Vulnerability-Lookup

RHSA-2024:5363

Vulnerability from csaf_redhat - Published: 2024-08-15 05:34 - Updated: 2026-09-01 11:55

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: phy: (CVE-2024-26600) * kernel: netfilter: multiple flaws (CVE-2024-26808, CVE-2024-27065, CVE-2024-35899, CVE-2024-36005) * kernel: cifs: (CVE-2024-26828) * kernel: wifi: multiple flaws (CVE-2024-26897, CVE-2024-27052, CVE-2024-27049, CVE-2023-52651, CVE-2024-35789, CVE-2024-27434, CVE-2024-35845, CVE-2024-35937, CVE-2024-36941, CVE-2024-36922, CVE-2024-36921, CVE-2024-38575) * kernel: nfs: (CVE-2024-26868) * kernel: igc: (CVE-2024-26853) * kernel: dmaengine/idxd: (CVE-2024-21823) * kernel: ipv6: multiple flaws (CVE-2024-27417, CVE-2024-35969, CVE-2024-36903, CVE-2024-40961) * kernel: vt: (CVE-2024-35823) * kernel: efi: (CVE-2024-35800) * kernel: mlxsw: (CVE-2024-35852) * kernel: eeprom: (CVE-2024-35848) * kernel: ice: (CVE-2024-35911) * kernel: platform/x86: (CVE-2023-52864) * kernel: i40e: (CVE-2024-36020) * kernel: rtnetlink: (CVE-2024-36017) * kernel: net: multiple flaws (CVE-2024-36929, CVE-2024-36971, CVE-2021-47606, CVE-2024-38558, CVE-2024-40928, CVE-2024-40954) * kernel: ipvlan: (CVE-2024-33621) * kernel: tcp: (CVE-2024-37356) * kernel: virtio: (CVE-2024-37353) * kernel: tls: (CVE-2024-36489) * kernel: cxl/region: (CVE-2024-38391) * kernel: bonding: (CVE-2024-39487) * kernel: netns: (CVE-2024-40958) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-47606

In the Linux kernel, the following vulnerability has been resolved: net: netlink: af_netlink: Prevent empty skb by adding a check on len. Adding a check on len parameter to avoid empty skb. This prevents a division error in netem_enqueue function which is caused when skb->len=0 and skb->data_len=0 in the randomized corruption step as shown below. skb->data[prandom_u32() % skb_headlen(skb)] ^= 1<<(prandom_u32() % 8); Crash Report: [ 343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.216110] netem: version 1.3 [ 343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+ [ 343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 [ 343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem] [ 343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f 74 <f7> f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03 [ 343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246 [ 343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX: 0000000000000000 [ 343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI: ffff88800f8eda40 [ 343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09: ffffffff94fb8445 [ 343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12: 0000000000000000 [ 343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15: 0000000000000020 [ 343.247291] FS: 00007fdde2bd7700(0000) GS:ffff888109780000(0000) knlGS:0000000000000000 [ 343.248350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4: 00000000000006e0 [ 343.250076] Call Trace: [ 343.250423] <TASK> [ 343.250713] ? memcpy+0x4d/0x60 [ 343.251162] ? netem_init+0xa0/0xa0 [sch_netem] [ 343.251795] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.252443] netem_enqueue+0xe28/0x33c0 [sch_netem] [ 343.253102] ? stack_trace_save+0x87/0xb0 [ 343.253655] ? filter_irq_stacks+0xb0/0xb0 [ 343.254220] ? netem_init+0xa0/0xa0 [sch_netem] [ 343.254837] ? __kasan_check_write+0x14/0x20 [ 343.255418] ? _raw_spin_lock+0x88/0xd6 [ 343.255953] dev_qdisc_enqueue+0x50/0x180 [ 343.256508] __dev_queue_xmit+0x1a7e/0x3090 [ 343.257083] ? netdev_core_pick_tx+0x300/0x300 [ 343.257690] ? check_kcov_mode+0x10/0x40 [ 343.258219] ? _raw_spin_unlock_irqrestore+0x29/0x40 [ 343.258899] ? __kasan_init_slab_obj+0x24/0x30 [ 343.259529] ? setup_object.isra.71+0x23/0x90 [ 343.260121] ? new_slab+0x26e/0x4b0 [ 343.260609] ? kasan_poison+0x3a/0x50 [ 343.261118] ? kasan_unpoison+0x28/0x50 [ 343.261637] ? __kasan_slab_alloc+0x71/0x90 [ 343.262214] ? memcpy+0x4d/0x60 [ 343.262674] ? write_comp_data+0x2f/0x90 [ 343.263209] ? __kasan_check_write+0x14/0x20 [ 343.263802] ? __skb_clone+0x5d6/0x840 [ 343.264329] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.264958] dev_queue_xmit+0x1c/0x20 [ 343.265470] netlink_deliver_tap+0x652/0x9c0 [ 343.266067] netlink_unicast+0x5a0/0x7f0 [ 343.266608] ? netlink_attachskb+0x860/0x860 [ 343.267183] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.267820] ? write_comp_data+0x2f/0x90 [ 343.268367] netlink_sendmsg+0x922/0xe80 [ 343.268899] ? netlink_unicast+0x7f0/0x7f0 [ 343.269472] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.270099] ? write_comp_data+0x2f/0x90 [ 343.270644] ? netlink_unicast+0x7f0/0x7f0 [ 343.271210] sock_sendmsg+0x155/0x190 [ 343.271721] ____sys_sendmsg+0x75f/0x8f0 [ 343.272262] ? kernel_sendmsg+0x60/0x60 [ 343.272788] ? write_comp_data+0x2f/0x90 [ 343.273332] ? write_comp_data+0x2f/0x90 [ 343.273869] ___sys_sendmsg+0x10f/0x190 [ 343.274405] ? sendmsg_copy_msghdr+0x80/0x80 [ 343.274984] ? slab_post_alloc_hook+0x70/0x230 [ 343.275597] ? futex_wait_setup+0x240/0x240 [ 343.276175] ? security_file_alloc+0x3e/0x170 [ 343.276779] ? write_comp_d ---truncated---

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-369 - Divide By Zero

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-427.31.1.el9_4.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.31.1.el9_4.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-427.31.1.el9_4.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-kvm-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.31.1.el9_4.x86_64	—	Vendor Fix fix

Known not affected 8 products

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-headers-0:5.14.0-427.31.1.el9_4.aarch64		—
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-headers-0:5.14.0-427.31.1.el9_4.ppc64le		—
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-headers-0:5.14.0-427.31.1.el9_4.s390x		—
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-headers-0:5.14.0-427.31.1.el9_4.x86_64		—
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-cross-headers-0:5.14.0-427.31.1.el9_4.aarch64		—
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-cross-headers-0:5.14.0-427.31.1.el9_4.ppc64le		—
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-cross-headers-0:5.14.0-427.31.1.el9_4.s390x		—
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-cross-headers-0:5.14.0-427.31.1.el9_4.x86_64		—

Threats

Impact Low

CVE-2023-52651

A potential NULL pointer dereference flaw was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in the Linux kernel. This issue may lead to a crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2023-52796

In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices. BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<f ---truncated---

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2023-52864

In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-21823

Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access

6.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-26600

A NULL pointer dereference flaw was found in the Linux kernel in the phy-omap-usb2 driver. This issue arises when the external PHY used with phy-omap-usb2 does not implement the send_srp() function. If this function is called without proper implementation, it can result in a system crash, especially during operations like waking up an idle Ethernet gadget.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-26808

A vulnerability was found in the Linux kernel's netfilter subsystem, related to the nft_chain_filter feature. This issue occurs when a NETDEV_UNREGISTER event is reported, which can leave a stale reference to a network device in the ingress basechain. If this issue is not addressed, this stale reference could result in lingering issues with network device handling.

6.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-26828

In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending.

6.7 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

CWE-191 - Integer Underflow (Wrap or Wraparound)

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-26853

A memory corruption flaw was found in the Linux kernel’s Intel(R) Ethernet Controller I225-LM/I225-V driver in how a user generates a high amount of packets. This flaw allows a local user to crash the system.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-26868

A vulnerability was found in the ff_layout_cancel_io() function in the Linux kernel. Improper error checking with the mirror_ds structure fails to check if it is NULL, leading to a potential NULL pointer dereference. This issue could lead to crashes.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-26897

A flaw was found in the Linux kernel. This vulnerability affects the ath9k wireless driver in the Linux kernel, specifically used with ath9k_htc devices. The issue arises from a race condition where certain initialization processes are incomplete when the system begins handling WiFi-related events. The problem occurs because the device is exposed to the USB subsystem before the ath9k driver finishes initializing critical data structures. This can lead to NULL pointer dereferences, which cause system crashes, particularly when running specific commands or handling events during WiFi operations. A partial fix had been applied earlier to prevent one aspect of this issue, but further problems were identified. The final resolution was to delay all event handling in the ath9k_wmi_event_tasklet() function until initialization is fully complete, ensuring stability.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-27049

A use-after-free flaw was found in free_irq() in the Linux kernel.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-27052

A vulnerability was found in the Linux kernel's net rtl8xxxu_core.c driver, where a race condition can lead to a use-after-free situation in the rtl8xxxu_stop() function. This occurs when the workqueue is still running but the driver has been stopped and can lead to c2hcmd_work attempting to access memory that has been freed. This issue can lead to memory corruption or crashes.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-27065

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-27417

A flaw was discovered in the Linux kernel's IPv6 implementation, specifically within the inet6_rtm_getaddr() function. The issue arises when user space provides a valid IFA_TARGET_NETNSID value but omits the IFA_ADDRESS and IFA_LOCAL attributes. In such cases, the function returns an -EINVAL error while inadvertently increasing the reference count of the struct net object, leading to a potential memory leak. This flaw has been addressed by ensuring that the reference count is properly managed, preventing unintended resource retention. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability and prevent resource leaks.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-27434

CVE-2024-27434 is a flaw in the Linux kernel’s iwlwifi driver related to handling Management Frame Protection (MFP) in certain Wi-Fi configurations. When connecting to an access point using TKIP as the group cipher, the driver incorrectly applies the MFP flag to the Group Temporal Key (GTK), which is not supported in this context. This can result in firmware crashes and instability. The issue has been fixed by ensuring the driver does not set the MFP flag for incompatible group ciphers like TKIP. Updating to a patched kernel version is recommended to resolve this vulnerability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-33621

In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xmit() path. WARNING: CPU: 2 PID: 0 at net/core/sock.c:775 sk_mc_loop+0x2d/0x70 Modules linked in: sch_netem ipvlan rfkill cirrus drm_shmem_helper sg drm_kms_helper CPU: 2 PID: 0 Comm: swapper/2 Kdump: loaded Not tainted 6.9.0+ #279 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:sk_mc_loop+0x2d/0x70 Code: fa 0f 1f 44 00 00 65 0f b7 15 f7 96 a3 4f 31 c0 66 85 d2 75 26 48 85 ff 74 1c RSP: 0018:ffffa9584015cd78 EFLAGS: 00010212 RAX: 0000000000000011 RBX: ffff91e585793e00 RCX: 0000000002c6a001 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff91e589c0f000 RBP: ffff91e5855bd100 R08: 0000000000000000 R09: 3d00545216f43d00 R10: ffff91e584fdcc50 R11: 00000060dd8616f4 R12: ffff91e58132d000 R13: ffff91e584fdcc68 R14: ffff91e5869ce800 R15: ffff91e589c0f000 FS: 0000000000000000(0000) GS:ffff91e898100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f788f7c44c0 CR3: 0000000008e1a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> ? __warn (kernel/panic.c:693) ? sk_mc_loop (net/core/sock.c:760) ? report_bug (lib/bug.c:201 lib/bug.c:219) ? handle_bug (arch/x86/kernel/traps.c:239) ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) ? asm_exc_invalid_op (./arch/x86/include/asm/idtentry.h:621) ? sk_mc_loop (net/core/sock.c:760) ip6_finish_output2 (net/ipv6/ip6_output.c:83 (discriminator 1)) ? nf_hook_slow (net/netfilter/core.c:626) ip6_finish_output (net/ipv6/ip6_output.c:222) ? __pfx_ip6_finish_output (net/ipv6/ip6_output.c:215) ipvlan_xmit_mode_l3 (drivers/net/ipvlan/ipvlan_core.c:602) ipvlan ipvlan_start_xmit (drivers/net/ipvlan/ipvlan_main.c:226) ipvlan dev_hard_start_xmit (net/core/dev.c:3594) sch_direct_xmit (net/sched/sch_generic.c:343) __qdisc_run (net/sched/sch_generic.c:416) net_tx_action (net/core/dev.c:5286) handle_softirqs (kernel/softirq.c:555) __irq_exit_rcu (kernel/softirq.c:589) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1043) The warning triggers as this: packet_sendmsg packet_snd //skb->sk is packet sk __dev_queue_xmit __dev_xmit_skb //q->enqueue is not NULL __qdisc_run sch_direct_xmit dev_hard_start_xmit ipvlan_start_xmit ipvlan_xmit_mode_l3 //l3 mode ipvlan_process_outbound //vepa flag ipvlan_process_v6_outbound ip6_local_out __ip6_finish_output ip6_finish_output2 //multicast packet sk_mc_loop //sk->sk_family is AF_PACKET Call ip{6}_local_out() with NULL sk in ipvlan as other tunnels to fix this.

2.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-35789

CVE-2024-35789 is a vulnerability in the Linux kernel’s Wi-Fi subsystem (mac80211). It occurs when a station is moved out of a VLAN, and the VLAN is subsequently deleted. A reference to the deleted VLAN’s network device may remain, leading to a use-after-free condition. This can result in system instability or crashes. The issue has been resolved by ensuring that outdated references are cleared when a station changes VLANs.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35800

In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel The Linux kernel CVE team has assigned CVE-2024-35800 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35800-219a@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35823

A vulnerability as found in the Linux kernel’s virtual terminal (VT) subsystem, which could lead to unicode buffer corruption when deleting characters. This issue arises from improper handling of unicode data, which can corrupt memory or lead to unintended behavior.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35845

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The Linux kernel CVE team has assigned CVE-2024-35845 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051718-CVE-2024-35845-65bd@gregkh/T

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35848

CVE-2024-35848 is a vulnerability in the Linux kernel's EEPROM driver (at24) that can lead to memory corruption. The issue arises when an EEPROM device is inaccessible: the system registers an nvmem device, the read operation fails, and the device is subsequently torn down. If another driver attempts to access the nvmem device after this teardown, it may reference invalid memory, causing potential system instability. The problem has been resolved by adjusting the failure handling to occur before the nvmem device is registered, preventing access to invalid memory. Users should update their Linux kernel to a version that includes this fix to ensure system reliability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35852

CVE-2024-35852 addresses a memory leak in the Linux kernel's mlxsw driver, specifically within the Spectrum ACL TCAM module. The issue occurs when rehash work is canceled while pending, leading to allocated hints not being freed properly. This results in a memory leak that can degrade system performance over time. The problem has been resolved by ensuring that any associated hints are freed when the rehash work is canceled. Users should update their Linux kernel to a version that includes this fix to maintain optimal system performance.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35899

A vulnerability was found in the Linux kernel's Netfilter framework, specifically within the nf_tables component. The issue arises from a race condition between the exit_net function and the destroy work queue, which can lead to use-after-free errors and potential system instability. This vulnerability has been addressed by making sure that any pending destroy work is flushed before releasing network namespaces, thereby preventing the race condition. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability and security.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35911

This is a flaw in the Linux kernel's ICE driver for Intel Ethernet controllers. The problem arises when the system enters a suspended state, and the driver frees queue vectors without resetting the num_q_vectors variable. This oversight causes the ice_rebuild() function to allocate an incorrectly sized buffer, leading to memory corruption and potential system crashes. During suspension, the driver fails to restore the num_q_vectors value after freeing queue vectors, resulting in invalid memory operations during system rebuilds. Kernel crashes or instability can occur, especially when resuming from suspension, due to buffer mismanagement.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35937

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-35969

This CVE addresses a race condition in the Linux kernel's IPv6 subsystem, specifically between the ipv6_get_ifaddr and ipv6_del_addr functions. This race condition can lead to use-after-free scenarios, potentially causing system instability or crashes.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36005

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-36005-2336@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-36017

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation Each attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a struct ifla_vf_vlan_info so the size of such attribute needs to be at least of sizeof(struct ifla_vf_vlan_info) which is 14 bytes. The current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes) which is less than sizeof(struct ifla_vf_vlan_info) so this validation is not enough and a too small attribute might be cast to a struct ifla_vf_vlan_info, this might result in an out of bands read access when accessing the saved (casted) entry in ivvl.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-36020

A flaw was found in the Linux kernel’s Ethernet Controller XL710 family driver. This flaw allows a local user to crash the system.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36489

In the Linux kernel, the following vulnerability has been resolved: tls: fix missing memory barrier in tls_init In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}. CPU0 CPU1 ----- ----- // In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1) // In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2) // In sock_common_setsockopt() READ_ONCE(sk->sk_prot)->setsockopt() // In tls_{setsockopt,getsockopt}() ctx->sk_proto->setsockopt() -(3) In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference. To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot.

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-36903

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36921

An out-of-bounds memory access flaw was found in the Linux kernel’s Wireless WiFi Link Next-Gen AGN driver in how a user removes it. This flaw allows a local user to crash or potentially escalate their privileges on the system.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36922

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-413 - Improper Resource Locking

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Low

CVE-2024-36929

In the Linux kernel, the following vulnerability has been resolved: net: core: reject skb_copy(_expand) for fraglist GSO skbs SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become invalid. Return NULL if such an skb is passed to skb_copy or skb_copy_expand, in order to prevent a crash on a potential later call to skb_gso_segment.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-822 - Untrusted Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36941

A possible NULL pointer dereference was observed in the Linux kernel, in net/wireless/nl80211.c. This may lead to a crash.

5.7 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-36971

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Exploit Status CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Impact Important

CVE-2024-37353

No description is available for this CVE.

CWE-415 - Double Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

CVE-2024-37356

A security vulnerability has been identified in the TCP networking implementation of the Linux kernel. Specifically, the dctcp_update_alpha() function is susceptible to a shift-out-of-bounds condition. This flaw could potentially be exploited to cause unexpected behavior or a denial-of-service.

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-38391

No description is available for this CVE.

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

CVE-2024-38558

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PACKET - Binary packet content. - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure with the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate the rest of the keys from the packet headers. Whenever the packet parsing code starts parsing the ICMPv6 header, it first zeroes out fields in the key corresponding to Neighbor Discovery information even if it is not an ND packet. It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares the space between 'nd' and 'ct_orig' that holds the original tuple conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. ND packets should not normally have conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have the state attached and it should not be overwritten. The issue results in all but the last 4 bytes of the destination address being wiped from the original conntrack tuple leading to incorrect packet matching and potentially executing wrong actions in case this packet recirculates within the datapath or goes back to userspace. ND fields should not be accessed in non-ND packets, so not clearing them should be fine. Executing memset() only for actual ND packets to avoid the issue. Initializing the whole thing before parsing is needed because ND packet may not contain all the options. The issue only affects the OVS_PACKET_CMD_EXECUTE path and doesn't affect packets entering OVS datapath from network interfaces, because in this case CT metadata is populated from skb after the packet is already parsed.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-665 - Improper Initialization

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-38575

in linux kernel wifi, the kzalloc() in brcmf_pcie_download_fw_nvram() will return null if the physical memory has run out. Thereafter if get_random_bytes() is used, a null pointer dereference is triggered, causing allocation failure.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-39487

In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte after the string, causing an out-of-bound read. BUG: KASAN: slab-out-of-bounds in strlen+0x7d/0xa0 lib/string.c:418 Read of size 1 at addr ffff8881119c4781 by task syz-executor665/8107 CPU: 1 PID: 8107 Comm: syz-executor665 Not tainted 6.7.0-rc7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc1/0x5e0 mm/kasan/report.c:475 kasan_report+0xbe/0xf0 mm/kasan/report.c:588 strlen+0x7d/0xa0 lib/string.c:418 __fortify_strlen include/linux/fortify-string.h:210 [inline] in4_pton+0xa3/0x3f0 net/core/utils.c:130 bond_option_arp_ip_targets_set+0xc2/0x910 drivers/net/bonding/bond_options.c:1201 __bond_opt_set+0x2a4/0x1030 drivers/net/bonding/bond_options.c:767 __bond_opt_set_notify+0x48/0x150 drivers/net/bonding/bond_options.c:792 bond_opt_tryset_rtnl+0xda/0x160 drivers/net/bonding/bond_options.c:817 bonding_sysfs_store_option+0xa1/0x120 drivers/net/bonding/bond_sysfs.c:156 dev_attr_store+0x54/0x80 drivers/base/core.c:2366 sysfs_kf_write+0x114/0x170 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x337/0x500 fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2020 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x96a/0xd80 fs/read_write.c:584 ksys_write+0x122/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b ---[ end trace ]--- Fix it by adding a check of string length before using it.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-40928

A vulnerability was found in the Linux kernel's ethtool implementation in the ethtool_get_phy_stats_ethtool() function, where the issue arises when a null function pointer is dereferenced if the 'ops->get_ethtool_phy_stats' is NULL, potentially leading to a crash.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-40954

A vulnerability was found in the Linux kernel's networking component in the __sock_release() function, where a dangling pointer can occur when socket creation fails. This happens when a reference to the socket is not cleared, leading to a use-after-free condition.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-40958

A vulnerability was found in the Linux kernel's netns in the get_net_ns() function. This vulnerability occurs when a network namespace reference count is zero, leading to a use-after-free condition that can trigger a kernel panic.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

CVE-2024-40961

A vulnerability was found in the Linux kernel's IPv6 routing component, where a NULL dereference occurs in the fib6_nh_init() function, this issue arises when the function attempts to initialize a network interface without verifying its availability, potentially leading to a DoS.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47606

Known not affected 8 products, the same list as for CVE-2021-47606

Threats

Impact Moderate

References

283 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:5363	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265838	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273405	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275600	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275655	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275715	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275748	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278380	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278417	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278519	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278989	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281057	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281097	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281133	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281190	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281237	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281257	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281265	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281272	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281639	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281667	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281821	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281900	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281949	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282719	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284400	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284417	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284474	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284496	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284511	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284513	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284543	external
https://bugzilla.redhat.com/show_bug.cgi?id=2292331	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293208	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293418	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293441	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293657	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293658	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293686	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293687	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293688	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297056	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297512	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297538	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297542	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297545	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-47606	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293208	external
https://www.cve.org/CVERecord?id=CVE-2021-47606	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47606	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2023-52651	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278519	external
https://www.cve.org/CVERecord?id=CVE-2023-52651	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52651	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52796	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282766	external
https://www.cve.org/CVERecord?id=CVE-2023-52796	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52796	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52864	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282719	external
https://www.cve.org/CVERecord?id=CVE-2023-52864	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52864	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-21823	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278989	external
https://www.cve.org/CVERecord?id=CVE-2024-21823	external
https://nvd.nist.gov/vuln/detail/CVE-2024-21823	external
https://access.redhat.com/security/cve/CVE-2024-26600	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265838	external
https://www.cve.org/CVERecord?id=CVE-2024-26600	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26600	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26808	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273405	external
https://www.cve.org/CVERecord?id=CVE-2024-26808	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26808	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26828	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275600	external
https://www.cve.org/CVERecord?id=CVE-2024-26828	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26828	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275748	external
https://www.cve.org/CVERecord?id=CVE-2024-26853	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26853	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26868	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275715	external
https://www.cve.org/CVERecord?id=CVE-2024-26868	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26868	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26897	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275655	external
https://www.cve.org/CVERecord?id=CVE-2024-26897	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26897	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-27049	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278429	external
https://www.cve.org/CVERecord?id=CVE-2024-27049	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27049	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27052	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278417	external
https://www.cve.org/CVERecord?id=CVE-2024-27052	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27052	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27065	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278380	external
https://www.cve.org/CVERecord?id=CVE-2024-27065	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27065	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27417	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281097	external
https://www.cve.org/CVERecord?id=CVE-2024-27417	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27417	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27434	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281133	external
https://www.cve.org/CVERecord?id=CVE-2024-27434	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27434	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-33621	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293657	external
https://www.cve.org/CVERecord?id=CVE-2024-33621	external
https://nvd.nist.gov/vuln/detail/CVE-2024-33621	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-35789	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281057	external
https://www.cve.org/CVERecord?id=CVE-2024-35789	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35789	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35800	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281237	external
https://www.cve.org/CVERecord?id=CVE-2024-35800	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35800	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35823	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281190	external
https://www.cve.org/CVERecord?id=CVE-2024-35823	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35823	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35845	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281272	external
https://www.cve.org/CVERecord?id=CVE-2024-35845	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35845	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35848	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281265	external
https://www.cve.org/CVERecord?id=CVE-2024-35848	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35848	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281257	external
https://www.cve.org/CVERecord?id=CVE-2024-35852	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35852	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281667	external
https://www.cve.org/CVERecord?id=CVE-2024-35899	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35899	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35911	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281639	external
https://www.cve.org/CVERecord?id=CVE-2024-35911	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35911	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35937	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281821	external
https://www.cve.org/CVERecord?id=CVE-2024-35937	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35937	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35969	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281900	external
https://www.cve.org/CVERecord?id=CVE-2024-35969	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35969	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36005	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281949	external
https://www.cve.org/CVERecord?id=CVE-2024-36005	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36005	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36017	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284417	external
https://www.cve.org/CVERecord?id=CVE-2024-36017	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36017	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36020	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284400	external
https://www.cve.org/CVERecord?id=CVE-2024-36020	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36020	external
https://access.redhat.com/security/cve/CVE-2024-36489	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293687	external
https://www.cve.org/CVERecord?id=CVE-2024-36489	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36489	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-36903	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284543	external
https://www.cve.org/CVERecord?id=CVE-2024-36903	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36903	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36921	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284513	external
https://www.cve.org/CVERecord?id=CVE-2024-36921	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36921	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36922	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284511	external
https://www.cve.org/CVERecord?id=CVE-2024-36922	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36922	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36929	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284496	external
https://www.cve.org/CVERecord?id=CVE-2024-36929	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36929	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36941	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284474	external
https://www.cve.org/CVERecord?id=CVE-2024-36941	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36941	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36971	self
https://bugzilla.redhat.com/show_bug.cgi?id=2292331	external
https://www.cve.org/CVERecord?id=CVE-2024-36971	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36971	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://www.cisa.gov/known-exploited-vulnerabilit…	external
https://access.redhat.com/security/cve/CVE-2024-37353	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293686	external
https://www.cve.org/CVERecord?id=CVE-2024-37353	external
https://nvd.nist.gov/vuln/detail/CVE-2024-37353	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-37356	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293658	external
https://www.cve.org/CVERecord?id=CVE-2024-37356	external
https://nvd.nist.gov/vuln/detail/CVE-2024-37356	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38391	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293688	external
https://www.cve.org/CVERecord?id=CVE-2024-38391	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38391	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38558	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293441	external
https://www.cve.org/CVERecord?id=CVE-2024-38558	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38558	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38575	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293418	external
https://www.cve.org/CVERecord?id=CVE-2024-38575	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38575	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-39487	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297056	external
https://www.cve.org/CVERecord?id=CVE-2024-39487	external
https://nvd.nist.gov/vuln/detail/CVE-2024-39487	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40928	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297512	external
https://www.cve.org/CVERecord?id=CVE-2024-40928	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40928	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40954	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297538	external
https://www.cve.org/CVERecord?id=CVE-2024-40954	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40954	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40958	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297542	external
https://www.cve.org/CVERecord?id=CVE-2024-40958	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40958	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40961	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297545	external
https://www.cve.org/CVERecord?id=CVE-2024-40961	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40961	external
https://lore.kernel.org/linux-cve-announce/202407…	external

JSON

To clipboard

Loading 4.1 MB of JSON…

CVE-2021-47606 (GCVE-0-2021-47606)

Vulnerability from cvelistv5 – Published: 2024-06-19 14:54 – Updated: 2026-05-11 13:57

Title

net: netlink: af_netlink: Prevent empty skb by adding a check on len.

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:12 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c54a60c8fbaa774f8…
https://git.kernel.org/stable/c/40cf2e058832d9cfa…
https://git.kernel.org/stable/c/54e785f7d5c197bc0…
https://git.kernel.org/stable/c/ff3f517bf7138e01a…
https://git.kernel.org/stable/c/c0315e93552e0d840…
https://git.kernel.org/stable/c/dadce61247c623048…
https://git.kernel.org/stable/c/4c986072a8c9249b9…
https://git.kernel.org/stable/c/f123cffdd8fe8ea6c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < c54a60c8fbaa774f828e26df79f66229a8a0e010 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < 40cf2e058832d9cfaae98dfd77334926275598b6 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < 54e785f7d5c197bc06dbb8053700df7e2a093ced (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < ff3f517bf7138e01a17369042908a3f345c0ee41 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < c0315e93552e0d840e9edc6abd71c7db82ec8f51 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < dadce61247c6230489527cc5e343b6002d1114c5 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < 4c986072a8c9249b9398c7a18f216dc26a9f0e35 (git) Affected: bcbde0d449eda7afa8f63280b165c8300dbd00e2 , < f123cffdd8fe8ea6c7fded4b88516a42798797d0 (git)
Linux	Linux	Affected: 3.11 Unaffected: 0 , < 3.11 (semver) Unaffected: 4.4.296 , ≤ 4.4.* (semver) Unaffected: 4.9.294 , ≤ 4.9.* (semver) Unaffected: 4.14.259 , ≤ 4.14.* (semver) Unaffected: 4.19.222 , ≤ 4.19.* (semver) Unaffected: 5.4.167 , ≤ 5.4.* (semver) Unaffected: 5.10.87 , ≤ 5.10.* (semver) Unaffected: 5.15.10 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:40.217Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c54a60c8fbaa774f828e26df79f66229a8a0e010"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/40cf2e058832d9cfaae98dfd77334926275598b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54e785f7d5c197bc06dbb8053700df7e2a093ced"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff3f517bf7138e01a17369042908a3f345c0ee41"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c0315e93552e0d840e9edc6abd71c7db82ec8f51"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dadce61247c6230489527cc5e343b6002d1114c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c986072a8c9249b9398c7a18f216dc26a9f0e35"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f123cffdd8fe8ea6c7fded4b88516a42798797d0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47606",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:12:08.038077Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:51.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/af_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c54a60c8fbaa774f828e26df79f66229a8a0e010",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "40cf2e058832d9cfaae98dfd77334926275598b6",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "54e785f7d5c197bc06dbb8053700df7e2a093ced",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "ff3f517bf7138e01a17369042908a3f345c0ee41",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "c0315e93552e0d840e9edc6abd71c7db82ec8f51",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "dadce61247c6230489527cc5e343b6002d1114c5",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "4c986072a8c9249b9398c7a18f216dc26a9f0e35",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            },
            {
              "lessThan": "f123cffdd8fe8ea6c7fded4b88516a42798797d0",
              "status": "affected",
              "version": "bcbde0d449eda7afa8f63280b165c8300dbd00e2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netlink/af_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.296",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.294",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.259",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.222",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.167",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.87",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.10",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netlink: af_netlink: Prevent empty skb by adding a check on len.\n\nAdding a check on len parameter to avoid empty skb. This prevents a\ndivision error in netem_enqueue function which is caused when skb-\u003elen=0\nand skb-\u003edata_len=0 in the randomized corruption step as shown below.\n\nskb-\u003edata[prandom_u32() % skb_headlen(skb)] ^= 1\u003c\u003c(prandom_u32() % 8);\n\nCrash Report:\n[  343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family\n0 port 6081 - 0\n[  343.216110] netem: version 1.3\n[  343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[  343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+\n[  343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 1.11.0-2.el7 04/01/2014\n[  343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem]\n[  343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff\nff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f\n74 \u003cf7\u003e f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03\n[  343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246\n[  343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX:\n0000000000000000\n[  343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI:\nffff88800f8eda40\n[  343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09:\nffffffff94fb8445\n[  343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12:\n0000000000000000\n[  343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15:\n0000000000000020\n[  343.247291] FS:  00007fdde2bd7700(0000) GS:ffff888109780000(0000)\nknlGS:0000000000000000\n[  343.248350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4:\n00000000000006e0\n[  343.250076] Call Trace:\n[  343.250423]  \u003cTASK\u003e\n[  343.250713]  ? memcpy+0x4d/0x60\n[  343.251162]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.251795]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.252443]  netem_enqueue+0xe28/0x33c0 [sch_netem]\n[  343.253102]  ? stack_trace_save+0x87/0xb0\n[  343.253655]  ? filter_irq_stacks+0xb0/0xb0\n[  343.254220]  ? netem_init+0xa0/0xa0 [sch_netem]\n[  343.254837]  ? __kasan_check_write+0x14/0x20\n[  343.255418]  ? _raw_spin_lock+0x88/0xd6\n[  343.255953]  dev_qdisc_enqueue+0x50/0x180\n[  343.256508]  __dev_queue_xmit+0x1a7e/0x3090\n[  343.257083]  ? netdev_core_pick_tx+0x300/0x300\n[  343.257690]  ? check_kcov_mode+0x10/0x40\n[  343.258219]  ? _raw_spin_unlock_irqrestore+0x29/0x40\n[  343.258899]  ? __kasan_init_slab_obj+0x24/0x30\n[  343.259529]  ? setup_object.isra.71+0x23/0x90\n[  343.260121]  ? new_slab+0x26e/0x4b0\n[  343.260609]  ? kasan_poison+0x3a/0x50\n[  343.261118]  ? kasan_unpoison+0x28/0x50\n[  343.261637]  ? __kasan_slab_alloc+0x71/0x90\n[  343.262214]  ? memcpy+0x4d/0x60\n[  343.262674]  ? write_comp_data+0x2f/0x90\n[  343.263209]  ? __kasan_check_write+0x14/0x20\n[  343.263802]  ? __skb_clone+0x5d6/0x840\n[  343.264329]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.264958]  dev_queue_xmit+0x1c/0x20\n[  343.265470]  netlink_deliver_tap+0x652/0x9c0\n[  343.266067]  netlink_unicast+0x5a0/0x7f0\n[  343.266608]  ? netlink_attachskb+0x860/0x860\n[  343.267183]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.267820]  ? write_comp_data+0x2f/0x90\n[  343.268367]  netlink_sendmsg+0x922/0xe80\n[  343.268899]  ? netlink_unicast+0x7f0/0x7f0\n[  343.269472]  ? __sanitizer_cov_trace_pc+0x21/0x60\n[  343.270099]  ? write_comp_data+0x2f/0x90\n[  343.270644]  ? netlink_unicast+0x7f0/0x7f0\n[  343.271210]  sock_sendmsg+0x155/0x190\n[  343.271721]  ____sys_sendmsg+0x75f/0x8f0\n[  343.272262]  ? kernel_sendmsg+0x60/0x60\n[  343.272788]  ? write_comp_data+0x2f/0x90\n[  343.273332]  ? write_comp_data+0x2f/0x90\n[  343.273869]  ___sys_sendmsg+0x10f/0x190\n[  343.274405]  ? sendmsg_copy_msghdr+0x80/0x80\n[  343.274984]  ? slab_post_alloc_hook+0x70/0x230\n[  343.275597]  ? futex_wait_setup+0x240/0x240\n[  343.276175]  ? security_file_alloc+0x3e/0x170\n[  343.276779]  ? write_comp_d\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:57:47.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c54a60c8fbaa774f828e26df79f66229a8a0e010"
        },
        {
          "url": "https://git.kernel.org/stable/c/40cf2e058832d9cfaae98dfd77334926275598b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/54e785f7d5c197bc06dbb8053700df7e2a093ced"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff3f517bf7138e01a17369042908a3f345c0ee41"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0315e93552e0d840e9edc6abd71c7db82ec8f51"
        },
        {
          "url": "https://git.kernel.org/stable/c/dadce61247c6230489527cc5e343b6002d1114c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c986072a8c9249b9398c7a18f216dc26a9f0e35"
        },
        {
          "url": "https://git.kernel.org/stable/c/f123cffdd8fe8ea6c7fded4b88516a42798797d0"
        }
      ],
      "title": "net: netlink: af_netlink: Prevent empty skb by adding a check on len.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47606",
    "datePublished": "2024-06-19T14:54:05.025Z",
    "dateReserved": "2024-05-24T15:11:00.737Z",
    "dateUpdated": "2026-05-11T13:57:47.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52651 (GCVE-0-2023-52651)

Vulnerability from cvelistv5 – Published: 2024-05-01 12:53 – Updated: 2024-05-02 10:07

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-05-02T10:07:14.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52651",
    "datePublished": "2024-05-01T12:53:15.604Z",
    "dateRejected": "2024-05-02T10:07:14.570Z",
    "dateReserved": "2024-03-06T09:52:12.097Z",
    "dateUpdated": "2024-05-02T10:07:14.570Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.0"
}

CVE-2023-52796 (GCVE-0-2023-52796)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-05-11 19:33

Title

ipvlan: add ipvlan_route_v6_outbound() helper

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-22 19:45 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/4f7f850611aa27aaa…
https://git.kernel.org/stable/c/4d2d30f0792b47908…
https://git.kernel.org/stable/c/43b781e7cb5cd0b43…
https://git.kernel.org/stable/c/1f64cad3ac38ac597…
https://git.kernel.org/stable/c/732a67ca436887b59…
https://git.kernel.org/stable/c/8872dc638c24bb774…
https://git.kernel.org/stable/c/03cddc4df8c6be47f…
https://git.kernel.org/stable/c/18f039428c7df183b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 4f7f850611aa27aaaf1bf5687702ad2240ae442a (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 4d2d30f0792b47908af64c4d02ed1ee25ff50542 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 43b781e7cb5cd0b435de276111953bf2bacd1f02 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 732a67ca436887b594ebc43bb5a04ffb0971a760 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 8872dc638c24bb774cd2224a69d72a7f661a4d56 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 03cddc4df8c6be47fd27c8f8b87e5f9a989e1458 (git) Affected: 2ad7bf3638411cb547f2823df08166c13ab04269 , < 18f039428c7df183b09c69ebf10ffd4e521035d2 (git)
Linux	Linux	Affected: 3.19 Unaffected: 0 , < 3.19 (semver) Unaffected: 4.19.300 , ≤ 4.19.* (semver) Unaffected: 5.4.262 , ≤ 5.4.* (semver) Unaffected: 5.10.202 , ≤ 5.10.* (semver) Unaffected: 5.15.140 , ≤ 5.15.* (semver) Unaffected: 6.1.64 , ≤ 6.1.* (semver) Unaffected: 6.5.13 , ≤ 6.5.* (semver) Unaffected: 6.6.3 , ≤ 6.6.* (semver) Unaffected: 6.7 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52796",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T19:45:36.487225Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:22:52.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.019Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ipvlan/ipvlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4f7f850611aa27aaaf1bf5687702ad2240ae442a",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "4d2d30f0792b47908af64c4d02ed1ee25ff50542",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "43b781e7cb5cd0b435de276111953bf2bacd1f02",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "732a67ca436887b594ebc43bb5a04ffb0971a760",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "8872dc638c24bb774cd2224a69d72a7f661a4d56",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "03cddc4df8c6be47fd27c8f8b87e5f9a989e1458",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            },
            {
              "lessThan": "18f039428c7df183b09c69ebf10ffd4e521035d2",
              "status": "affected",
              "version": "2ad7bf3638411cb547f2823df08166c13ab04269",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ipvlan/ipvlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.300",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.300",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.262",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.202",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.140",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.64",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.13",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvlan: add ipvlan_route_v6_outbound() helper\n\nInspired by syzbot reports using a stack of multiple ipvlan devices.\n\nReduce stack size needed in ipvlan_process_v6_outbound() by moving\nthe flowi6 struct used for the route lookup in an non inlined\nhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,\nimmediately reclaimed.\n\nAlso make sure ipvlan_process_v4_outbound() is not inlined.\n\nWe might also have to lower MAX_NEST_DEV, because only syzbot uses\nsetups with more than four stacked devices.\n\nBUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)\nstack guard page: 0000 [#1] SMP KASAN\nCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\nRIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188\nCode: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 \u003c41\u003e 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89\nRSP: 0018:ffffc9000e804000 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568\nRBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c\nR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000\nFS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003c#DF\u003e\n\u003c/#DF\u003e\n\u003cTASK\u003e\n[\u003cffffffff81f281d1\u003e] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n[\u003cffffffff817e5bf2\u003e] instrument_atomic_read include/linux/instrumented.h:72 [inline]\n[\u003cffffffff817e5bf2\u003e] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n[\u003cffffffff817e5bf2\u003e] cpumask_test_cpu include/linux/cpumask.h:506 [inline]\n[\u003cffffffff817e5bf2\u003e] cpu_online include/linux/cpumask.h:1092 [inline]\n[\u003cffffffff817e5bf2\u003e] trace_lock_acquire include/trace/events/lock.h:24 [inline]\n[\u003cffffffff817e5bf2\u003e] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632\n[\u003cffffffff8563221e\u003e] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306\n[\u003cffffffff8561464d\u003e] rcu_read_lock include/linux/rcupdate.h:747 [inline]\n[\u003cffffffff8561464d\u003e] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221\n[\u003cffffffff85618120\u003e] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606\n[\u003cffffffff856f65b5\u003e] pol_lookup_func include/net/ip6_fib.h:584 [inline]\n[\u003cffffffff856f65b5\u003e] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116\n[\u003cffffffff85618009\u003e] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638\n[\u003cffffffff8561821a\u003e] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651\n[\u003cffffffff838bd5a3\u003e] ip6_route_output include/net/ip6_route.h:100 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n[\u003cffffffff838bd5a3\u003e] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677\n[\u003cffffffff838c2909\u003e] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229\n[\u003cffffffff84d03900\u003e] netdev_start_xmit include/linux/netdevice.h:4966 [inline]\n[\u003cffffffff84d03900\u003e] xmit_one net/core/dev.c:3644 [inline]\n[\u003cffffffff84d03900\u003e] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660\n[\u003cffffffff84d080e2\u003e] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324\n[\u003cffffffff855ce4cd\u003e] dev_queue_xmit include/linux/netdevice.h:3067 [inline]\n[\u003cffffffff855ce4cd\u003e] neigh_hh_output include/net/neighbour.h:529 [inline]\n[\u003cf\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:33:17.912Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542"
        },
        {
          "url": "https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f"
        },
        {
          "url": "https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760"
        },
        {
          "url": "https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56"
        },
        {
          "url": "https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458"
        },
        {
          "url": "https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2"
        }
      ],
      "title": "ipvlan: add ipvlan_route_v6_outbound() helper",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52796",
    "datePublished": "2024-05-21T15:31:10.290Z",
    "dateReserved": "2024-05-21T15:19:24.246Z",
    "dateUpdated": "2026-05-11T19:33:17.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52864 (GCVE-0-2023-52864)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-08-05 09:11

Title

platform/x86: wmi: Fix opening of char device

Summary

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-22 18:21 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/cf098e937dd125c03…
https://git.kernel.org/stable/c/9fb0eed09e1470cd4…
https://git.kernel.org/stable/c/d426a2955e45a95b2…
https://git.kernel.org/stable/c/e0bf076b734a2fab9…
https://git.kernel.org/stable/c/44a96796d25809502…
https://git.kernel.org/stable/c/36d85fa7ae0d6be65…
https://git.kernel.org/stable/c/fb7b06b59c6887659…
https://git.kernel.org/stable/c/eba9ac7abab91c8f6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < cf098e937dd125c0317a0d6f261ac2a950a233d6 (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < 9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203 (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < d426a2955e45a95b2282764105fcfb110a540453 (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < e0bf076b734a2fab92d8fddc2b8b03462eee7097 (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < 44a96796d25809502c75771d40ee693c2e44724e (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < 36d85fa7ae0d6be651c1a745191fa7ef055db43e (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < fb7b06b59c6887659c6ed0ecd3110835eecbb6a3 (git) Affected: 44b6b7661132b1b0e5fd3147ded66f1e4a817ca9 , < eba9ac7abab91c8f6d351460239108bef5e7a0b6 (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 4.19.299 , ≤ 4.19.* (semver) Unaffected: 5.4.261 , ≤ 5.4.* (semver) Unaffected: 5.10.201 , ≤ 5.10.* (semver) Unaffected: 5.15.139 , ≤ 5.15.* (semver) Unaffected: 6.1.63 , ≤ 6.1.* (semver) Unaffected: 6.5.12 , ≤ 6.5.* (semver) Unaffected: 6.6.2 , ≤ 6.6.* (semver) Unaffected: 6.7 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52864",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-22T18:21:10.578430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:24:07.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.054Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf098e937dd125c0317a0d6f261ac2a950a233d6",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "d426a2955e45a95b2282764105fcfb110a540453",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "e0bf076b734a2fab92d8fddc2b8b03462eee7097",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "44a96796d25809502c75771d40ee693c2e44724e",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "36d85fa7ae0d6be651c1a745191fa7ef055db43e",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "fb7b06b59c6887659c6ed0ecd3110835eecbb6a3",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            },
            {
              "lessThan": "eba9ac7abab91c8f6d351460239108bef5e7a0b6",
              "status": "affected",
              "version": "44b6b7661132b1b0e5fd3147ded66f1e4a817ca9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.299",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.299",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.261",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.201",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.139",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.63",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.12",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: wmi: Fix opening of char device\n\nSince commit fa1f68db6ca7 (\"drivers: misc: pass miscdevice pointer via\nfile private data\"), the miscdevice stores a pointer to itself inside\nfilp-\u003eprivate_data, which means that private_data will not be NULL when\nwmi_char_open() is called. This might cause memory corruption should\nwmi_char_open() be unable to find its driver, something which can\nhappen when the associated WMI device is deleted in wmi_free_devices().\n\nFix the problem by using the miscdevice pointer to retrieve the WMI\ndevice data associated with a char device using container_of(). This\nalso avoids wmi_char_open() picking a wrong WMI device bound to a\ndriver with the same name as the original driver."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by opening the local misc char device `/dev/wmi/$driver` (typically `/dev/wmi/dell-smbios`): open \u2192 misc_open \u2192 wmi_char_open. There is no network or adjacent-link path into this platform/x86 WMI code.\nAC:H - Memory corruption requires wmi_char_open() to fail its driver lookup while misc_open still succeeds, which the fix ties to wmi_free_devices() list_del before misc_deregister\u2014i.e. concurrent ACPI/platform WMI removal (e.g. rmmod wmi). An unprivileged attacker can spam open/ioctl but cannot induce that privileged teardown, matching other module-unload races scored AC:H.\nPR:L - The char device is registered with mode 0444, so any local unprivileged user can open it and issue read/ioctl; no init-namespace root or capability is required on the attacker\u2019s side of the race.\nUI:N - The attacker opens and operates on the WMI char device in their own process; no victim action is required. Concurrent administrative device removal is Attack Complexity, not User Interaction.\nS:U - Type confusion / use-after-free stays inside the host kernel\u2019s WMI/misc authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - Failed lookup leaves filp-\u003eprivate_data as a miscdevice* that read/ioctl treat as struct wmi_block, causing out-of-bounds reads of adjacent heap; if the wblock is freed while the fd is held this becomes a UAF disclosure primitive, scored High per kernel guidance.\nI:H - The same type confusion/UAF makes wmi_ioctl() mutex_lock, dereference handler_data, and copy_from_user() through misinterpreted pointers\u2014yielding heap corruption and an arbitrary-write primitive after reclaim, so Integrity is High.\nA:H - Misinterpreting a miscdevice as a wmi_block (or using a freed wblock) reliably leads to invalid memory access, oops/panic, or hang on corrupted locks; any such kernel crash/UAF is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:43.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cf098e937dd125c0317a0d6f261ac2a950a233d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fb0eed09e1470cd4021ff52b2b9dfcbcee4c203"
        },
        {
          "url": "https://git.kernel.org/stable/c/d426a2955e45a95b2282764105fcfb110a540453"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0bf076b734a2fab92d8fddc2b8b03462eee7097"
        },
        {
          "url": "https://git.kernel.org/stable/c/44a96796d25809502c75771d40ee693c2e44724e"
        },
        {
          "url": "https://git.kernel.org/stable/c/36d85fa7ae0d6be651c1a745191fa7ef055db43e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb7b06b59c6887659c6ed0ecd3110835eecbb6a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/eba9ac7abab91c8f6d351460239108bef5e7a0b6"
        }
      ],
      "title": "platform/x86: wmi: Fix opening of char device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52864",
    "datePublished": "2024-05-21T15:31:55.875Z",
    "dateReserved": "2024-05-21T15:19:24.261Z",
    "dateUpdated": "2026-08-05T09:11:43.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-21823 (GCVE-0-2024-21823)

Vulnerability from cvelistv5 – Published: 2024-05-16 20:46 – Updated: 2024-08-14 20:45

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-23 18:02 UTC

CWE

escalation of privilege
CWE-1264 - Hardware Logic with Insecure De-Synchronization between Control and Data Channels
CWE-400 - Uncontrolled Resource Consumption

Assigner

intel mitre root

References

4 references

URL	Tags
https://www.intel.com/content/www/us/en/security-…
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2024/05/15/1
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

1 product

Vendor	Product	Version
n/a	Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors	Affected: See references

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:36.291Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html",
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/05/15/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21823",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T18:02:56.696203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-08T14:39:32.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "escalation of privilege",
              "lang": "en"
            },
            {
              "cweId": "CWE-1264",
              "description": "Hardware Logic with Insecure De-Synchronization between Control and Data Channels",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-14T20:45:24.842Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html",
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01084.html"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/"
        },
        {
          "name": "http://www.openwall.com/lists/oss-security/2024/05/15/1",
          "url": "http://www.openwall.com/lists/oss-security/2024/05/15/1"
        },
        {
          "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DW2MIOIMOFUSNLHLRYX23AFR36BMKD65/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2024-21823",
    "datePublished": "2024-05-16T20:46:57.735Z",
    "dateReserved": "2024-01-24T04:00:22.601Z",
    "dateUpdated": "2024-08-14T20:45:24.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26600 (GCVE-0-2024-26600)

Vulnerability from cvelistv5 – Published: 2024-02-24 14:56 – Updated: 2026-05-11 20:00

Title

phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP

Summary

In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can happen on an idle Ethernet gadget triggering a wakeup for example: configfs-gadget.g1 gadget.0: ECM Suspend configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup ... Unable to handle kernel NULL pointer dereference at virtual address 00000000 when execute ... PC is at 0x0 LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] ... musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 __dev_queue_xmit from arp_solicit+0xf0/0x268 arp_solicit from neigh_probe+0x54/0x7c neigh_probe from __neigh_event_send+0x22c/0x47c __neigh_event_send from neigh_resolve_output+0x14c/0x1c0 neigh_resolve_output from ip_finish_output2+0x1c8/0x628 ip_finish_output2 from ip_send_skb+0x40/0xd8 ip_send_skb from udp_send_skb+0x124/0x340 udp_send_skb from udp_sendmsg+0x780/0x984 udp_sendmsg from __sys_sendto+0xd8/0x158 __sys_sendto from ret_fast_syscall+0x0/0x58 Let's fix the issue by checking for send_srp() and set_vbus() before calling them. For USB peripheral only cases these both could be NULL.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-28 17:03 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/486218c11e8d1c8f5…
https://git.kernel.org/stable/c/8398d8d735ee93a04…
https://git.kernel.org/stable/c/be3b82e4871ba00e9…
https://git.kernel.org/stable/c/8cc889b9dea057972…
https://git.kernel.org/stable/c/0430bfcd46657d911…
https://git.kernel.org/stable/c/14ef61594a5a286ae…
https://git.kernel.org/stable/c/396e17af6761b3cc9…
https://git.kernel.org/stable/c/7104ba0f1958adb25…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 486218c11e8d1c8f515a3bdd70d62203609d4b6b (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 8398d8d735ee93a04fb9e9f490e8cacd737e3bf5 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < be3b82e4871ba00e9b5d0ede92d396d579d7b3b3 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 8cc889b9dea0579726be9520fcc766077890b462 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 0430bfcd46657d9116a26cd377f112cbc40826a4 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 14ef61594a5a286ae0d493b8acbf9eac46fd04c4 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 396e17af6761b3cc9e6e4ca94b4de7f642bfece1 (git) Affected: 657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6 , < 7104ba0f1958adb250319e68a15eff89ec4fd36d (git)
Linux	Linux	Affected: 3.7 Unaffected: 0 , < 3.7 (semver) Unaffected: 4.19.307 , ≤ 4.19.* (semver) Unaffected: 5.4.269 , ≤ 5.4.* (semver) Unaffected: 5.10.210 , ≤ 5.10.* (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.78 , ≤ 6.1.* (semver) Unaffected: 6.6.17 , ≤ 6.6.* (semver) Unaffected: 6.7.5 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T17:03:23.255963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T17:03:34.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/486218c11e8d1c8f515a3bdd70d62203609d4b6b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8398d8d735ee93a04fb9e9f490e8cacd737e3bf5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/be3b82e4871ba00e9b5d0ede92d396d579d7b3b3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8cc889b9dea0579726be9520fcc766077890b462"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0430bfcd46657d9116a26cd377f112cbc40826a4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/14ef61594a5a286ae0d493b8acbf9eac46fd04c4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/396e17af6761b3cc9e6e4ca94b4de7f642bfece1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7104ba0f1958adb250319e68a15eff89ec4fd36d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/ti/phy-omap-usb2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "486218c11e8d1c8f515a3bdd70d62203609d4b6b",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "8398d8d735ee93a04fb9e9f490e8cacd737e3bf5",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "be3b82e4871ba00e9b5d0ede92d396d579d7b3b3",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "8cc889b9dea0579726be9520fcc766077890b462",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "0430bfcd46657d9116a26cd377f112cbc40826a4",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "14ef61594a5a286ae0d493b8acbf9eac46fd04c4",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "396e17af6761b3cc9e6e4ca94b4de7f642bfece1",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            },
            {
              "lessThan": "7104ba0f1958adb250319e68a15eff89ec4fd36d",
              "status": "affected",
              "version": "657b306a7bdfca4ae1514b533a0e7c3c6d26dbc6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/ti/phy-omap-usb2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.78",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.17",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP\n\nIf the external phy working together with phy-omap-usb2 does not implement\nsend_srp(), we may still attempt to call it. This can happen on an idle\nEthernet gadget triggering a wakeup for example:\n\nconfigfs-gadget.g1 gadget.0: ECM Suspend\nconfigfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup\n...\nUnable to handle kernel NULL pointer dereference at virtual address\n00000000 when execute\n...\nPC is at 0x0\nLR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc]\n...\nmusb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core]\nusb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether]\neth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c\ndev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4\nsch_direct_xmit from __dev_queue_xmit+0x334/0xd88\n__dev_queue_xmit from arp_solicit+0xf0/0x268\narp_solicit from neigh_probe+0x54/0x7c\nneigh_probe from __neigh_event_send+0x22c/0x47c\n__neigh_event_send from neigh_resolve_output+0x14c/0x1c0\nneigh_resolve_output from ip_finish_output2+0x1c8/0x628\nip_finish_output2 from ip_send_skb+0x40/0xd8\nip_send_skb from udp_send_skb+0x124/0x340\nudp_send_skb from udp_sendmsg+0x780/0x984\nudp_sendmsg from __sys_sendto+0xd8/0x158\n__sys_sendto from ret_fast_syscall+0x0/0x58\n\nLet\u0027s fix the issue by checking for send_srp() and set_vbus() before\ncalling them. For USB peripheral only cases these both could be NULL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:00:33.641Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/486218c11e8d1c8f515a3bdd70d62203609d4b6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8398d8d735ee93a04fb9e9f490e8cacd737e3bf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/be3b82e4871ba00e9b5d0ede92d396d579d7b3b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cc889b9dea0579726be9520fcc766077890b462"
        },
        {
          "url": "https://git.kernel.org/stable/c/0430bfcd46657d9116a26cd377f112cbc40826a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/14ef61594a5a286ae0d493b8acbf9eac46fd04c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/396e17af6761b3cc9e6e4ca94b4de7f642bfece1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7104ba0f1958adb250319e68a15eff89ec4fd36d"
        }
      ],
      "title": "phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26600",
    "datePublished": "2024-02-24T14:56:55.674Z",
    "dateReserved": "2024-02-19T14:20:24.128Z",
    "dateUpdated": "2026-05-11T20:00:33.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26808 (GCVE-0-2024-26808)

Vulnerability from cvelistv5 – Published: 2024-04-04 09:50 – Updated: 2026-08-05 11:27

Title

netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale reference to netdevice remains in the hook list.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-27 19:35 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/9489e214ea8f2a903…
https://git.kernel.org/stable/c/70f17b48c86622217…
https://git.kernel.org/stable/c/af149a46890e8285d…
https://git.kernel.org/stable/c/e5888acbf1a3d8d02…
https://git.kernel.org/stable/c/36a0a80f322092384…
https://git.kernel.org/stable/c/01acb2e8666a65296…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < 9489e214ea8f2a90345516016aa51f2db3a8cc2f (git) Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < 70f17b48c86622217a58d5099d29242fc9adac58 (git) Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < af149a46890e8285d1618bd68b8d159bdb87fdb3 (git) Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4 (git) Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < 36a0a80f32209238469deb481967d777a3d539ee (git) Affected: 60a3815da702fd9e4759945f26cce5c47d3967ad , < 01acb2e8666a6529697141a6017edbf206921913 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 5.10.210 , ≤ 5.10.* (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.76 , ≤ 6.1.* (semver) Unaffected: 6.6.15 , ≤ 6.6.* (semver) Unaffected: 6.7.3 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.575Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T19:35:33.665875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T19:36:03.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_chain_filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9489e214ea8f2a90345516016aa51f2db3a8cc2f",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            },
            {
              "lessThan": "70f17b48c86622217a58d5099d29242fc9adac58",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            },
            {
              "lessThan": "af149a46890e8285d1618bd68b8d159bdb87fdb3",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            },
            {
              "lessThan": "e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            },
            {
              "lessThan": "36a0a80f32209238469deb481967d777a3d539ee",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            },
            {
              "lessThan": "01acb2e8666a6529697141a6017edbf206921913",
              "status": "affected",
              "version": "60a3815da702fd9e4759945f26cce5c47d3967ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_chain_filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain\n\nRemove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER\nevent is reported, otherwise a stale reference to netdevice remains in\nthe hook list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the NETLINK_NETFILTER socket interface (nftables configuration) plus local netdevice operations; it is not exposed to remote packet processing.\nAC:L - The attacker fully controls every step \u2014 creating the inet ingress base chain, binding it to a device, and unregistering that device \u2014 so the stale reference is created deterministically with no race or uncontrolled precondition.\nPR:L - Configuring nft chains requires CAP_NET_ADMIN, but this is obtainable by an unprivileged user in a new network namespace via unshare -Urn, so only low privileges are truly needed.\nUI:N - The entire sequence is driven by the attacker\u0027s own syscalls; no action by any other user is required.\nS:U - The use-after-free occurs within kernel memory in the same security authority; it does not cross a virtualization or IOMMU boundary.\nC:H - The dangling net_device reference enables reads of freed heap memory (e.g. hook-\u003eops.dev-\u003ename is leaked to userspace during chain dump), which with heap grooming yields sensitive kernel data disclosure.\nI:H - The use-after-free leaves the freed net_device reclaimable and later written through (nf_unregister_net_hook updates dev-\u003enf_hooks_ingress), giving a controllable write primitive that can be leveraged for privilege escalation.\nA:H - Dereferencing the stale, freed net_device reliably triggers a use-after-free that oopses/panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:26.994Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9489e214ea8f2a90345516016aa51f2db3a8cc2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/70f17b48c86622217a58d5099d29242fc9adac58"
        },
        {
          "url": "https://git.kernel.org/stable/c/af149a46890e8285d1618bd68b8d159bdb87fdb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5888acbf1a3d8d021990ce6c6061fd5b2bb21b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a0a80f32209238469deb481967d777a3d539ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/01acb2e8666a6529697141a6017edbf206921913"
        }
      ],
      "title": "netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26808",
    "datePublished": "2024-04-04T09:50:26.672Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2026-08-05T11:27:26.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26828 (GCVE-0-2024-26828)

Vulnerability from cvelistv5 – Published: 2024-04-17 09:43 – Updated: 2026-08-05 11:27

Title

cifs: fix underflow in parse_server_interfaces()

Summary

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

6.7 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-12 17:36 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/7190353835b4a219a…
https://git.kernel.org/stable/c/f7ff1c89fb6e9610d…
https://git.kernel.org/stable/c/df2af9fdbc4ddde18…
https://git.kernel.org/stable/c/cffe487026be13eaf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fe856be475f7cf5ffcde57341d175ce9fd09434b , < 7190353835b4a219abb70f90b06cdcae97f11512 (git) Affected: fe856be475f7cf5ffcde57341d175ce9fd09434b , < f7ff1c89fb6e9610d2b01c1821727729e6609308 (git) Affected: fe856be475f7cf5ffcde57341d175ce9fd09434b , < df2af9fdbc4ddde18a3371c4ca1a86596e8be301 (git) Affected: fe856be475f7cf5ffcde57341d175ce9fd09434b , < cffe487026be13eaf37ea28b783d9638ab147204 (git)
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26828",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:36:16.490979Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-04T18:28:47.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7190353835b4a219abb70f90b06cdcae97f11512",
              "status": "affected",
              "version": "fe856be475f7cf5ffcde57341d175ce9fd09434b",
              "versionType": "git"
            },
            {
              "lessThan": "f7ff1c89fb6e9610d2b01c1821727729e6609308",
              "status": "affected",
              "version": "fe856be475f7cf5ffcde57341d175ce9fd09434b",
              "versionType": "git"
            },
            {
              "lessThan": "df2af9fdbc4ddde18a3371c4ca1a86596e8be301",
              "status": "affected",
              "version": "fe856be475f7cf5ffcde57341d175ce9fd09434b",
              "versionType": "git"
            },
            {
              "lessThan": "cffe487026be13eaf37ea28b783d9638ab147204",
              "status": "affected",
              "version": "fe856be475f7cf5ffcde57341d175ce9fd09434b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix underflow in parse_server_interfaces()\n\nIn this loop, we step through the buffer and after each item we check\nif the size_left is greater than the minimum size we need.  However,\nthe problem is that \"bytes_left\" is type ssize_t while sizeof() is type\nsize_t.  That means that because of type promotion, the comparison is\ndone as an unsigned and if we have negative bytes left the loop\ncontinues instead of ending."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable parser consumes an SMB2 IOCTL response body received over TCP/445 from the remote SMB server, so a malicious or compromised server (or a MITM on an unsigned connection) triggers it purely with network data. No local access to the victim is required.\nAC:L - The server controls both the response length and every `Next` field, so making `bytes_left` underflow is a single deterministic value choice (e.g. buf_len=152, Next=160) with no race, timing, or memory-layout condition outside the attacker\u0027s control.\nPR:N - The attacker is the server side of the connection and needs no credentials or privileges on the victim host; it simply answers the client\u0027s own FSCTL_QUERY_NETWORK_INTERFACE_INFO request with a crafted reply.\nUI:N - Beyond the mount path, `smb2_query_server_interfaces()` re-issues the query from a self-re-arming cifsiod delayed work every 600 seconds, and `smb2_reconnect()` issues it on every tcon reconnect, so an already-mounted share is attacked with zero user action.\nS:U - The out-of-bounds read and the resulting crash are entirely within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop walks arbitrary kernel memory at an attacker-chosen stride and stores the OOB bytes as interface speeds and IPv4/IPv6 addresses in `ses-\u003eiface_list`, which is printed verbatim to world-readable `/proc/fs/cifs/DebugData` and used as multichannel connect targets \u2014 an unbounded, repeatable kernel heap disclosure primitive.\nI:L - There is no out-of-bounds write, but garbage harvested from unrelated kernel heap memory is installed as the session\u0027s authoritative interface list and drives which addresses the client opens additional SMB channels to, a limited unauthorized modification of client connection state.\nA:H - With `Next` up to 4 GiB the pointer walk dereferences unmapped memory and oopses the kernel, and the loop can only exit when an OOB `Next` is zero, additionally causing unbounded `iface_list`/`iface_count` growth from a workqueue context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:41.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7190353835b4a219abb70f90b06cdcae97f11512"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7ff1c89fb6e9610d2b01c1821727729e6609308"
        },
        {
          "url": "https://git.kernel.org/stable/c/df2af9fdbc4ddde18a3371c4ca1a86596e8be301"
        },
        {
          "url": "https://git.kernel.org/stable/c/cffe487026be13eaf37ea28b783d9638ab147204"
        }
      ],
      "title": "cifs: fix underflow in parse_server_interfaces()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26828",
    "datePublished": "2024-04-17T09:43:52.995Z",
    "dateReserved": "2024-02-19T14:20:24.181Z",
    "dateUpdated": "2026-08-05T11:27:41.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26853 (GCVE-0-2024-26853)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:17 – Updated: 2026-08-05 11:27

Title

igc: avoid returning frame twice in XDP_REDIRECT

Summary

In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi. However, this is the responsibility of the caller of the ndo_xdp_xmit (see for example bq_xmit_all in kernel/bpf/devmap.c) and thus calling it inside igc_xdp_xmit (which is the ndo_xdp_xmit of the igc driver) as well will lead to memory corruption. In fact, bq_xmit_all expects that it can return all frames after the last successfully transmitted one. Therefore, break for the first not transmitted frame, but do not call xdp_return_frame_rx_napi in igc_xdp_xmit. This is equally implemented in other Intel drivers such as the igb. There are two alternatives to this that were rejected: 1. Return num_frames as all the frames would have been transmitted and release them inside igc_xdp_xmit. While it might work technically, it is not what the return value is meant to represent (i.e. the number of SUCCESSFULLY transmitted packets). 2. Rework kernel/bpf/devmap.c and all drivers to support non-consecutively dropped packets. Besides being complex, it likely has a negative performance impact without a significant gain since it is anyway unlikely that the next frame can be transmitted if the previous one was dropped. The memory corruption can be reproduced with the following script which leads to a kernel panic after a few seconds. It basically generates more traffic than a i225 NIC can transmit and pushes it via XDP_REDIRECT from a virtual interface to the physical interface where frames get dropped. #!/bin/bash INTERFACE=enp4s0 INTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex` sudo ip link add dev veth1 type veth peer name veth2 sudo ip link set up $INTERFACE sudo ip link set up veth1 sudo ip link set up veth2 cat << EOF > redirect.bpf.c SEC("prog") int redirect(struct xdp_md *ctx) { return bpf_redirect($INTERFACE_IDX, 0); } char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o sudo ip link set veth2 xdp obj redirect.bpf.o cat << EOF > pass.bpf.c SEC("prog") int pass(struct xdp_md *ctx) { return XDP_PASS; } char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o sudo ip link set $INTERFACE xdp obj pass.bpf.o cat << EOF > trafgen.cfg { /* Ethernet Header */ 0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, const16(ETH_P_IP), /* IPv4 Header */ 0b01000101, 0, # IPv4 version, IHL, TOS const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) const16(2), # IPv4 ident 0b01000000, 0, # IPv4 flags, fragmentation off 64, # IPv4 TTL 17, # Protocol UDP csumip(14, 33), # IPv4 checksum /* UDP Header */ 10, 0, 1, 1, # IP Src - adapt as needed 10, 0, 1, 2, # IP Dest - adapt as needed const16(6666), # UDP Src Port const16(6666), # UDP Dest Port const16(1008), # UDP length (UDP header 8 bytes + payload length) csumudp(14, 34), # UDP checksum /* Payload */ fill('W', 1000), } EOF sudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:48 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/63a3c1f3c9ecc654d…
https://git.kernel.org/stable/c/8df393af9e7e8dfd6…
https://git.kernel.org/stable/c/1b3b8231386a572ba…
https://git.kernel.org/stable/c/ef27f655b438bed4c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4ff3203610928cac82d5627ce803559e78d61b91 , < 63a3c1f3c9ecc654d851e7906d05334cd0c236e2 (git) Affected: 4ff3203610928cac82d5627ce803559e78d61b91 , < 8df393af9e7e8dfd62e9c41dbaa4d2ff53bf794a (git) Affected: 4ff3203610928cac82d5627ce803559e78d61b91 , < 1b3b8231386a572bac8cd5b6fd7e944b84f9bb1f (git) Affected: 4ff3203610928cac82d5627ce803559e78d61b91 , < ef27f655b438bed4c83680e4f01e1cde2739854b (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 6.1.82 , ≤ 6.1.* (semver) Unaffected: 6.6.22 , ≤ 6.6.* (semver) Unaffected: 6.7.10 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.713Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/63a3c1f3c9ecc654d851e7906d05334cd0c236e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8df393af9e7e8dfd62e9c41dbaa4d2ff53bf794a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1b3b8231386a572bac8cd5b6fd7e944b84f9bb1f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ef27f655b438bed4c83680e4f01e1cde2739854b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:48:38.543081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:27.256Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63a3c1f3c9ecc654d851e7906d05334cd0c236e2",
              "status": "affected",
              "version": "4ff3203610928cac82d5627ce803559e78d61b91",
              "versionType": "git"
            },
            {
              "lessThan": "8df393af9e7e8dfd62e9c41dbaa4d2ff53bf794a",
              "status": "affected",
              "version": "4ff3203610928cac82d5627ce803559e78d61b91",
              "versionType": "git"
            },
            {
              "lessThan": "1b3b8231386a572bac8cd5b6fd7e944b84f9bb1f",
              "status": "affected",
              "version": "4ff3203610928cac82d5627ce803559e78d61b91",
              "versionType": "git"
            },
            {
              "lessThan": "ef27f655b438bed4c83680e4f01e1cde2739854b",
              "status": "affected",
              "version": "4ff3203610928cac82d5627ce803559e78d61b91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/igc/igc_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.10",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nigc: avoid returning frame twice in XDP_REDIRECT\n\nWhen a frame can not be transmitted in XDP_REDIRECT\n(e.g. due to a full queue), it is necessary to free\nit by calling xdp_return_frame_rx_napi.\n\nHowever, this is the responsibility of the caller of\nthe ndo_xdp_xmit (see for example bq_xmit_all in\nkernel/bpf/devmap.c) and thus calling it inside\nigc_xdp_xmit (which is the ndo_xdp_xmit of the igc\ndriver) as well will lead to memory corruption.\n\nIn fact, bq_xmit_all expects that it can return all\nframes after the last successfully transmitted one.\nTherefore, break for the first not transmitted frame,\nbut do not call xdp_return_frame_rx_napi in igc_xdp_xmit.\nThis is equally implemented in other Intel drivers\nsuch as the igb.\n\nThere are two alternatives to this that were rejected:\n1. Return num_frames as all the frames would have been\n   transmitted and release them inside igc_xdp_xmit.\n   While it might work technically, it is not what\n   the return value is meant to represent (i.e. the\n   number of SUCCESSFULLY transmitted packets).\n2. Rework kernel/bpf/devmap.c and all drivers to\n   support non-consecutively dropped packets.\n   Besides being complex, it likely has a negative\n   performance impact without a significant gain\n   since it is anyway unlikely that the next frame\n   can be transmitted if the previous one was dropped.\n\nThe memory corruption can be reproduced with\nthe following script which leads to a kernel panic\nafter a few seconds.  It basically generates more\ntraffic than a i225 NIC can transmit and pushes it\nvia XDP_REDIRECT from a virtual interface to the\nphysical interface where frames get dropped.\n\n   #!/bin/bash\n   INTERFACE=enp4s0\n   INTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex`\n\n   sudo ip link add dev veth1 type veth peer name veth2\n   sudo ip link set up $INTERFACE\n   sudo ip link set up veth1\n   sudo ip link set up veth2\n\n   cat \u003c\u003c EOF \u003e redirect.bpf.c\n\n   SEC(\"prog\")\n   int redirect(struct xdp_md *ctx)\n   {\n       return bpf_redirect($INTERFACE_IDX, 0);\n   }\n\n   char _license[] SEC(\"license\") = \"GPL\";\n   EOF\n   clang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o\n   sudo ip link set veth2 xdp obj redirect.bpf.o\n\n   cat \u003c\u003c EOF \u003e pass.bpf.c\n\n   SEC(\"prog\")\n   int pass(struct xdp_md *ctx)\n   {\n       return XDP_PASS;\n   }\n\n   char _license[] SEC(\"license\") = \"GPL\";\n   EOF\n   clang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o\n   sudo ip link set $INTERFACE xdp obj pass.bpf.o\n\n   cat \u003c\u003c EOF \u003e trafgen.cfg\n\n   {\n     /* Ethernet Header */\n     0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46,\n     0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,\n     const16(ETH_P_IP),\n\n     /* IPv4 Header */\n     0b01000101, 0,   # IPv4 version, IHL, TOS\n     const16(1028),   # IPv4 total length (UDP length + 20 bytes (IP header))\n     const16(2),      # IPv4 ident\n     0b01000000, 0,   # IPv4 flags, fragmentation off\n     64,              # IPv4 TTL\n     17,              # Protocol UDP\n     csumip(14, 33),  # IPv4 checksum\n\n     /* UDP Header */\n     10,  0, 1, 1,    # IP Src - adapt as needed\n     10,  0, 1, 2,    # IP Dest - adapt as needed\n     const16(6666),   # UDP Src Port\n     const16(6666),   # UDP Dest Port\n     const16(1008),   # UDP length (UDP header 8 bytes + payload length)\n     csumudp(14, 34), # UDP checksum\n\n     /* Payload */\n     fill(\u0027W\u0027, 1000),\n   }\n   EOF\n\n   sudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The condition that triggers the bug is a full igc TX ring, which is driven purely by the rate of packets being XDP-redirected to the interface; in an XDP forwarding/load-balancer deployment those packets arrive from arbitrary remote senders across routed networks, so no local or adjacent access is needed.\nAC:L - The attacker fully controls the trigger by offering traffic faster than the 2.5G NIC can transmit, causing `igc_maybe_stop_tx()` to return -EBUSY deterministically; the fix commit\u0027s own reproducer panics the kernel within seconds, with no attacker-uncontrollable precondition.\nPR:N - Once the XDP redirect path is configured (the intended, supported use of the driver), the corruption is reached purely by sending network packets \u2014 the attacker needs no account, credential, or privilege on the target.\nUI:N - The double free occurs in the NAPI/XDP receive-and-redirect path with no victim action required; the redirect and TX-full condition are driven entirely by inbound traffic.\nS:U - The freed buffers, page-pool state and TX descriptor ring all live within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Double-freeing into the page pool / buddy allocator makes one page simultaneously owned by two consumers, so a buffer reallocated for another kernel object can be read back out over the network, and the NIC continues DMAing from pages already handed to other users \u2014 a use-after-free read primitive over kernel memory.\nI:H - The NIC DMAs attacker-supplied packet bytes into pages that have been freed and reallocated for arbitrary kernel objects, and the page-pool refcount/ring corruption is a classic heap-grooming primitive; the commit itself describes the result as \"memory corruption.\"\nA:H - The maintainer\u0027s reproducer produces a kernel panic within seconds of sustained traffic, and any double free of page-pool buffers reliably crashes the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:49.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63a3c1f3c9ecc654d851e7906d05334cd0c236e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df393af9e7e8dfd62e9c41dbaa4d2ff53bf794a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b3b8231386a572bac8cd5b6fd7e944b84f9bb1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef27f655b438bed4c83680e4f01e1cde2739854b"
        }
      ],
      "title": "igc: avoid returning frame twice in XDP_REDIRECT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26853",
    "datePublished": "2024-04-17T10:17:16.571Z",
    "dateReserved": "2024-02-19T14:20:24.183Z",
    "dateUpdated": "2026-08-05T11:27:49.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26868 (GCVE-0-2024-26868)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-08-05 11:27

Title

nfs: fix panic when nfs4_ff_layout_prepare_ds() fails

Summary

In the Linux kernel, the following vulnerability has been resolved: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails We've been seeing the following panic in production BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0 RIP: 0010:ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles] Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x286/0x380 ? __rpc_execute+0x2c3/0x470 [sunrpc] ? rpc_new_task+0x42/0x1c0 [sunrpc] ? exc_page_fault+0x5d/0x110 ? asm_exc_page_fault+0x22/0x30 ? ff_layout_free_layoutreturn+0x110/0x110 [nfs_layout_flexfiles] ? ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles] ? ff_layout_cancel_io+0x6f/0x90 [nfs_layout_flexfiles] pnfs_mark_matching_lsegs_return+0x1b0/0x360 [nfsv4] pnfs_error_mark_layout_for_return+0x9e/0x110 [nfsv4] ? ff_layout_send_layouterror+0x50/0x160 [nfs_layout_flexfiles] nfs4_ff_layout_prepare_ds+0x11f/0x290 [nfs_layout_flexfiles] ff_layout_pg_init_write+0xf0/0x1f0 [nfs_layout_flexfiles] __nfs_pageio_add_request+0x154/0x6c0 [nfs] nfs_pageio_add_request+0x26b/0x380 [nfs] nfs_do_writepage+0x111/0x1e0 [nfs] nfs_writepages_callback+0xf/0x30 [nfs] write_cache_pages+0x17f/0x380 ? nfs_pageio_init_write+0x50/0x50 [nfs] ? nfs_writepages+0x6d/0x210 [nfs] ? nfs_writepages+0x6d/0x210 [nfs] nfs_writepages+0x125/0x210 [nfs] do_writepages+0x67/0x220 ? generic_perform_write+0x14b/0x210 filemap_fdatawrite_wbc+0x5b/0x80 file_write_and_wait_range+0x6d/0xc0 nfs_file_fsync+0x81/0x170 [nfs] ? nfs_file_mmap+0x60/0x60 [nfs] __x64_sys_fsync+0x53/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Inspecting the core with drgn I was able to pull this >>> prog.crashed_thread().stack_trace()[0] #0 at 0xffffffffa079657a (ff_layout_cancel_io+0x3a/0x84) in ff_layout_cancel_io at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27 >>> prog.crashed_thread().stack_trace()[0]['idx'] (u32)1 >>> prog.crashed_thread().stack_trace()[0]['flseg'].mirror_array[1].mirror_ds (struct nfs4_ff_layout_ds *)0xffffffffffffffed This is clear from the stack trace, we call nfs4_ff_layout_prepare_ds() which could error out initializing the mirror_ds, and then we go to clean it all up and our check is only for if (!mirror->mirror_ds). This is inconsistent with the rest of the users of mirror_ds, which have if (IS_ERR_OR_NULL(mirror_ds)) to keep from tripping over this exact scenario. Fix this up in ff_layout_cancel_io() to make sure we don't panic when we get an error. I also spot checked all the other instances of checking mirror_ds and we appear to be doing the correct checks everywhere, only unconditionally dereferencing mirror_ds when we know it would be valid.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-28 19:56 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/31db25e3141b20e2a…
https://git.kernel.org/stable/c/7ca651b4ec4a049f5…
https://git.kernel.org/stable/c/5ada9016b1217498f…
https://git.kernel.org/stable/c/dac068f164ad05b35…
https://git.kernel.org/stable/c/719fcafe07c126466…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b739a5bd9d9f18cc69dced8db128ef7206e000cd , < 31db25e3141b20e2a76a9f219eeca52e3cab126c (git) Affected: b739a5bd9d9f18cc69dced8db128ef7206e000cd , < 7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5 (git) Affected: b739a5bd9d9f18cc69dced8db128ef7206e000cd , < 5ada9016b1217498fad876a3d5b07645cc955608 (git) Affected: b739a5bd9d9f18cc69dced8db128ef7206e000cd , < dac068f164ad05b35e7c0be13f138c3f6adca58f (git) Affected: b739a5bd9d9f18cc69dced8db128ef7206e000cd , < 719fcafe07c12646691bd62d7f8d94d657fa0766 (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.83 , ≤ 6.1.* (semver) Unaffected: 6.6.23 , ≤ 6.6.* (semver) Unaffected: 6.7.11 , ≤ 6.7.* (semver) Unaffected: 6.8.2 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:56:48.883135Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:27.644Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:04.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31db25e3141b20e2a76a9f219eeca52e3cab126c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ada9016b1217498fad876a3d5b07645cc955608"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dac068f164ad05b35e7c0be13f138c3f6adca58f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/719fcafe07c12646691bd62d7f8d94d657fa0766"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31db25e3141b20e2a76a9f219eeca52e3cab126c",
              "status": "affected",
              "version": "b739a5bd9d9f18cc69dced8db128ef7206e000cd",
              "versionType": "git"
            },
            {
              "lessThan": "7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5",
              "status": "affected",
              "version": "b739a5bd9d9f18cc69dced8db128ef7206e000cd",
              "versionType": "git"
            },
            {
              "lessThan": "5ada9016b1217498fad876a3d5b07645cc955608",
              "status": "affected",
              "version": "b739a5bd9d9f18cc69dced8db128ef7206e000cd",
              "versionType": "git"
            },
            {
              "lessThan": "dac068f164ad05b35e7c0be13f138c3f6adca58f",
              "status": "affected",
              "version": "b739a5bd9d9f18cc69dced8db128ef7206e000cd",
              "versionType": "git"
            },
            {
              "lessThan": "719fcafe07c12646691bd62d7f8d94d657fa0766",
              "status": "affected",
              "version": "b739a5bd9d9f18cc69dced8db128ef7206e000cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayout.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: fix panic when nfs4_ff_layout_prepare_ds() fails\n\nWe\u0027ve been seeing the following panic in production\n\nBUG: kernel NULL pointer dereference, address: 0000000000000065\nPGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0\nRIP: 0010:ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles]\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x78/0xc0\n ? page_fault_oops+0x286/0x380\n ? __rpc_execute+0x2c3/0x470 [sunrpc]\n ? rpc_new_task+0x42/0x1c0 [sunrpc]\n ? exc_page_fault+0x5d/0x110\n ? asm_exc_page_fault+0x22/0x30\n ? ff_layout_free_layoutreturn+0x110/0x110 [nfs_layout_flexfiles]\n ? ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles]\n ? ff_layout_cancel_io+0x6f/0x90 [nfs_layout_flexfiles]\n pnfs_mark_matching_lsegs_return+0x1b0/0x360 [nfsv4]\n pnfs_error_mark_layout_for_return+0x9e/0x110 [nfsv4]\n ? ff_layout_send_layouterror+0x50/0x160 [nfs_layout_flexfiles]\n nfs4_ff_layout_prepare_ds+0x11f/0x290 [nfs_layout_flexfiles]\n ff_layout_pg_init_write+0xf0/0x1f0 [nfs_layout_flexfiles]\n __nfs_pageio_add_request+0x154/0x6c0 [nfs]\n nfs_pageio_add_request+0x26b/0x380 [nfs]\n nfs_do_writepage+0x111/0x1e0 [nfs]\n nfs_writepages_callback+0xf/0x30 [nfs]\n write_cache_pages+0x17f/0x380\n ? nfs_pageio_init_write+0x50/0x50 [nfs]\n ? nfs_writepages+0x6d/0x210 [nfs]\n ? nfs_writepages+0x6d/0x210 [nfs]\n nfs_writepages+0x125/0x210 [nfs]\n do_writepages+0x67/0x220\n ? generic_perform_write+0x14b/0x210\n filemap_fdatawrite_wbc+0x5b/0x80\n file_write_and_wait_range+0x6d/0xc0\n nfs_file_fsync+0x81/0x170 [nfs]\n ? nfs_file_mmap+0x60/0x60 [nfs]\n __x64_sys_fsync+0x53/0x90\n do_syscall_64+0x3d/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nInspecting the core with drgn I was able to pull this\n\n  \u003e\u003e\u003e prog.crashed_thread().stack_trace()[0]\n  #0 at 0xffffffffa079657a (ff_layout_cancel_io+0x3a/0x84) in ff_layout_cancel_io at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27\n  \u003e\u003e\u003e prog.crashed_thread().stack_trace()[0][\u0027idx\u0027]\n  (u32)1\n  \u003e\u003e\u003e prog.crashed_thread().stack_trace()[0][\u0027flseg\u0027].mirror_array[1].mirror_ds\n  (struct nfs4_ff_layout_ds *)0xffffffffffffffed\n\nThis is clear from the stack trace, we call nfs4_ff_layout_prepare_ds()\nwhich could error out initializing the mirror_ds, and then we go to\nclean it all up and our check is only for if (!mirror-\u003emirror_ds).  This\nis inconsistent with the rest of the users of mirror_ds, which have\n\n  if (IS_ERR_OR_NULL(mirror_ds))\n\nto keep from tripping over this exact scenario.  Fix this up in\nff_layout_cancel_io() to make sure we don\u0027t panic when we get an error.\nI also spot checked all the other instances of checking mirror_ds and we\nappear to be doing the correct checks everywhere, only unconditionally\ndereferencing mirror_ds when we know it would be valid."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code path is driven entirely by data from the remote NFS server \u2014 a malicious, compromised, or spoofed NFSv4.1/4.2 server forces GETDEVICEINFO to fail (error reply, malformed XDR, or no usable DS addresses), which is what plants the ERR_PTR that is later dereferenced. The NFS client processes this attacker-controlled protocol data over the network with no locality restriction.\nAC:L - The server-side attacker fully and deterministically controls the trigger: grant a flexfiles layout, then fail the GETDEVICEINFO for one of its device IDs, and the very next write/fsync on that inode panics the client. No race, no memory-layout grooming, and the flexfiles layout driver is present in default distro NFSv4.1 configurations.\nPR:N - The attacker acts as the NFS server (or an RPC-reply injector on the path) and needs no credentials or account on the victim client. Even in the purely local framing, any unprivileged user with write access to a file on the mount reaches nfs_writepages()\u2192ff_layout_pg_init_write(), so no elevated privileges are required in any scenario.\nUI:N - No victim action is needed at exploit time \u2014 the mount is pre-existing infrastructure, and normal background writeback or any application fsync() drives the path automatically. A compromised server can simply wait for routine client I/O.\nS:U - The fault occurs in the NFS client within the kernel\u0027s own security authority; nothing crosses into another VM, hypervisor, or IOMMU/DMA boundary.\nC:N - The dereferenced value can only ever be ERR_PTR(-ENODEV), producing a fixed low address (0x65) below mmap_min_addr that faults immediately. No attacker data is read back and no kernel memory is disclosed.\nI:N - The bug is a read of an invalid fixed pointer with no write to kernel memory and no attacker influence over the faulting address, so there is no data modification or control-flow hijack primitive.\nA:H - The result is an unrecoverable kernel NULL-pointer dereference oops in writeback context (as captured in the production panic in the fix commit), taking down the client system. It can be re-triggered at will by the remote server, so affected clients can be kept permanently down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:55.702Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31db25e3141b20e2a76a9f219eeca52e3cab126c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ca651b4ec4a049f5a46a0e5ff921b86b91c47c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ada9016b1217498fad876a3d5b07645cc955608"
        },
        {
          "url": "https://git.kernel.org/stable/c/dac068f164ad05b35e7c0be13f138c3f6adca58f"
        },
        {
          "url": "https://git.kernel.org/stable/c/719fcafe07c12646691bd62d7f8d94d657fa0766"
        }
      ],
      "title": "nfs: fix panic when nfs4_ff_layout_prepare_ds() fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26868",
    "datePublished": "2024-04-17T10:27:29.431Z",
    "dateReserved": "2024-02-19T14:20:24.184Z",
    "dateUpdated": "2026-08-05T11:27:55.702Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2024:5363

CVE-2021-47606 (GCVE-0-2021-47606)

CVE-2023-52651 (GCVE-0-2023-52651)

CVE-2023-52796 (GCVE-0-2023-52796)

CVE-2023-52864 (GCVE-0-2023-52864)

CVE-2024-21823 (GCVE-0-2024-21823)

CVE-2024-26600 (GCVE-0-2024-26600)

CVE-2024-26808 (GCVE-0-2024-26808)

CVE-2024-26828 (GCVE-0-2024-26828)

CVE-2024-26853 (GCVE-0-2024-26853)

CVE-2024-26868 (GCVE-0-2024-26868)

Tags

Sightings

Nomenclature