inline]\n   __se_sys_exit_group kernel/exit.c:1097 [inline]\n   __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097\n   x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0\n  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __dump_stack lib/dump_stack.c:94 [inline]\n   dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n   bad_page+0x176/0x1d0 mm/page_alloc.c:501\n   free_page_is_bad mm/page_alloc.c:918 [inline]\n   free_pages_prepare mm/page_alloc.c:1100 [inline]\n   free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638\n   kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline]\n   kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386\n   kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143\n   __fput+0x23f/0x880 fs/file_table.c:431\n   task_work_run+0x24f/0x310 kernel/task_work.c:239\n   exit_task_work include/linux/task_work.h:43 [inline]\n   do_exit+0xa2f/0x28e0 kernel/exit.c:939\n   do_group_exit+0x207/0x2c0 kernel/exit.c:1088\n   __do_sys_exit_group kernel/exit.c:1099 [in\n---truncated---(CVE-2024-53105)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync\n\nThis fixes the following crash:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353\nRead of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54\n\nCPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\nWorkqueue: hci0 hci_cmd_sync_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:93 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119\n print_address_description mm/kasan/report.c:377 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:488\nq kasan_report+0x143/0x180 mm/kasan/report.c:601\n set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328\n process_one_work kernel/workqueue.c:3231 [inline]\n process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312\n worker_thread+0x86d/0xd10 kernel/workqueue.c:3389\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u0026lt;/TASK\u0026gt;\n\nAllocated by task 5247:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n kasan_kmalloc include/linux/kasan.h:211 [inline]\n __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193\n kmalloc_noprof include/linux/slab.h:681 [inline]\n kzalloc_noprof include/linux/slab.h:807 [inline]\n mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269\n mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296\n set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394\n hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712\n hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:745\n sock_write_iter+0x2dd/0x400 net/socket.c:1160\n new_sync_write fs/read_write.c:497 [inline]\n vfs_write+0xa72/0xc90 fs/read_write.c:590\n ksys_write+0x1a0/0x2c0 fs/read_write.c:643\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 5246:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579\n poison_slab_object+0xe0/0x150 mm/kasan/common.c:240\n __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256\n kasan_slab_free include/linux/kasan.h:184 [inline]\n slab_free_hook mm/slub.c:2256 [inline]\n slab_free mm/slub.c:4477 [inline]\n kfree+0x149/0x360 mm/slub.c:4598\n settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443\n mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259\n __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455\n hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191\n hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]\n hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508\n sock_do_ioctl+0x158/0x460 net/socket.c:1222\n sock_ioctl+0x629/0x8e0 net/socket.c:1341\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:907 [inline]\n __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-53208)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix NULL pointer in comp_algorithm_show()\n\nLTP reported a NULL pointer dereference as followed:\n\n CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3\n Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015\n pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __pi_strcmp+0x24/0x140\n lr : zcomp_available_show+0x60/0x100 [zram]\n sp : ffff800088b93b90\n x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0\n x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000\n x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900\n x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000\n x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280\n x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000\n x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c\n x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000\n Call trace:\n  __pi_strcmp+0x24/0x140\n  comp_algorithm_show+0x40/0x70 [zram]\n  dev_attr_show+0x28/0x80\n  sysfs_kf_seq_show+0x90/0x140\n  kernfs_seq_show+0x34/0x48\n  seq_read_iter+0x1d4/0x4e8\n  kernfs_fop_read_iter+0x40/0x58\n  new_sync_read+0x9c/0x168\n  vfs_read+0x1a8/0x1f8\n  ksys_read+0x74/0x108\n  __arm64_sys_read+0x24/0x38\n  invoke_syscall+0x50/0x120\n  el0_svc_common.constprop.0+0xc8/0xf0\n  do_el0_svc+0x24/0x38\n  el0_svc+0x38/0x138\n  el0t_64_sync_handler+0xc0/0xc8\n  el0t_64_sync+0x188/0x190\n\nThe zram-\u0026gt;comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if\ncomp_algorithm_set() has not been called.  User can access the zram device\nby sysfs after device_add_disk(), so there is a time window to trigger the\nNULL pointer dereference.  Move it ahead device_add_disk() to make sure\nwhen user can access the zram device, it is ready.  comp_algorithm_set()\nis protected by zram-\u0026gt;init_lock in other places and no such problem.(CVE-2024-53222)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: prevent use of deleted inode\n\nsyzbot reported a WARNING in nilfs_rmdir. [1]\n\nBecause the inode bitmap is corrupted, an inode with an inode number that\nshould exist as a \u0026quot;.nilfs\u0026quot; file was reassigned by nilfs_mkdir for \u0026quot;file0\u0026quot;,\ncausing an inode duplication during execution.  And this causes an\nunderflow of i_nlink in rmdir operations.\n\nThe inode is used twice by the same task to unmount and remove directories\n\u0026quot;.nilfs\u0026quot; and \u0026quot;file0\u0026quot;, it trigger warning in nilfs_rmdir.\n\nAvoid to this issue, check i_nlink in nilfs_iget(), if it is 0, it means\nthat this inode has been deleted, and iput is executed to reclaim it.\n\n[1]\nWARNING: CPU: 1 PID: 5824 at fs/inode.c:407 drop_nlink+0xc4/0x110 fs/inode.c:407\n...\nCall Trace:\n \u0026lt;TASK\u0026gt;\n nilfs_rmdir+0x1b0/0x250 fs/nilfs2/namei.c:342\n vfs_rmdir+0x3a3/0x510 fs/namei.c:4394\n do_rmdir+0x3b5/0x580 fs/namei.c:4453\n __do_sys_rmdir fs/namei.c:4472 [inline]\n __se_sys_rmdir fs/namei.c:4470 [inline]\n __x64_sys_rmdir+0x47/0x50 fs/namei.c:4470\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-53690)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/modes: Avoid divide by zero harder in drm_mode_vrefresh()\n\ndrm_mode_vrefresh() is trying to avoid divide by zero\nby checking whether htotal or vtotal are zero. But we may\nstill end up with a div-by-zero of vtotal*htotal*...(CVE-2024-56369)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nkcsan: Turn report_filterlist_lock into a raw_spinlock\n\nRan Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see\nsplats like:\n\n| BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\n| in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1\n| preempt_count: 10002, expected: 0\n| RCU nest depth: 0, expected: 0\n| no locks held by swapper/1/0.\n| irq event stamp: 156674\n| hardirqs last  enabled at (156673): [\u0026lt;ffffffff81130bd9\u0026gt;] do_idle+0x1f9/0x240\n| hardirqs last disabled at (156674): [\u0026lt;ffffffff82254f84\u0026gt;] sysvec_apic_timer_interrupt+0x14/0xc0\n| softirqs last  enabled at (0): [\u0026lt;ffffffff81099f47\u0026gt;] copy_process+0xfc7/0x4b60\n| softirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n| Preemption disabled at:\n| [\u0026lt;ffffffff814a3e2a\u0026gt;] paint_ptr+0x2a/0x90\n| CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted 6.11.0+ #3\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-0-ga698c8995f-prebuilt.qemu.org 04/01/2014\n| Call Trace:\n|  \u0026lt;IRQ\u0026gt;\n|  dump_stack_lvl+0x7e/0xc0\n|  dump_stack+0x1d/0x30\n|  __might_resched+0x1a2/0x270\n|  rt_spin_lock+0x68/0x170\n|  kcsan_skip_report_debugfs+0x43/0xe0\n|  print_report+0xb5/0x590\n|  kcsan_report_known_origin+0x1b1/0x1d0\n|  kcsan_setup_watchpoint+0x348/0x650\n|  __tsan_unaligned_write1+0x16d/0x1d0\n|  hrtimer_interrupt+0x3d6/0x430\n|  __sysvec_apic_timer_interrupt+0xe8/0x3a0\n|  sysvec_apic_timer_interrupt+0x97/0xc0\n|  \u0026lt;/IRQ\u0026gt;\n\nOn a detected data race, KCSAN\u0026apos;s reporting logic checks if it should\nfilter the report. That list is protected by the report_filterlist_lock\n*non-raw* spinlock which may sleep on RT kernels.\n\nSince KCSAN may report data races in any context, convert it to a\nraw_spinlock.\n\nThis requires being careful about when to allocate memory for the filter\nlist itself which can be done via KCSAN\u0026apos;s debugfs interface. Concurrent\nmodification of the filter list via debugfs should be rare: the chosen\nstrategy is to optimistically pre-allocate memory before the critical\nsection and discard if unused.(CVE-2024-56610)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU\n\nCommit\n\n  5944ce092b97 (\u0026quot;arch_topology: Build cacheinfo from primary CPU\u0026quot;)\n\nadds functionality that architectures can use to optionally allocate and\nbuild cacheinfo early during boot. Commit\n\n  6539cffa9495 (\u0026quot;cacheinfo: Add arch specific early level initializer\u0026quot;)\n\nlets secondary CPUs correct (and reallocate memory) cacheinfo data if\nneeded.\n\nIf the early build functionality is not used and cacheinfo does not need\ncorrection, memory for cacheinfo is never allocated. x86 does not use\nthe early build functionality. Consequently, during the cacheinfo CPU\nhotplug callback, last_level_cache_is_valid() attempts to dereference\na NULL pointer:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000100\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] PREEPMT SMP NOPTI\n  CPU: 0 PID 19 Comm: cpuhp/0 Not tainted 6.4.0-rc2 #1\n  RIP: 0010: last_level_cache_is_valid+0x95/0xe0a\n\nAllocate memory for cacheinfo during the cacheinfo CPU hotplug callback\nif not done earlier.\n\nMoreover, before determining the validity of the last-level cache info,\nensure that it has been allocated. Simply checking for non-zero\ncache_leaves() is not sufficient, as some architectures (e.g., Intel\nprocessors) have non-zero cache_leaves() before allocation.\n\nDereferencing NULL cacheinfo can occur in update_per_cpu_data_slice_size().\nThis function iterates over all online CPUs. However, a CPU may have come\nonline recently, but its cacheinfo may not have been allocated yet.\n\nWhile here, remove an unnecessary indentation in allocate_cache_info().\n\n  [ bp: Massage. ](CVE-2024-56617)\n\nRejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.(CVE-2024-56686)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY\n\nSince commit 8f4f68e788c3 (\u0026quot;crypto: pcrypt - Fix hungtask for\nPADATA_RESET\u0026quot;), the pcrypt encryption and decryption operations return\n-EAGAIN when the CPU goes online or offline. In alg_test(), a WARN is\ngenerated when pcrypt_aead_decrypt() or pcrypt_aead_encrypt() returns\n-EAGAIN, the unnecessary panic will occur when panic_on_warn set 1.\nFix this issue by calling crypto layer directly without parallelization\nin that case.(CVE-2024-56690)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: gadget: Fix looping of queued SG entries\n\nThe dwc3_request-\u0026gt;num_queued_sgs is decremented on completion. If a\npartially completed request is handled, then the\ndwc3_request-\u0026gt;num_queued_sgs no longer reflects the total number of\nnum_queued_sgs (it would be cleared).\n\nCorrectly check the number of request SG entries remained to be prepare\nand queued. Failure to do this may cause null pointer dereference when\naccessing non-existent SG entry.(CVE-2024-56698)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nionic: Fix netdev notifier unregister on failure\n\nIf register_netdev() fails, then the driver leaks the netdev notifier.\nFix this by calling ionic_lif_unregister() on register_netdev()\nfailure. This will also call ionic_lif_unregister_phc() if it has\nalready been registered.(CVE-2024-56715)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check return value of sock_recvmsg when draining clc data\n\nWhen receiving clc msg, the field length in smc_clc_msg_hdr indicates the\nlength of msg should be received from network and the value should not be\nfully trusted as it is from the network. Once the value of length exceeds\nthe value of buflen in function smc_clc_wait_msg it may run into deadloop\nwhen trying to drain the remaining data exceeding buflen.\n\nThis patch checks the return value of sock_recvmsg when draining data in\ncase of deadloop in draining.(CVE-2024-57791)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in tcp_conn_request()\n\nIf inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will\nreturn without free the dst memory, which allocated in af_ops-\u0026gt;route_req.\n\nHere is the kmemleak stack:\n\nunreferenced object 0xffff8881198631c0 (size 240):\n  comm \u0026quot;softirq\u0026quot;, pid 0, jiffies 4299266571 (age 1802.392s)\n  hex dump (first 32 bytes):\n    00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff  ................\n    81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00  .U..............\n  backtrace:\n    [\u0026lt;ffffffffb93e8d4c\u0026gt;] kmem_cache_alloc+0x60c/0xa80\n    [\u0026lt;ffffffffba11b4c5\u0026gt;] dst_alloc+0x55/0x250\n    [\u0026lt;ffffffffba227bf6\u0026gt;] rt_dst_alloc+0x46/0x1d0\n    [\u0026lt;ffffffffba23050a\u0026gt;] __mkroute_output+0x29a/0xa50\n    [\u0026lt;ffffffffba23456b\u0026gt;] ip_route_output_key_hash+0x10b/0x240\n    [\u0026lt;ffffffffba2346bd\u0026gt;] ip_route_output_flow+0x1d/0x90\n    [\u0026lt;ffffffffba254855\u0026gt;] inet_csk_route_req+0x2c5/0x500\n    [\u0026lt;ffffffffba26b331\u0026gt;] tcp_conn_request+0x691/0x12c0\n    [\u0026lt;ffffffffba27bd08\u0026gt;] tcp_rcv_state_process+0x3c8/0x11b0\n    [\u0026lt;ffffffffba2965c6\u0026gt;] tcp_v4_do_rcv+0x156/0x3b0\n    [\u0026lt;ffffffffba299c98\u0026gt;] tcp_v4_rcv+0x1cf8/0x1d80\n    [\u0026lt;ffffffffba239656\u0026gt;] ip_protocol_deliver_rcu+0xf6/0x360\n    [\u0026lt;ffffffffba2399a6\u0026gt;] ip_local_deliver_finish+0xe6/0x1e0\n    [\u0026lt;ffffffffba239b8e\u0026gt;] ip_local_deliver+0xee/0x360\n    [\u0026lt;ffffffffba239ead\u0026gt;] ip_rcv+0xad/0x2f0\n    [\u0026lt;ffffffffba110943\u0026gt;] __netif_receive_skb_one_core+0x123/0x140\n\nCall dst_release() to free the dst memory when\ninet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().(CVE-2024-57841)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix TCP options overflow.\n\nSyzbot reported the following splat:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 1 UID: 0 PID: 5836 Comm: sshd Not tainted 6.13.0-rc3-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/25/2024\nRIP: 0010:_compound_head include/linux/page-flags.h:242 [inline]\nRIP: 0010:put_page+0x23/0x260 include/linux/mm.h:1552\nCode: 90 90 90 90 90 90 90 55 41 57 41 56 53 49 89 fe 48 bd 00 00 00 00 00 fc ff df e8 f8 5e 12 f8 49 8d 5e 08 48 89 d8 48 c1 e8 03 \u0026lt;80\u0026gt; 3c 28 00 74 08 48 89 df e8 8f c7 78 f8 48 8b 1b 48 89 de 48 83\nRSP: 0000:ffffc90003916c90 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: 0000000000000008 RCX: ffff888030458000\nRDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: dffffc0000000000 R08: ffffffff898ca81d R09: 1ffff110054414ac\nR10: dffffc0000000000 R11: ffffed10054414ad R12: 0000000000000007\nR13: ffff88802a20a542 R14: 0000000000000000 R15: 0000000000000000\nFS:  00007f34f496e800(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f9d6ec9ec28 CR3: 000000004d260000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_page_unref include/linux/skbuff_ref.h:43 [inline]\n __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]\n skb_release_data+0x483/0x8a0 net/core/skbuff.c:1119\n skb_release_all net/core/skbuff.c:1190 [inline]\n __kfree_skb+0x55/0x70 net/core/skbuff.c:1204\n tcp_clean_rtx_queue net/ipv4/tcp_input.c:3436 [inline]\n tcp_ack+0x2442/0x6bc0 net/ipv4/tcp_input.c:4032\n tcp_rcv_state_process+0x8eb/0x44e0 net/ipv4/tcp_input.c:6805\n tcp_v4_do_rcv+0x77d/0xc70 net/ipv4/tcp_ipv4.c:1939\n tcp_v4_rcv+0x2dc0/0x37f0 net/ipv4/tcp_ipv4.c:2351\n ip_protocol_deliver_rcu+0x22e/0x440 net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x341/0x5f0 net/ipv4/ip_input.c:233\n NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314\n NF_HOOK+0x3a4/0x450 include/linux/netfilter.h:314\n __netif_receive_skb_one_core net/core/dev.c:5672 [inline]\n __netif_receive_skb+0x2bf/0x650 net/core/dev.c:5785\n process_backlog+0x662/0x15b0 net/core/dev.c:6117\n __napi_poll+0xcb/0x490 net/core/dev.c:6883\n napi_poll net/core/dev.c:6952 [inline]\n net_rx_action+0x89b/0x1240 net/core/dev.c:7074\n handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561\n __do_softirq kernel/softirq.c:595 [inline]\n invoke_softirq kernel/softirq.c:435 [inline]\n __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662\n irq_exit_rcu+0x9/0x30 kernel/softirq.c:678\n instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]\n sysvec_apic_timer_interrupt+0x57/0xc0 arch/x86/kernel/apic/apic.c:1049\n asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702\nRIP: 0033:0x7f34f4519ad5\nCode: 85 d2 74 0d 0f 10 02 48 8d 54 24 20 0f 11 44 24 20 64 8b 04 25 18 00 00 00 85 c0 75 27 41 b8 08 00 00 00 b8 0f 01 00 00 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 76 75 48 8b 15 24 73 0d 00 f7 d8 64 89 02 48 83\nRSP: 002b:00007ffec5b32ce0 EFLAGS: 00000246\nRAX: 0000000000000001 RBX: 00000000000668a0 RCX: 00007f34f4519ad5\nRDX: 00007ffec5b32d00 RSI: 0000000000000004 RDI: 0000564f4bc6cae0\nRBP: 0000564f4bc6b5a0 R08: 0000000000000008 R09: 0000000000000000\nR10: 00007ffec5b32de8 R11: 0000000000000246 R12: 0000564f48ea8aa4\nR13: 0000000000000001 R14: 0000564f48ea93e8 R15: 00007ffec5b32d68\n \u0026lt;/TASK\u0026gt;\n\nEric noted a probable shinfo-\u0026gt;nr_frags corruption, which indeed\noccurs.\n\nThe root cause is a buggy MPTCP option len computation in some\ncircumstances: the ADD_ADDR option should be mutually exclusive\nwith DSS since the blamed commit.\n\nStill, mptcp_established_options_add_addr() tries to set the\nrelevant info in mptcp_out_options, if \n---truncated---(CVE-2024-57882)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker\n\nAfter commit\n746ae46c1113 (\u0026quot;drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM\u0026quot;)\namdgpu started seeing the following warning:\n\n [ ] workqueue: WQ_MEM_RECLAIM sdma0:drm_sched_run_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM events:amdgpu_device_delay_enable_gfx_off [amdgpu]\n...\n [ ] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched]\n...\n [ ] Call Trace:\n [ ]  \u0026lt;TASK\u0026gt;\n...\n [ ]  ? check_flush_dependency+0xf5/0x110\n...\n [ ]  cancel_delayed_work_sync+0x6e/0x80\n [ ]  amdgpu_gfx_off_ctrl+0xab/0x140 [amdgpu]\n [ ]  amdgpu_ring_alloc+0x40/0x50 [amdgpu]\n [ ]  amdgpu_ib_schedule+0xf4/0x810 [amdgpu]\n [ ]  ? drm_sched_run_job_work+0x22c/0x430 [gpu_sched]\n [ ]  amdgpu_job_run+0xaa/0x1f0 [amdgpu]\n [ ]  drm_sched_run_job_work+0x257/0x430 [gpu_sched]\n [ ]  process_one_work+0x217/0x720\n...\n [ ]  \u0026lt;/TASK\u0026gt;\n\nThe intent of the verifcation done in check_flush_depedency is to ensure\nforward progress during memory reclaim, by flagging cases when either a\nmemory reclaim process, or a memory reclaim work item is flushed from a\ncontext not marked as memory reclaim safe.\n\nThis is correct when flushing, but when called from the\ncancel(_delayed)_work_sync() paths it is a false positive because work is\neither already running, or will not be running at all. Therefore\ncancelling it is safe and we can relax the warning criteria by letting the\nhelper know of the calling context.\n\nReferences: 746ae46c1113 (\u0026quot;drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM\u0026quot;)(CVE-2024-57888)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmisc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling\n\nResolve kernel panic caused by improper handling of IRQs while\naccessing GPIO values. This is done by replacing generic_handle_irq with\nhandle_nested_irq.(CVE-2024-57916)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix a missing return value check bug\n\nIn the smb2_send_interim_resp(), if ksmbd_alloc_work_struct()\nfails to allocate a node, it returns a NULL pointer to the\nin_work pointer. This can lead to an illegal memory write of\nin_work-\u0026gt;response_buf when allocate_interim_rsp_buf() attempts\nto perform a kzalloc() on it.\n\nTo address this issue, incorporating a check for the return\nvalue of ksmbd_alloc_work_struct() ensures that the function\nreturns immediately upon allocation failure, thereby preventing\nthe aforementioned illegal memory access.(CVE-2024-57925)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: guard XDP xmit NDO on existence of xdp queues\n\nIn GVE, dedicated XDP queues only exist when an XDP program is installed\nand the interface is up. As such, the NDO XDP XMIT callback should\nreturn early if either of these conditions are false.\n\nIn the case of no loaded XDP program, priv-\u0026gt;num_xdp_queues=0 which can\ncause a divide-by-zero error, and in the case of interface down,\nnum_xdp_queues remains untouched to persist XDP queue count for the next\ninterface up, but the TX pointer itself would be NULL.\n\nThe XDP xmit callback also needs to synchronize with a device\ntransitioning from open to close. This synchronization will happen via\nthe GVE_PRIV_FLAGS_NAPI_ENABLED bit along with a synchronize_net() call,\nwhich waits for any RCU critical sections at call-time to complete.(CVE-2024-57932)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngve: guard XSK operations on the existence of queues\n\nThis patch predicates the enabling and disabling of XSK pools on the\nexistence of queues. As it stands, if the interface is down, disabling\nor enabling XSK pools would result in a crash, as the RX queue pointer\nwould be NULL. XSK pool registration will occur as part of the next\ninterface up.\n\nSimilarly, xsk_wakeup needs be guarded against queues disappearing\nwhile the function is executing, so a check against the\nGVE_PRIV_FLAGS_NAPI_ENABLED flag is added to synchronize with the\ndisabling of the bit and the synchronize_net() in gve_turndown.(CVE-2024-57933)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nriscv: Fix sleeping in invalid context in die()\n\ndie() can be called in exception handler, and therefore cannot sleep.\nHowever, die() takes spinlock_t which can sleep with PREEMPT_RT enabled.\nThat causes the following warning:\n\nBUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex\npreempt_count: 110001, expected: 0\nRCU nest depth: 0, expected: 0\nCPU: 0 UID: 0 PID: 285 Comm: mutex Not tainted 6.12.0-rc7-00022-ge19049cf7d56-dirty #234\nHardware name: riscv-virtio,qemu (DT)\nCall Trace:\n    dump_backtrace+0x1c/0x24\n    show_stack+0x2c/0x38\n    dump_stack_lvl+0x5a/0x72\n    dump_stack+0x14/0x1c\n    __might_resched+0x130/0x13a\n    rt_spin_lock+0x2a/0x5c\n    die+0x24/0x112\n    do_trap_insn_illegal+0xa0/0xea\n    _new_vmalloc_restore_context_a0+0xcc/0xd8\nOops - illegal instruction [#1]\n\nSwitch to use raw_spinlock_t, which does not sleep even with PREEMPT_RT\nenabled.(CVE-2024-57939)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix the infinite loop in exfat_readdir()\n\nIf the file system is corrupted so that a cluster is linked to\nitself in the cluster chain, and there is an unused directory\nentry in the cluster, \u0026apos;dentry\u0026apos; will not be incremented, causing\ncondition \u0026apos;dentry \u0026lt; max_dentries\u0026apos; unable to prevent an infinite\nloop.\n\nThis infinite loop causes s_lock not to be released, and other\ntasks will hang, such as exfat_sync_fs().\n\nThis commit stops traversing the cluster chain when there is unused\ndirectory entry in the cluster to avoid this infinite loop.(CVE-2024-57940)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_set_pipapo: fix initial map fill\n\nThe initial buffer has to be inited to all-ones, but it must restrict\nit to the size of the first field, not the total field size.\n\nAfter each round in the map search step, the result and the fill map\nare swapped, so if we have a set where f-\u0026gt;bsize of the first element\nis smaller than m-\u0026gt;bsize_max, those one-bits are leaked into future\nrounds result map.\n\nThis makes pipapo find an incorrect matching results for sets where\nfirst field size is not the largest.\n\nFollowup patch adds a test case to nft_concat_range.sh selftest script.\n\nThanks to Stefano Brivio for pointing out that we need to zero out\nthe remainder explicitly, only correcting memset() argument isn\u0026apos;t enough.(CVE-2024-57947)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it\n\nWakeup for IRQ1 should be disabled only in cases where i8042 had\nactually enabled it, otherwise \u0026quot;wake_depth\u0026quot; for this IRQ will try to\ndrop below zero and there will be an unpleasant WARN() logged:\n\nkernel: atkbd serio0: Disabling IRQ1 wakeup source to avoid platform firmware bug\nkernel: ------------[ cut here ]------------\nkernel: Unbalanced IRQ 1 wake disable\nkernel: WARNING: CPU: 10 PID: 6431 at kernel/irq/manage.c:920 irq_set_irq_wake+0x147/0x1a0\n\nThe PMC driver uses DEFINE_SIMPLE_DEV_PM_OPS() to define its dev_pm_ops\nwhich sets amd_pmc_suspend_handler() to the .suspend, .freeze, and\n.poweroff handlers. i8042_pm_suspend(), however, is only set as\nthe .suspend handler.\n\nFix the issue by call PMC suspend handler only from the same set of\ndev_pm_ops handlers as i8042_pm_suspend(), which currently means just\nthe .suspend handler.\n\nTo reproduce this issue try hibernating (S4) the machine after a fresh boot\nwithout putting it into s2idle first.\n\n[ij: edited the commit message.](CVE-2025-21645)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix kernel crash when 1588 is sent on HIP08 devices\n\nCurrently, HIP08 devices does not register the ptp devices, so the\nhdev-\u0026gt;ptp is NULL. But the tx process would still try to set hardware time\nstamp info with SKBTX_HW_TSTAMP flag and cause a kernel crash.\n\n[  128.087798] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018\n...\n[  128.280251] pc : hclge_ptp_set_tx_info+0x2c/0x140 [hclge]\n[  128.286600] lr : hclge_ptp_set_tx_info+0x20/0x140 [hclge]\n[  128.292938] sp : ffff800059b93140\n[  128.297200] x29: ffff800059b93140 x28: 0000000000003280\n[  128.303455] x27: ffff800020d48280 x26: ffff0cb9dc814080\n[  128.309715] x25: ffff0cb9cde93fa0 x24: 0000000000000001\n[  128.315969] x23: 0000000000000000 x22: 0000000000000194\n[  128.322219] x21: ffff0cd94f986000 x20: 0000000000000000\n[  128.328462] x19: ffff0cb9d2a166c0 x18: 0000000000000000\n[  128.334698] x17: 0000000000000000 x16: ffffcf1fc523ed24\n[  128.340934] x15: 0000ffffd530a518 x14: 0000000000000000\n[  128.347162] x13: ffff0cd6bdb31310 x12: 0000000000000368\n[  128.353388] x11: ffff0cb9cfbc7070 x10: ffff2cf55dd11e02\n[  128.359606] x9 : ffffcf1f85a212b4 x8 : ffff0cd7cf27dab0\n[  128.365831] x7 : 0000000000000a20 x6 : ffff0cd7cf27d000\n[  128.372040] x5 : 0000000000000000 x4 : 000000000000ffff\n[  128.378243] x3 : 0000000000000400 x2 : ffffcf1f85a21294\n[  128.384437] x1 : ffff0cb9db520080 x0 : ffff0cb9db500080\n[  128.390626] Call trace:\n[  128.393964]  hclge_ptp_set_tx_info+0x2c/0x140 [hclge]\n[  128.399893]  hns3_nic_net_xmit+0x39c/0x4c4 [hns3]\n[  128.405468]  xmit_one.constprop.0+0xc4/0x200\n[  128.410600]  dev_hard_start_xmit+0x54/0xf0\n[  128.415556]  sch_direct_xmit+0xe8/0x634\n[  128.420246]  __dev_queue_xmit+0x224/0xc70\n[  128.425101]  dev_queue_xmit+0x1c/0x40\n[  128.429608]  ovs_vport_send+0xac/0x1a0 [openvswitch]\n[  128.435409]  do_output+0x60/0x17c [openvswitch]\n[  128.440770]  do_execute_actions+0x898/0x8c4 [openvswitch]\n[  128.446993]  ovs_execute_actions+0x64/0xf0 [openvswitch]\n[  128.453129]  ovs_dp_process_packet+0xa0/0x224 [openvswitch]\n[  128.459530]  ovs_vport_receive+0x7c/0xfc [openvswitch]\n[  128.465497]  internal_dev_xmit+0x34/0xb0 [openvswitch]\n[  128.471460]  xmit_one.constprop.0+0xc4/0x200\n[  128.476561]  dev_hard_start_xmit+0x54/0xf0\n[  128.481489]  __dev_queue_xmit+0x968/0xc70\n[  128.486330]  dev_queue_xmit+0x1c/0x40\n[  128.490856]  ip_finish_output2+0x250/0x570\n[  128.495810]  __ip_finish_output+0x170/0x1e0\n[  128.500832]  ip_finish_output+0x3c/0xf0\n[  128.505504]  ip_output+0xbc/0x160\n[  128.509654]  ip_send_skb+0x58/0xd4\n[  128.513892]  udp_send_skb+0x12c/0x354\n[  128.518387]  udp_sendmsg+0x7a8/0x9c0\n[  128.522793]  inet_sendmsg+0x4c/0x8c\n[  128.527116]  __sock_sendmsg+0x48/0x80\n[  128.531609]  __sys_sendto+0x124/0x164\n[  128.536099]  __arm64_sys_sendto+0x30/0x5c\n[  128.540935]  invoke_syscall+0x50/0x130\n[  128.545508]  el0_svc_common.constprop.0+0x10c/0x124\n[  128.551205]  do_el0_svc+0x34/0xdc\n[  128.555347]  el0_svc+0x20/0x30\n[  128.559227]  el0_sync_handler+0xb8/0xc0\n[  128.563883]  el0_sync+0x160/0x180(CVE-2025-21649)\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpio: xilinx: Convert gpio_lock to raw spinlock\n\nirq_chip functions may be called in raw spinlock context. Therefore, we\nmust also use a raw spinlock for our own internal locking.\n\nThis fixes the following lockdep splat:\n\n[    5.349336] =============================\n[    5.353349] [ BUG: Invalid wait context ]\n[    5.357361] 6.13.0-rc5+ #69 Tainted: G        W\n[    5.363031] -----------------------------\n[    5.367045] kworker/u17:1/44 is trying to lock:\n[    5.371587] ffffff88018b02c0 (\u0026amp;chip-\u0026gt;gpio_lock){....}-{3:3}, at: xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8))\n[    5.380079] other info that might help us debug this:\n[    5.385138] context-{5:5}\n[    5.387762] 5 locks held by kworker/u17:1/44:\n[    5.392123] #0: ffffff8800014958 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3204)\n[    5.402260] #1: ffffffc082fcbdd8 (deferred_probe_work){+.+.}-{0:0}, at: process_one_work (kernel/workqueue.c:3205)\n[    5.411528] #2: ffffff880172c900 (\u0026amp;dev-\u0026gt;mutex){....}-{4:4}, at: __device_attach (drivers/base/dd.c:1006)\n[    5.419929] #3: ffffff88039c8268 (request_class#2){+.+.}-{4:4}, at: __setup_irq (kernel/irq/internals.h:156 kernel/irq/manage.c:1596)\n[    5.428331] #4: ffffff88039c80c8 (lock_class#2){....}-{2:2}, at: __setup_irq (kernel/irq/manage.c:1614)\n[    5.436472] stack backtrace:\n[    5.439359] CPU: 2 UID: 0 PID: 44 Comm: kworker/u17:1 Tainted: G        W          6.13.0-rc5+ #69\n[    5.448690] Tainted: [W]=WARN\n[    5.451656] Hardware name: xlnx,zynqmp (DT)\n[    5.455845] Workqueue: events_unbound deferred_probe_work_func\n[    5.461699] Call trace:\n[    5.464147] show_stack+0x18/0x24 C\n[    5.467821] dump_stack_lvl (lib/dump_stack.c:123)\n[    5.471501] dump_stack (lib/dump_stack.c:130)\n[    5.474824] __lock_acquire (kernel/locking/lockdep.c:4828 kernel/locking/lockdep.c:4898 kernel/locking/lockdep.c:5176)\n[    5.478758] lock_acquire (arch/arm64/include/asm/percpu.h:40 kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851 kernel/locking/lockdep.c:5814)\n[    5.482429] _raw_spin_lock_irqsave (include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162)\n[    5.486797] xgpio_irq_unmask (drivers/gpio/gpio-xilinx.c:433 (discriminator 8))\n[    5.490737] irq_enable (kernel/irq/internals.h:236 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345)\n[    5.494060] __irq_startup (kernel/irq/internals.h:241 kernel/irq/chip.c:180 kernel/irq/chip.c:250)\n[    5.497645] irq_startup (kernel/irq/chip.c:270)\n[    5.501143] __setup_irq (kernel/irq/manage.c:1807)\n[    5.504728] request_threaded_irq (kernel/irq/manage.c:2208)(CVE-2025-21684)","status":"published","published":"2025-02-14T11:08:12Z","modified":"2026-08-18T01:18:46.868649827Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-56686","description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","status":"published","published":"2024-12-28T10:15:00Z","modified":"2026-11-10T02:49:47.478178693Z","updated_at":"2026-11-10T03:18:14.21956Z"}]}}