https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:31:20 +0000 https://vulnerability.circl.lu/vuln/cve-2024-44932 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>idpf: fix UAFs when destroying the queues</p> <p>The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools&#39; NAPI pointers lead to freed memory before these pools are destroyed by libeth. It&#39;s not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere.</p> <p>Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don&#39;t require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue-&gt;q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it&#39;s not clear why nullify the pointers at all).</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>idpf: fix UAFs when destroying the queues</p> <p>The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools&#39; NAPI pointers lead to freed memory before these pools are destroyed by libeth. It&#39;s not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere.</p> <p>Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don&#39;t require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue-&gt;q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it&#39;s not clear why nullify the pointers at all).</p> https://vulnerability.circl.lu/vuln/cve-2024-44932