Vulnerability-Lookup

RHSA-2024:6997

Vulnerability from csaf_redhat - Published: 2024-09-24 03:05 - Updated: 2026-08-19 17:33

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: uio: Fix use-after-free in uio_open (CVE-2023-52439) * kernel: net/sched: act_mirred: don't override retval if we already lost the skb (CVE-2024-26739) * kernel: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (CVE-2024-26947) * kernel: scsi: qla2xxx: Fix command flush on cable pull (CVE-2024-26931) * kernel: scsi: qla2xxx: Fix double free of the ha->vp_map pointer (CVE-2024-26930) * kernel: scsi: qla2xxx: Fix double free of fcport (CVE-2024-26929) * kernel: fork: defer linking file vma until vma is fully initialized (CVE-2024-27022) * kernel: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes (CVE-2024-26991) * kernel: bpf, sockmap: Prevent lock inversion deadlock in map delete elem (CVE-2024-35895) * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) * kernel: gpiolib: cdev: Fix use after free in lineinfo_changed_notify (CVE-2024-36899) * kernel: cpufreq: exit() callback is optional (CVE-2024-38615) * kernel: ring-buffer: Fix a race between readers and resize checks (CVE-2024-38601) * kernel: cppc_cpufreq: Fix possible null pointer dereference (CVE-2024-38573) * kernel: gfs2: Fix potential glock use-after-free on unmount (CVE-2024-38570) * kernel: wifi: nl80211: Avoid address calculations via out of bounds array indexing (CVE-2024-38562) * kernel: Input: cyapa - add missing input core locking to suspend/resume functions (CVE-2023-52884) * kernel: ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CVE-2024-40984) * kernel: wifi: mac80211: Avoid address calculations via out of bounds array indexing (CVE-2024-41071) * kernel: wifi: mt76: replace skb_put with skb_put_zero (CVE-2024-42225) * kernel: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CVE-2024-42246) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-52439

A flaw was found in the Linux kernel’s uio subsystem. A use-after-free memory flaw in the uio_open functionality allows a local user to crash or escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-427.37.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.37.1.el9_4.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-427.37.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-kvm-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.37.1.el9_4.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2023-52884

In the Linux kernel, the following vulnerability has been resolved: Input: cyapa - add missing input core locking to suspend/resume functions Grab input->mutex during suspend/resume functions like it is done in other input drivers. This fixes the following warning during system suspend/resume cycle on Samsung Exynos5250-based Snow Chromebook: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298 dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]--- ... ------------[ cut here ]------------ WARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c Modules linked in: ... CPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G W 6.6.0-rc5-next-20231009 #14109 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound async_run_entry_fn unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x58/0x70 dump_stack_lvl from __warn+0x1a8/0x1cc __warn from warn_slowpath_fmt+0x18c/0x1b4 warn_slowpath_fmt from input_device_enabled+0x68/0x6c input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c cyapa_reinitialize from cyapa_resume+0x48/0x98 cyapa_resume from dpm_run_callback+0x90/0x298 dpm_run_callback from device_resume+0xb4/0x258 device_resume from async_resume+0x20/0x64 async_resume from async_run_entry_fn+0x40/0x15c async_run_entry_fn from process_scheduled_works+0xbc/0x6a8 process_scheduled_works from worker_thread+0x188/0x454 worker_thread from kthread+0x108/0x140 kthread from ret_from_fork+0x14/0x28 Exception stack(0xf1625fb0 to 0xf1625ff8) ... ---[ end trace 0000000000000000 ]---

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-667 - Improper Locking

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Low

CVE-2024-26739

A use-after-free flaw was found in net/sched/act_mirred.c in the Linux kernel. This may result in a crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-26929

No description is available for this CVE.

CWE-415 - Double Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

CVE-2024-26930

A vulnerability was found in the Linux kernel. A potential double-free in the pointer ha->vp_map exists in the Linux kernel in drivers/scsi/qla2xxx/qla_os.c.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-763 - Release of Invalid Pointer or Reference

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-26931

A flaw was found in the qla2xxx module in the Linux kernel. A NULL pointer dereference can be triggered when the system is under memory stress and the driver cannot allocate memory to handle the error recovery of cable pull, causing a system crash and a denial of service.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-26947

A flaw was found in the Linux kernel’s ARM memory management functionality, where certain memory layouts cause a kernel panic. This flaw allows an attacker who can specify or alter memory layouts to cause a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-439 - Behavioral Change in New Version or Environment

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-26991

A flaw was found in the Linux Kernel. A lpage_info overflow can occur when checking attributes. This may lead to a crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-27022

A flaw was found in the Linux kernel. A race condition can occur when the fork system call is called due to improper locking, triggering a warning, impacting system stability, and resulting in a denial of service.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-35895

CVE-2024-35895 addresses a vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, specifically within the sockmap feature. The issue arises when BPF tracing programs, which can execute in various interrupt contexts, attempt to delete elements from sockmap or sockhash maps. This operation involves acquiring locks that are not safe for use in hard interrupt contexts, leading to potential deadlocks due to lock inversion. BPF tracing programs may delete elements from sockmap/sockhash maps while running in interrupt contexts where the required locks are not hardirq-safe, causing possible deadlocks. System hangs or crashes due to deadlocks when deleting elements from sockmap/sockhash maps in inappropriate contexts.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-36016

A vulnerability was found in the Linux kernel's `n_gsm` driver, affecting the `tty` subsystem. It occurs when switching between basic and advanced option modes in GSM multiplexing, leading to potential out-of-bounds memory writes. This happens because certain state variables, like `gsm->len` and `gsm->state`, are not properly reset during mode changes. The issue could result in memory corruption.

6.4 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-36899

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watched_lines is freed by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier chain failed due to waiting write rwsem. Additionally, one of the GPIO chip's lines is also in the release process and holds the notifier chain's read rwsem. Consequently, a race condition leads to the use-after-free of watched_lines. Here is the typical stack when issue happened: [free] gpio_chrdev_release() --> bitmap_free(cdev->watched_lines) <-- freed --> blocking_notifier_chain_unregister() --> down_write(&nh->rwsem) <-- waiting rwsem --> __down_write_common() --> rwsem_down_write_slowpath() --> schedule_preempt_disabled() --> schedule() [use] st54spi_gpio_dev_release() --> gpio_free() --> gpiod_free() --> gpiod_free_commit() --> gpiod_line_state_notify() --> blocking_notifier_call_chain() --> down_read(&nh->rwsem); <-- held rwsem --> notifier_call_chain() --> lineinfo_changed_notify() --> test_bit(xxxx, cdev->watched_lines) <-- use after free The side effect of the use-after-free issue is that a GPIO line event is being generated for userspace where it shouldn't. However, since the chrdev is being closed, userspace won't have the chance to read that event anyway. To fix the issue, call the bitmap_free() function after the unregistration of lineinfo_changed_nb notifier chain.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-38562

A vulnerability has been identified in the Linux kernel, specifically involving a possible out-of-bounds array indexing within the net/wireless/nl80211.c file (related to the wireless networking subsystem). This flaw can lead to a kernel-level crash, resulting in a denial-of-service condition for the affected system.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-38570

A vulnerability was found in the Linux kernel within the gfs2 component, where potential use-after-free issues could occur on unmount. When DLM lockspaces are released with remaining locks, callbacks for asynchronous lock contention may access freed objects, causing unexpected behavior.

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-38573

A NULL pointer dereference flaw was found in cppc_cpufreq_get_rate() in the Linux kernel. This issue may result in a crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Low

CVE-2024-38601

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix a race between readers and resize checks The reader code in rb_get_reader_page() swaps a new reader page into the ring buffer by doing cmpxchg on old->list.prev->next to point it to the new page. Following that, if the operation is successful, old->list.next->prev gets updated too. This means the underlying doubly-linked list is temporarily inconsistent, page->prev->next or page->next->prev might not be equal back to page for some page in the ring buffer. The resize operation in ring_buffer_resize() can be invoked in parallel. It calls rb_check_pages() which can detect the described inconsistency and stop further tracing: [ 190.271762] ------------[ cut here ]------------ [ 190.271771] WARNING: CPU: 1 PID: 6186 at kernel/trace/ring_buffer.c:1467 rb_check_pages.isra.0+0x6a/0xa0 [ 190.271789] Modules linked in: [...] [ 190.271991] Unloaded tainted modules: intel_uncore_frequency(E):1 skx_edac(E):1 [ 190.272002] CPU: 1 PID: 6186 Comm: cmd.sh Kdump: loaded Tainted: G E 6.9.0-rc6-default #5 158d3e1e6d0b091c34c3b96bfd99a1c58306d79f [ 190.272011] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552c-rebuilt.opensuse.org 04/01/2014 [ 190.272015] RIP: 0010:rb_check_pages.isra.0+0x6a/0xa0 [ 190.272023] Code: [...] [ 190.272028] RSP: 0018:ffff9c37463abb70 EFLAGS: 00010206 [ 190.272034] RAX: ffff8eba04b6cb80 RBX: 0000000000000007 RCX: ffff8eba01f13d80 [ 190.272038] RDX: ffff8eba01f130c0 RSI: ffff8eba04b6cd00 RDI: ffff8eba0004c700 [ 190.272042] RBP: ffff8eba0004c700 R08: 0000000000010002 R09: 0000000000000000 [ 190.272045] R10: 00000000ffff7f52 R11: ffff8eba7f600000 R12: ffff8eba0004c720 [ 190.272049] R13: ffff8eba00223a00 R14: 0000000000000008 R15: ffff8eba067a8000 [ 190.272053] FS: 00007f1bd64752c0(0000) GS:ffff8eba7f680000(0000) knlGS:0000000000000000 [ 190.272057] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.272061] CR2: 00007f1bd6662590 CR3: 000000010291e001 CR4: 0000000000370ef0 [ 190.272070] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 190.272073] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 190.272077] Call Trace: [ 190.272098] <TASK> [ 190.272189] ring_buffer_resize+0x2ab/0x460 [ 190.272199] __tracing_resize_ring_buffer.part.0+0x23/0xa0 [ 190.272206] tracing_resize_ring_buffer+0x65/0x90 [ 190.272216] tracing_entries_write+0x74/0xc0 [ 190.272225] vfs_write+0xf5/0x420 [ 190.272248] ksys_write+0x67/0xe0 [ 190.272256] do_syscall_64+0x82/0x170 [ 190.272363] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 190.272373] RIP: 0033:0x7f1bd657d263 [ 190.272381] Code: [...] [ 190.272385] RSP: 002b:00007ffe72b643f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 190.272391] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1bd657d263 [ 190.272395] RDX: 0000000000000002 RSI: 0000555a6eb538e0 RDI: 0000000000000001 [ 190.272398] RBP: 0000555a6eb538e0 R08: 000000000000000a R09: 0000000000000000 [ 190.272401] R10: 0000555a6eb55190 R11: 0000000000000246 R12: 00007f1bd6662500 [ 190.272404] R13: 0000000000000002 R14: 00007f1bd6667c00 R15: 0000000000000002 [ 190.272412] </TASK> [ 190.272414] ---[ end trace 0000000000000000 ]--- Note that ring_buffer_resize() calls rb_check_pages() only if the parent trace_buffer has recording disabled. Recent commit d78ab792705c ("tracing: Stop current tracer when resizing buffer") causes that it is now always the case which makes it more likely to experience this issue. The window to hit this race is nonetheless very small. To help reproducing it, one can add a delay loop in rb_get_reader_page(): ret = rb_head_page_replace(reader, cpu_buffer->reader_page); if (!ret) goto spin; for (unsigned i = 0; i < 1U << 26; i++) /* inserted delay loop */ __asm__ __volatile__ ("" : : : "memory"); rb_list_head(reader->list.next)->prev = &cpu_buffer->reader_page->list; .. ---truncated---

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Low

CVE-2024-38615

In the Linux kernel, the following vulnerability has been resolved: cpufreq: exit() callback is optional The exit() callback is optional and shouldn't be called without checking a valid pointer first. Also, we must clear freq_table pointer even if the exit() callback isn't present.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-459 - Incomplete Cleanup

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Low

CVE-2024-40984

A vulnerability was found in the Linux kernel's ACPICA component, where improper handling of memory mappings can lead to a NULL pointer dereference. This issue arises when mapping requests exceed page boundaries, resulting in attempts to access unmapped memory.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-41071

No description is available for this CVE.

CWE-787 - Out-of-bounds Write

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

CVE-2024-42225

A potential flaw was found in the Linux kernel’s MediaTek WiFi, where it was reusing uninitialized data. This flaw allows a local user to gain unauthorized access to some data potentially.

4.8 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-457 - Use of Uninitialized Variable

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

CVE-2024-42246

A flaw was found in the Linux kernel's bpf programs. Under certain conditions, when the kernel attempts to initiate a network connection using the kernel_connect function, it can return a value that causes the cx_tcp_setup_socket function to loop. This issue can lead to continuous data writing to the Syslog, filling up the available space and causing the kernel to freeze and become unresponsive.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 279 products, the same list as for CVE-2023-52439

Threats

Impact Moderate

References

128 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:6997	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265271	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273270	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278167	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278245	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278248	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278250	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278252	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278318	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281677	external
https://bugzilla.redhat.com/show_bug.cgi?id=2283894	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284549	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293348	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293364	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293420	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293423	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293431	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293685	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297568	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300448	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301543	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-52439	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265271	external
https://www.cve.org/CVERecord?id=CVE-2023-52439	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52439	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2023-52884	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293685	external
https://www.cve.org/CVERecord?id=CVE-2023-52884	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52884	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-26739	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273270	external
https://www.cve.org/CVERecord?id=CVE-2024-26739	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26739	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26929	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278250	external
https://www.cve.org/CVERecord?id=CVE-2024-26929	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26929	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26930	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278248	external
https://www.cve.org/CVERecord?id=CVE-2024-26930	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26930	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26931	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278245	external
https://www.cve.org/CVERecord?id=CVE-2024-26931	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26931	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26947	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278167	external
https://www.cve.org/CVERecord?id=CVE-2024-26947	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26947	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26991	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278318	external
https://www.cve.org/CVERecord?id=CVE-2024-26991	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26991	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27022	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278252	external
https://www.cve.org/CVERecord?id=CVE-2024-27022	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27022	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35895	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281677	external
https://www.cve.org/CVERecord?id=CVE-2024-35895	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35895	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36016	self
https://bugzilla.redhat.com/show_bug.cgi?id=2283894	external
https://www.cve.org/CVERecord?id=CVE-2024-36016	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36016	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36899	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284549	external
https://www.cve.org/CVERecord?id=CVE-2024-36899	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36899	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-38562	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293431	external
https://www.cve.org/CVERecord?id=CVE-2024-38562	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38562	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38570	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293423	external
https://www.cve.org/CVERecord?id=CVE-2024-38570	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38570	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38573	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293420	external
https://www.cve.org/CVERecord?id=CVE-2024-38573	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38573	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38601	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293364	external
https://www.cve.org/CVERecord?id=CVE-2024-38601	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38601	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38615	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293348	external
https://www.cve.org/CVERecord?id=CVE-2024-38615	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38615	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-40984	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297568	external
https://www.cve.org/CVERecord?id=CVE-2024-40984	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40984	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41071	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300448	external
https://www.cve.org/CVERecord?id=CVE-2024-41071	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41071	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42225	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301543	external
https://www.cve.org/CVERecord?id=CVE-2024-42225	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42225	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42246	self
https://bugzilla.redhat.com/show_bug.cgi?id=2303514	external
https://www.cve.org/CVERecord?id=CVE-2024-42246	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42246	external
https://lore.kernel.org/linux-cve-announce/202408…	external

JSON

To clipboard

Loading 2.0 MB of JSON…

CVE-2023-52439 (GCVE-0-2023-52439)

Vulnerability from cvelistv5 – Published: 2024-02-20 18:34 – Updated: 2026-08-05 09:09

Title

uio: Fix use-after-free in uio_open

Summary

In the Linux kernel, the following vulnerability has been resolved: uio: Fix use-after-free in uio_open core-1 core-2 ------------------------------------------------------- uio_unregister_device uio_open idev = idr_find() device_unregister(&idev->dev) put_device(&idev->dev) uio_device_release get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev) ------------------------------------------------------- In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then: 1. After core-1 kfree idev, the core-2 will do use-after-free for idev. 2. When core-2 do uio_release and put_device, the idev will be double freed. To address this issue, we can get idev atomic & inc idev reference with minor_lock.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:02 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/3174e0f7de1ba392d…
https://git.kernel.org/stable/c/e93da893d52d82d57…
https://git.kernel.org/stable/c/5e0be1229ae199ebb…
https://git.kernel.org/stable/c/5cf604ee538ed0c46…
https://git.kernel.org/stable/c/17a8519cb359c3b48…
https://git.kernel.org/stable/c/35f102607054faafe…
https://git.kernel.org/stable/c/913205930da621330…
https://git.kernel.org/stable/c/0c9ae0b8605078eaf…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://security.netapp.com/advisory/ntap-2024122…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 3174e0f7de1ba392dc191625da83df02d695b60c (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < e93da893d52d82d57fc0db2ca566024e0f26ff50 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 5e0be1229ae199ebb90b33102f74a0f22d152570 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 5cf604ee538ed0c467abe3b4cda5308a6398f0f7 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 17a8519cb359c3b483fb5c7367efa9a8a508bdea (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 35f102607054faafe78d2a6994b18d5d9d6e92ad (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 913205930da6213305616ac539447702eaa85e41 (git) Affected: 57c5f4df0a5a0ee83df799991251e2ee93a5e4e9 , < 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 (git) Affected: 13af019c87f2d90e663742cb1a819834048842ae (git) Affected: 4.14.100 , < 4.15 (semver)
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.4.268 , ≤ 5.4.* (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.74 , ≤ 6.1.* (semver) Unaffected: 6.6.13 , ≤ 6.6.* (semver) Unaffected: 6.7.1 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-27T16:03:00.894Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241227-0006/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52439",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:02:55.773038Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:35.621Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3174e0f7de1ba392dc191625da83df02d695b60c",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "e93da893d52d82d57fc0db2ca566024e0f26ff50",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5e0be1229ae199ebb90b33102f74a0f22d152570",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "5cf604ee538ed0c467abe3b4cda5308a6398f0f7",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "17a8519cb359c3b483fb5c7367efa9a8a508bdea",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "35f102607054faafe78d2a6994b18d5d9d6e92ad",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "913205930da6213305616ac539447702eaa85e41",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "lessThan": "0c9ae0b8605078eafc3bea053cc78791e97ba2e2",
              "status": "affected",
              "version": "57c5f4df0a5a0ee83df799991251e2ee93a5e4e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "13af019c87f2d90e663742cb1a819834048842ae",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.100",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/uio/uio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.74",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.13",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.100",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuio: Fix use-after-free in uio_open\n\ncore-1\t\t\t\tcore-2\n-------------------------------------------------------\nuio_unregister_device\t\tuio_open\n\t\t\t\tidev = idr_find()\ndevice_unregister(\u0026idev-\u003edev)\nput_device(\u0026idev-\u003edev)\nuio_device_release\n\t\t\t\tget_device(\u0026idev-\u003edev)\nkfree(idev)\nuio_free_minor(minor)\n\t\t\t\tuio_release\n\t\t\t\tput_device(\u0026idev-\u003edev)\n\t\t\t\tkfree(idev)\n-------------------------------------------------------\n\nIn the core-1 uio_unregister_device(), the device_unregister will kfree\nidev when the idev-\u003edev kobject ref is 1. But after core-1\ndevice_unregister, put_device and before doing kfree, the core-2 may\nget_device. Then:\n1. After core-1 kfree idev, the core-2 will do use-after-free for idev.\n2. When core-2 do uio_release and put_device, the idev will be double\n   freed.\n\nTo address this issue, we can get idev atomic \u0026 inc idev reference with\nminor_lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening a local UIO character device (/dev/uioN) via the open syscall; the vulnerable uio_open path is not reachable from the network stack or remote protocols.\nAC:L - An attacker who can open /dev/uioN can repeatedly race open against concurrent uio_unregister_device (e.g. TCMU configfs destroy or driver unbind they can also drive), so both sides of the race are attacker-influenced and do not depend on blind external timing.\nPR:L - uio_open has no capability check; access is gated only by /dev/uio* permissions, and worst-case deployments (industrial/DPDK udev rules, TCMU service accounts) grant this to unprivileged users. The UAF at get_device occurs before any driver-specific open hooks.\nUI:N - No separate victim action is required; the attacker triggers the race directly by opening the device while unregister runs.\nS:U - This is a same-host kernel heap UAF/double-free leading to privilege escalation within the kernel\u0027s security authority, not a VM/IOMMU/sandbox boundary escape.\nC:H - Use-after-free of struct uio_device lets the attacker reclaim and control the freed object contents, enabling arbitrary kernel memory disclosure primitives.\nI:H - The same UAF plus the documented double-free on put_device/uio_device_release enables heap corruption and arbitrary write/control-flow hijacking in the kernel.\nA:H - Dereferencing or double-freeing the reclaimed uio_device reliably causes kernel oops/panic even when not fully exploited for code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:09:56.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2"
        }
      ],
      "title": "uio: Fix use-after-free in uio_open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52439",
    "datePublished": "2024-02-20T18:34:49.323Z",
    "dateReserved": "2024-02-20T12:30:33.291Z",
    "dateUpdated": "2026-08-05T09:09:56.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52884 (GCVE-0-2023-52884)

Vulnerability from cvelistv5 – Published: 2024-06-21 10:18 – Updated: 2026-05-11 19:34

Title

Input: cyapa - add missing input core locking to suspend/resume functions

Summary

Severity

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-24 17:50 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/f99809fdeb50d65bc…
https://git.kernel.org/stable/c/9400caf566f65c703…
https://git.kernel.org/stable/c/a4c638ab25786bd5a…
https://git.kernel.org/stable/c/a5fc298fa8f67cf1f…
https://git.kernel.org/stable/c/7b4e0b39182cf5e67…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d69f0a43c677e8afc67a222e1e7b51b9acc69cd3 , < f99809fdeb50d65bcbc1661ef391af94eebb8a75 (git) Affected: d69f0a43c677e8afc67a222e1e7b51b9acc69cd3 , < 9400caf566f65c703e99d95f87b00c4b445627a7 (git) Affected: d69f0a43c677e8afc67a222e1e7b51b9acc69cd3 , < a4c638ab25786bd5aab5978fe51b2b9be16a4ebd (git) Affected: d69f0a43c677e8afc67a222e1e7b51b9acc69cd3 , < a5fc298fa8f67cf1f0e1fc126eab70578cd40adc (git) Affected: d69f0a43c677e8afc67a222e1e7b51b9acc69cd3 , < 7b4e0b39182cf5e677c1fc092a3ec40e621c25b6 (git)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.9.4 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-24T17:50:27.641770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T16:02:45.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:18:41.179Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f99809fdeb50d65bcbc1661ef391af94eebb8a75"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9400caf566f65c703e99d95f87b00c4b445627a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a4c638ab25786bd5aab5978fe51b2b9be16a4ebd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a5fc298fa8f67cf1f0e1fc126eab70578cd40adc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7b4e0b39182cf5e677c1fc092a3ec40e621c25b6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/cyapa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f99809fdeb50d65bcbc1661ef391af94eebb8a75",
              "status": "affected",
              "version": "d69f0a43c677e8afc67a222e1e7b51b9acc69cd3",
              "versionType": "git"
            },
            {
              "lessThan": "9400caf566f65c703e99d95f87b00c4b445627a7",
              "status": "affected",
              "version": "d69f0a43c677e8afc67a222e1e7b51b9acc69cd3",
              "versionType": "git"
            },
            {
              "lessThan": "a4c638ab25786bd5aab5978fe51b2b9be16a4ebd",
              "status": "affected",
              "version": "d69f0a43c677e8afc67a222e1e7b51b9acc69cd3",
              "versionType": "git"
            },
            {
              "lessThan": "a5fc298fa8f67cf1f0e1fc126eab70578cd40adc",
              "status": "affected",
              "version": "d69f0a43c677e8afc67a222e1e7b51b9acc69cd3",
              "versionType": "git"
            },
            {
              "lessThan": "7b4e0b39182cf5e677c1fc092a3ec40e621c25b6",
              "status": "affected",
              "version": "d69f0a43c677e8afc67a222e1e7b51b9acc69cd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/mouse/cyapa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: cyapa - add missing input core locking to suspend/resume functions\n\nGrab input-\u003emutex during suspend/resume functions like it is done in\nother input drivers. This fixes the following warning during system\nsuspend/resume cycle on Samsung Exynos5250-based Snow Chromebook:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c\nModules linked in: ...\nCPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G        W          6.6.0-rc5-next-20231009 #14109\nHardware name: Samsung Exynos (Flattened Device Tree)\nWorkqueue: events_unbound async_run_entry_fn\n unwind_backtrace from show_stack+0x10/0x14\n show_stack from dump_stack_lvl+0x58/0x70\n dump_stack_lvl from __warn+0x1a8/0x1cc\n __warn from warn_slowpath_fmt+0x18c/0x1b4\n warn_slowpath_fmt from input_device_enabled+0x68/0x6c\n input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc\n cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c\n cyapa_reinitialize from cyapa_resume+0x48/0x98\n cyapa_resume from dpm_run_callback+0x90/0x298\n dpm_run_callback from device_resume+0xb4/0x258\n device_resume from async_resume+0x20/0x64\n async_resume from async_run_entry_fn+0x40/0x15c\n async_run_entry_fn from process_scheduled_works+0xbc/0x6a8\n process_scheduled_works from worker_thread+0x188/0x454\n worker_thread from kthread+0x108/0x140\n kthread from ret_from_fork+0x14/0x28\nException stack(0xf1625fb0 to 0xf1625ff8)\n...\n---[ end trace 0000000000000000 ]---\n...\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 1680 at drivers/input/input.c:2291 input_device_enabled+0x68/0x6c\nModules linked in: ...\nCPU: 1 PID: 1680 Comm: kworker/u4:12 Tainted: G        W          6.6.0-rc5-next-20231009 #14109\nHardware name: Samsung Exynos (Flattened Device Tree)\nWorkqueue: events_unbound async_run_entry_fn\n unwind_backtrace from show_stack+0x10/0x14\n show_stack from dump_stack_lvl+0x58/0x70\n dump_stack_lvl from __warn+0x1a8/0x1cc\n __warn from warn_slowpath_fmt+0x18c/0x1b4\n warn_slowpath_fmt from input_device_enabled+0x68/0x6c\n input_device_enabled from cyapa_gen3_set_power_mode+0x13c/0x1dc\n cyapa_gen3_set_power_mode from cyapa_reinitialize+0x10c/0x15c\n cyapa_reinitialize from cyapa_resume+0x48/0x98\n cyapa_resume from dpm_run_callback+0x90/0x298\n dpm_run_callback from device_resume+0xb4/0x258\n device_resume from async_resume+0x20/0x64\n async_resume from async_run_entry_fn+0x40/0x15c\n async_run_entry_fn from process_scheduled_works+0xbc/0x6a8\n process_scheduled_works from worker_thread+0x188/0x454\n worker_thread from kthread+0x108/0x140\n kthread from ret_from_fork+0x14/0x28\nException stack(0xf1625fb0 to 0xf1625ff8)\n...\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:34:53.543Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f99809fdeb50d65bcbc1661ef391af94eebb8a75"
        },
        {
          "url": "https://git.kernel.org/stable/c/9400caf566f65c703e99d95f87b00c4b445627a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4c638ab25786bd5aab5978fe51b2b9be16a4ebd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5fc298fa8f67cf1f0e1fc126eab70578cd40adc"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b4e0b39182cf5e677c1fc092a3ec40e621c25b6"
        }
      ],
      "title": "Input: cyapa - add missing input core locking to suspend/resume functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52884",
    "datePublished": "2024-06-21T10:18:03.669Z",
    "dateReserved": "2024-05-21T15:35:00.782Z",
    "dateUpdated": "2026-05-11T19:34:53.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26739 (GCVE-0-2024-26739)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:26

Title

net/sched: act_mirred: don't override retval if we already lost the skb

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:51 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/0117fe0a4615a7c8d…
https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e9…
https://git.kernel.org/stable/c/e873e8f7d03a2ee5b…
https://git.kernel.org/stable/c/28cdbbd38a4413b8e…
https://git.kernel.org/stable/c/f4e294bbdca8ac875…
https://git.kernel.org/stable/c/166c2c8a6a4dc2e4c…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd (git) Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5 (git) Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < e873e8f7d03a2ee5b77fb1a305c782fed98e2754 (git) Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 28cdbbd38a4413b8eff53399b3f872fd4e80db9d (git) Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < f4e294bbdca8ac8757db436fc82214f3882fc7e7 (git) Affected: e5cf1baf92cb785b90390db1c624948e70c8b8bd , < 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 (git)
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.238 , ≤ 5.10.* (semver) Unaffected: 5.15.182 , ≤ 5.15.* (semver) Unaffected: 6.1.136 , ≤ 6.1.* (semver) Unaffected: 6.6.19 , ≤ 6.6.* (semver) Unaffected: 6.7.7 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:31.734Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26739",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:51:53.930424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:18.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_mirred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "e873e8f7d03a2ee5b77fb1a305c782fed98e2754",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "28cdbbd38a4413b8eff53399b3f872fd4e80db9d",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "f4e294bbdca8ac8757db436fc82214f3882fc7e7",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            },
            {
              "lessThan": "166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210",
              "status": "affected",
              "version": "e5cf1baf92cb785b90390db1c624948e70c8b8bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_mirred.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.182",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.182",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.136",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_mirred: don\u0027t override retval if we already lost the skb\n\nIf we\u0027re redirecting the skb, and haven\u0027t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable configuration (ingress qdisc + filter with an act_mirred redirect) must be installed locally via rtnetlink, and the attacker drives the trigger by injecting frames locally into that device. Per kernel scoring convention, tc/qdisc netlink-configured paths are Local.\nAC:L - There is no race or memory-layout precondition; the attacker fully controls both the mirred configuration and the drop condition (unhandled ethertype, or a drop filter/saturated qdisc on the target device), so every injected packet deterministically produces the double free.\nPR:L - Configuring the mirred action requires only CAP_NET_ADMIN within a network namespace, which any unprivileged user obtains via `unshare -Urn`; CAP_NET_RAW in that same user namespace supplies the AF_PACKET frame injection.\nUI:N - The attacker sets up the qdisc/filter and sends the packets entirely on their own; no action by any other user or administrator is needed.\nS:U - The corruption is confined to the kernel\u0027s own heap and privilege domain; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - The skb and its data buffer are freed twice, so the same slab object is handed to two owners; this use-after-free lets an attacker read the contents of a kernel object aliased onto the reclaimed skb, giving arbitrary kernel memory disclosure.\nI:H - The same double-free/UAF primitive permits heap spraying of the reclaimed skb with attacker-controlled data, yielding a write primitive over adjacent kernel structures and a path to control-flow hijack and privilege escalation.\nA:H - Even without further exploitation, freeing an already-freed skb corrupts the slab freelist and reliably triggers a kernel oops/panic (or BUG on a debug kernel), and it can be repeated at packet rate."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:57.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0117fe0a4615a7c8d30d6ebcbf87332fbe63e6fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d3ef89b6a5e9f2e940de2cef3d543be0be8dec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e873e8f7d03a2ee5b77fb1a305c782fed98e2754"
        },
        {
          "url": "https://git.kernel.org/stable/c/28cdbbd38a4413b8eff53399b3f872fd4e80db9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4e294bbdca8ac8757db436fc82214f3882fc7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210"
        }
      ],
      "title": "net/sched: act_mirred: don\u0027t override retval if we already lost the skb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26739",
    "datePublished": "2024-04-03T17:00:24.879Z",
    "dateReserved": "2024-02-19T14:20:24.166Z",
    "dateUpdated": "2026-08-05T11:26:57.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26929 (GCVE-0-2024-26929)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:17 – Updated: 2025-01-06 16:24

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-01-06T16:24:17.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26929",
    "datePublished": "2024-05-01T05:17:06.418Z",
    "dateRejected": "2025-01-06T16:24:17.811Z",
    "dateReserved": "2024-02-19T14:20:24.195Z",
    "dateUpdated": "2025-01-06T16:24:17.811Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26930 (GCVE-0-2024-26930)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:17 – Updated: 2026-08-05 11:28

Title

scsi: qla2xxx: Fix double free of the ha->vp_map pointer

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL to vp_map and kfree take care of NULL.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:40 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/f14cee7a882cb7952…
https://git.kernel.org/stable/c/b7deb675d674f44e0…
https://git.kernel.org/stable/c/825d63164a2e6bacb…
https://git.kernel.org/stable/c/e288285d47784fdcf…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < f14cee7a882cb79528f17a2335f53e9fd1848467 (git) Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < b7deb675d674f44e0ddbab87fee8f9f098925e73 (git) Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < 825d63164a2e6bacb059a9afb5605425b485413f (git) Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < e288285d47784fdcf7c81be56df7d65c6f10c58b (git)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:40:52.767633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:46:59.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f14cee7a882cb79528f17a2335f53e9fd1848467",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "b7deb675d674f44e0ddbab87fee8f9f098925e73",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "825d63164a2e6bacb059a9afb5605425b485413f",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "e288285d47784fdcf7c81be56df7d65c6f10c58b",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\n\nCoverity scan reported potential risk of double free of the pointer\nha-\u003evp_map.  ha-\u003evp_map was freed in qla2x00_mem_alloc(), and again freed\nin function qla2x00_mem_free(ha).\n\nAssign NULL to vp_map and kfree take care of NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only entered from `qla2x00_probe_one()`, i.e. local driver bring-up via module load, sysfs driver bind, or boot-time PCI enumeration; no network or remote-peer data reaches this path.\nAC:H - Triggering requires a kernel memory-allocation failure at one of ~20 specific sites inside the probe, plus the non-default `qlini_mode=exclusive|disabled|dual` (FC target) or `ql2xsecenable=1` on QLA28xx \u2014 neither the timing of the probe nor which allocation fails is under the attacker\u0027s control.\nPR:L - The only attacker-supplied ingredient is memory exhaustion/fragmentation, which any unprivileged local user can create; the probe itself is driven by ordinary system activity (boot, PCI hotplug, udev/driver rebind), so no elevated privilege is needed for the attacker\u0027s half.\nUI:N - Once the allocation failure occurs during probe, the error unwind and the second `kfree()` in `qla2x00_mem_free()` happen automatically inside the kernel with no action by any other user.\nS:U - The corruption is confined to the kernel slab allocator on the same host and crosses no virtualization, IOMMU, or sandbox authority boundary.\nC:H - The double free of the 4 KB `vp_map` object lets the same slab object be handed to two owners, yielding a use-after-free read primitive over whatever kernel structure lands there \u2014 potentially arbitrary kernel memory disclosure.\nI:H - Freelist corruption from the double free gives overlapping allocations, the classic path to controlled kernel heap writes and control-flow hijack; the freed 4 KB object is also a prime heap-spray target.\nA:H - With `CONFIG_SLAB_FREELIST_HARDENED`/SLUB debug the second `kfree()` is detected and BUG()s immediately; without it, freelist corruption reliably leads to an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:25.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73"
        },
        {
          "url": "https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b"
        }
      ],
      "title": "scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26930",
    "datePublished": "2024-05-01T05:17:10.685Z",
    "dateReserved": "2024-02-19T14:20:24.195Z",
    "dateUpdated": "2026-08-05T11:28:25.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26931 (GCVE-0-2024-26931)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:17 – Updated: 2026-08-05 11:28

Title

scsi: qla2xxx: Fix command flush on cable pull

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0 ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0 ? __switch_to+0x10c/0x450 ? process_one_work+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? worker_thread+0x1ce/0x390 ? create_worker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? set_kthread_struct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed. ? ret_from_fork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsi_cmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL. Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:45 UTC

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/b73377124f56d2fec…
https://git.kernel.org/stable/c/d7a68eee87b05d4e2…
https://git.kernel.org/stable/c/67b2d35853c2da25a…
https://git.kernel.org/stable/c/a859f6a8f4234b8ef…
https://git.kernel.org/stable/c/09c0ac18cac206ed1…
https://git.kernel.org/stable/c/8de1584ec4fe0ebea…
https://git.kernel.org/stable/c/8f0d32004e3a572bb…
https://git.kernel.org/stable/c/ec7587eef003cab15…
https://git.kernel.org/stable/c/a27d4d0e7de305def…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < b73377124f56d2fec154737c2f8d2e839c237d5a (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < d7a68eee87b05d4e29419e6f151aef99314970a9 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 67b2d35853c2da25a8ca1c4190a5e96d3083c2ac (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 09c0ac18cac206ed1218b1fe6c1a0918e5ea9211 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 8de1584ec4fe0ebea33c273036e7e0a05e65c81d (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 8f0d32004e3a572bb77e6c11c2797c87f8c9703d (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < ec7587eef003cab15a13446d67c3adb88146a150 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < a27d4d0e7de305def8a5098a614053be208d1aa1 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 4.19.312 , ≤ 4.19.* (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.629Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26931",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:45:55.384223Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:53.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b73377124f56d2fec154737c2f8d2e839c237d5a",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "d7a68eee87b05d4e29419e6f151aef99314970a9",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "67b2d35853c2da25a8ca1c4190a5e96d3083c2ac",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "09c0ac18cac206ed1218b1fe6c1a0918e5ea9211",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "8de1584ec4fe0ebea33c273036e7e0a05e65c81d",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "8f0d32004e3a572bb77e6c11c2797c87f8c9703d",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "ec7587eef003cab15a13446d67c3adb88146a150",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            },
            {
              "lessThan": "a27d4d0e7de305def8a5098a614053be208d1aa1",
              "status": "affected",
              "version": "726b85487067d7f5b23495bc33c484b8517c4074",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_target.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix command flush on cable pull\n\nSystem crash due to command failed to flush back to SCSI layer.\n\n BUG: unable to handle kernel NULL pointer dereference at 0000000000000000\n PGD 0 P4D 0\n Oops: 0000 [#1] SMP NOPTI\n CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-372.9.1.el8.x86_64 #1\n Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021\n Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]\n RIP: 0010:__wake_up_common+0x4c/0x190\n Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 \u003c49\u003e 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75\n RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086\n RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320\n RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8\n R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20\n R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000\n FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n PKRU: 55555554\n Call Trace:\n  __wake_up_common_lock+0x7c/0xc0\n  qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0\n ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.\n  ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1\n ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]\n qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0\n  ? __switch_to+0x10c/0x450\n ? process_one_work+0x1a7/0x360\n qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.\n  ? worker_thread+0x1ce/0x390\n  ? create_worker+0x1a0/0x1a0\n qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70\n  ? kthread+0x10a/0x120\n qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8\n  ? set_kthread_struct+0x40/0x40\n qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.\n  ? ret_from_fork+0x1f/0x40\n qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout\n\nThe system was under memory stress where driver was not able to allocate an\nSRB to carry out error recovery of cable pull.  The failure to flush causes\nupper layer to start modifying scsi_cmnd.  When the system frees up some\nmemory, the subsequent cable pull trigger another command flush. At this\npoint the driver access a null pointer when attempting to DMA unmap the\nSGL.\n\nAdd a check to make sure commands are flush back on session tear down to\nprevent the null pointer access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The session teardown that triggers the bug is driven by remote Fibre Channel fabric events \u2014 `MBA_PORT_UPDATE` port-logout/RSCN async events from a peer port or switch reach `qlt_schedule_sess_for_deletion()` in initiator mode with no local access required. An FC SAN is a logically adjacent topology / limited administrative domain rather than a routable network, so Adjacent applies.\nAC:L - An attacker on the fabric controls both required conditions: repeated login/logout storms with deep queue depth force many concurrent GFP_ATOMIC abort-SRB allocations against the fixed 128-entry `SRB_MIN_REQ` mempool, making the flush failure reproducible, and the sequence can be retried indefinitely at no cost.\nPR:N - Fibre Channel performs no authentication by default, so a peer port needs no credentials or account on the victim host to force session teardown while I/O is outstanding. The vulnerable path is reached entirely from firmware-delivered link events.\nUI:N - No victim action is needed \u2014 the crash follows automatically from the link/session state change and the subsequent teardown once the flush has failed.\nS:U - The stale-pointer access, memory corruption, and crash are all confined to the host kernel; no security authority or virtualization boundary is crossed.\nC:H - The driver acts on a `scsi_cmnd` the midlayer has already reclaimed and may have reused, and on a freed `fc_port_t` still referenced by outstanding SRBs \u2014 a stale-pointer/UAF-class condition on heap objects whose contents an attacker can shape via I/O patterns, and `scsi_dma_unmap()` on a reused SGL triggers swiotlb copy-back into the wrong pages.\nI:H - The same primitive gives writes: unmapping an in-flight scatter-gather list lets the HBA DMA into pages the kernel has since freed and reallocated, and `qla2x00_sp_compl()` calls `scsi_done()` on a recycled request, corrupting another command\u0027s result and double-completing it in the block layer.\nA:H - The reported failure is a kernel NULL pointer dereference oops while DMA-unmapping the stale command\u0027s SGL, taking down the storage host; the fix additionally has to force a full chip reset to recover."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:26.685Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a"
        },
        {
          "url": "https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211"
        },
        {
          "url": "https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150"
        },
        {
          "url": "https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1"
        }
      ],
      "title": "scsi: qla2xxx: Fix command flush on cable pull",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26931",
    "datePublished": "2024-05-01T05:17:14.823Z",
    "dateReserved": "2024-02-19T14:20:24.195Z",
    "dateUpdated": "2026-08-05T11:28:26.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26947 (GCVE-0-2024-26947)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:18 – Updated: 2026-05-23 15:40

Title

ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses

Summary

In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the semantics of pfn_valid() to check presence of the memory map for a PFN. A valid page for an address which is reserved but not mapped by the kernel[1], the system crashed during some uio test with the following memory layout: node 0: [mem 0x00000000c0a00000-0x00000000cc8fffff] node 0: [mem 0x00000000d0000000-0x00000000da1fffff] the uio layout is：0xc0900000, 0x100000 the crash backtrace like: Unable to handle kernel paging request at virtual address bff00000 [...] CPU: 1 PID: 465 Comm: startapp.bin Tainted: G O 5.10.0 #1 Hardware name: Generic DT based system PC is at b15_flush_kern_dcache_area+0x24/0x3c LR is at __sync_icache_dcache+0x6c/0x98 [...] (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98) (__sync_icache_dcache) from (set_pte_at+0x28/0x54) (set_pte_at) from (remap_pfn_range+0x1a0/0x274) (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio]) (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4) (__mmap_region) from (__do_mmap_mm+0x3ec/0x440) (__do_mmap_mm) from (do_mmap+0x50/0x58) (do_mmap) from (vm_mmap_pgoff+0xfc/0x188) (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4) (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c) Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e) ---[ end trace 09cf0734c3805d52 ]--- Kernel panic - not syncing: Fatal exception So check if PG_reserved was set to solve this issue. [1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:40 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/0c027c2bad7f5111c…
https://git.kernel.org/stable/c/9f7ddc222cae8254e…
https://git.kernel.org/stable/c/fb3a122a978626b33…
https://git.kernel.org/stable/c/0c66c6f4e21cb2222…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 , < 0c027c2bad7f5111c51a358b5d392e1a695dabff (git) Affected: a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 , < 9f7ddc222cae8254e93d5c169a8ae11a49d912a7 (git) Affected: a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 , < fb3a122a978626b33de3367ee1762da934c0f512 (git) Affected: a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 , < 0c66c6f4e21cb22220cbd8821c5c73fc157d20dc (git) Affected: 6026d4032dbbe3d7f4ac2c8daa923fe74dcf41c4 (git) Affected: 65c578935bcc26ddc04e6757b2c7be95bf235b31 (git) Affected: 5.4.167 , < 5.5 (semver) Affected: 5.10.87 , < 5.11 (semver)
Linux	Linux	Affected: 5.14 Unaffected: 0 , < 5.14 (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26947",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:40:49.744241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:46:53.297Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c027c2bad7f5111c51a358b5d392e1a695dabff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9f7ddc222cae8254e93d5c169a8ae11a49d912a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb3a122a978626b33de3367ee1762da934c0f512"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c66c6f4e21cb22220cbd8821c5c73fc157d20dc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/mm/flush.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c027c2bad7f5111c51a358b5d392e1a695dabff",
              "status": "affected",
              "version": "a4d5613c4dc6d413e0733e37db9d116a2a36b9f3",
              "versionType": "git"
            },
            {
              "lessThan": "9f7ddc222cae8254e93d5c169a8ae11a49d912a7",
              "status": "affected",
              "version": "a4d5613c4dc6d413e0733e37db9d116a2a36b9f3",
              "versionType": "git"
            },
            {
              "lessThan": "fb3a122a978626b33de3367ee1762da934c0f512",
              "status": "affected",
              "version": "a4d5613c4dc6d413e0733e37db9d116a2a36b9f3",
              "versionType": "git"
            },
            {
              "lessThan": "0c66c6f4e21cb22220cbd8821c5c73fc157d20dc",
              "status": "affected",
              "version": "a4d5613c4dc6d413e0733e37db9d116a2a36b9f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6026d4032dbbe3d7f4ac2c8daa923fe74dcf41c4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "65c578935bcc26ddc04e6757b2c7be95bf235b31",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.167",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.87",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/mm/flush.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.87",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses\n\nSince commit a4d5613c4dc6 (\"arm: extend pfn_valid to take into account\nfreed memory map alignment\") changes the semantics of pfn_valid() to check\npresence of the memory map for a PFN. A valid page for an address which\nis reserved but not mapped by the kernel[1], the system crashed during\nsome uio test with the following memory layout:\n\n node   0: [mem 0x00000000c0a00000-0x00000000cc8fffff]\n node   0: [mem 0x00000000d0000000-0x00000000da1fffff]\n the uio layout is\uff1a0xc0900000, 0x100000\n\nthe crash backtrace like:\n\n  Unable to handle kernel paging request at virtual address bff00000\n  [...]\n  CPU: 1 PID: 465 Comm: startapp.bin Tainted: G           O      5.10.0 #1\n  Hardware name: Generic DT based system\n  PC is at b15_flush_kern_dcache_area+0x24/0x3c\n  LR is at __sync_icache_dcache+0x6c/0x98\n  [...]\n   (b15_flush_kern_dcache_area) from (__sync_icache_dcache+0x6c/0x98)\n   (__sync_icache_dcache) from (set_pte_at+0x28/0x54)\n   (set_pte_at) from (remap_pfn_range+0x1a0/0x274)\n   (remap_pfn_range) from (uio_mmap+0x184/0x1b8 [uio])\n   (uio_mmap [uio]) from (__mmap_region+0x264/0x5f4)\n   (__mmap_region) from (__do_mmap_mm+0x3ec/0x440)\n   (__do_mmap_mm) from (do_mmap+0x50/0x58)\n   (do_mmap) from (vm_mmap_pgoff+0xfc/0x188)\n   (vm_mmap_pgoff) from (ksys_mmap_pgoff+0xac/0xc4)\n   (ksys_mmap_pgoff) from (ret_fast_syscall+0x0/0x5c)\n  Code: e0801001 e2423001 e1c00003 f57ff04f (ee070f3e)\n  ---[ end trace 09cf0734c3805d52 ]---\n  Kernel panic - not syncing: Fatal exception\n\nSo check if PG_reserved was set to solve this issue.\n\n[1]: https://lore.kernel.org/lkml/Zbtdue57RO0QScJM@linux.ibm.com/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:40:35.915Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c027c2bad7f5111c51a358b5d392e1a695dabff"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f7ddc222cae8254e93d5c169a8ae11a49d912a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb3a122a978626b33de3367ee1762da934c0f512"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c66c6f4e21cb22220cbd8821c5c73fc157d20dc"
        }
      ],
      "title": "ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26947",
    "datePublished": "2024-05-01T05:18:17.316Z",
    "dateReserved": "2024-02-19T14:20:24.197Z",
    "dateUpdated": "2026-05-23T15:40:35.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26991 (GCVE-0-2024-26991)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:27 – Updated: 2026-05-11 20:08

Title

KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conversions_test selftest. When memory attributes are set on a GFN range, that range will have specific properties applied to the TDP. A huge page cannot be used when the attributes are inconsistent, so they are disabled for those the specific huge pages. For internal KVM reasons, huge pages are also not allowed to span adjacent memslots regardless of whether the backing memory could be mapped as huge. What GFNs support which huge page sizes is tracked by an array of arrays 'lpage_info' on the memslot, of ‘kvm_lpage_info’ structs. Each index of lpage_info contains a vmalloc allocated array of these for a specific supported page size. The kvm_lpage_info denotes whether a specific huge page (GFN and page size) on the memslot is supported. These arrays include indices for unaligned head and tail huge pages. Preventing huge pages from spanning adjacent memslot is covered by incrementing the count in head and tail kvm_lpage_info when the memslot is allocated, but disallowing huge pages for memory that has mixed attributes has to be done in a more complicated way. During the KVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot in the range that has mismatched attributes. KVM does this a memslot at a time, and marks a special bit, KVM_LPAGE_MIXED_FLAG, in the kvm_lpage_info for any huge page. This bit is essentially a permanently elevated count. So huge pages will not be mapped for the GFN at that page size if the count is elevated in either case: a huge head or tail page unaligned to the memslot or if KVM_LPAGE_MIXED_FLAG is set because it has mixed attributes. To determine whether a huge page has consistent attributes, the KVM_SET_MEMORY_ATTRIBUTES operation checks an xarray to make sure it consistently has the incoming attribute. Since level - 1 huge pages are aligned to level huge pages, it employs an optimization. As long as the level - 1 huge pages are checked first, it can just check these and assume that if each level - 1 huge page contained within the level sized huge page is not mixed, then the level size huge page is not mixed. This optimization happens in the helper hugepage_has_attrs(). Unfortunately, although the kvm_lpage_info array representing page size 'level' will contain an entry for an unaligned tail page of size level, the array for level - 1 will not contain an entry for each GFN at page size level. The level - 1 array will only contain an index for any unaligned region covered by level - 1 huge page size, which can be a smaller region. So this causes the optimization to overflow the level - 1 kvm_lpage_info and perform a vmalloc out of bounds read. In some cases of head and tail pages where an overflow could happen, callers skip the operation completely as KVM_LPAGE_MIXED_FLAG is not required to prevent huge pages as discussed earlier. But for memslots that are smaller than the 1GB page size, it does call hugepage_has_attrs(). In this case the huge page is both the head and tail page. The issue can be observed simply by compiling the kernel with CONFIG_KASAN_VMALLOC and running the selftest “private_mem_conversions_test”, which produces the output like the following: BUG: KASAN: vmalloc-out-of-bounds in hugepage_has_attrs+0x7e/0x110 Read of size 4 at addr ffffc900000a3008 by task private_mem_con/169 Call Trace: dump_stack_lvl print_report ? __virt_addr_valid ? hugepage_has_attrs ? hugepage_has_attrs kasan_report ? hugepage_has_attrs hugepage_has_attrs kvm_arch_post_set_memory_attributes kvm_vm_ioctl It is a little ambiguous whether the unaligned head page (in the bug case also the tail page) should be expected to have KVM_LPAGE_MIXED_FLAG set. It is not functionally required, as the unal ---truncated---

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-06 18:48 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/048cc4a028e635d33…
https://git.kernel.org/stable/c/992b54bd083c5bee2…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 90b4fe17981e155432c4dbc490606d0c2e9c2199 , < 048cc4a028e635d339687ed968985d2d1669494c (git) Affected: 90b4fe17981e155432c4dbc490606d0c2e9c2199 , < 992b54bd083c5bee24ff7cc35991388ab08598c4 (git)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.8.8 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T18:48:18.659568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T17:18:09.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:40.007Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "048cc4a028e635d339687ed968985d2d1669494c",
              "status": "affected",
              "version": "90b4fe17981e155432c4dbc490606d0c2e9c2199",
              "versionType": "git"
            },
            {
              "lessThan": "992b54bd083c5bee24ff7cc35991388ab08598c4",
              "status": "affected",
              "version": "90b4fe17981e155432c4dbc490606d0c2e9c2199",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/mmu/mmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86/mmu: x86: Don\u0027t overflow lpage_info when checking attributes\n\nFix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger\nKASAN splat, as seen in the private_mem_conversions_test selftest.\n\nWhen memory attributes are set on a GFN range, that range will have\nspecific properties applied to the TDP. A huge page cannot be used when\nthe attributes are inconsistent, so they are disabled for those the\nspecific huge pages. For internal KVM reasons, huge pages are also not\nallowed to span adjacent memslots regardless of whether the backing memory\ncould be mapped as huge.\n\nWhat GFNs support which huge page sizes is tracked by an array of arrays\n\u0027lpage_info\u0027 on the memslot, of \u2018kvm_lpage_info\u2019 structs. Each index of\nlpage_info contains a vmalloc allocated array of these for a specific\nsupported page size. The kvm_lpage_info denotes whether a specific huge\npage (GFN and page size) on the memslot is supported. These arrays include\nindices for unaligned head and tail huge pages.\n\nPreventing huge pages from spanning adjacent memslot is covered by\nincrementing the count in head and tail kvm_lpage_info when the memslot is\nallocated, but disallowing huge pages for memory that has mixed attributes\nhas to be done in a more complicated way. During the\nKVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot in\nthe range that has mismatched attributes. KVM does this a memslot at a\ntime, and marks a special bit, KVM_LPAGE_MIXED_FLAG, in the kvm_lpage_info\nfor any huge page. This bit is essentially a permanently elevated count.\nSo huge pages will not be mapped for the GFN at that page size if the\ncount is elevated in either case: a huge head or tail page unaligned to\nthe memslot or if KVM_LPAGE_MIXED_FLAG is set because it has mixed\nattributes.\n\nTo determine whether a huge page has consistent attributes, the\nKVM_SET_MEMORY_ATTRIBUTES operation checks an xarray to make sure it\nconsistently has the incoming attribute. Since level - 1 huge pages are\naligned to level huge pages, it employs an optimization. As long as the\nlevel - 1 huge pages are checked first, it can just check these and assume\nthat if each level - 1 huge page contained within the level sized huge\npage is not mixed, then the level size huge page is not mixed. This\noptimization happens in the helper hugepage_has_attrs().\n\nUnfortunately, although the kvm_lpage_info array representing page size\n\u0027level\u0027 will contain an entry for an unaligned tail page of size level,\nthe array for level - 1  will not contain an entry for each GFN at page\nsize level. The level - 1 array will only contain an index for any\nunaligned region covered by level - 1 huge page size, which can be a\nsmaller region. So this causes the optimization to overflow the level - 1\nkvm_lpage_info and perform a vmalloc out of bounds read.\n\nIn some cases of head and tail pages where an overflow could happen,\ncallers skip the operation completely as KVM_LPAGE_MIXED_FLAG is not\nrequired to prevent huge pages as discussed earlier. But for memslots that\nare smaller than the 1GB page size, it does call hugepage_has_attrs(). In\nthis case the huge page is both the head and tail page. The issue can be\nobserved simply by compiling the kernel with CONFIG_KASAN_VMALLOC and\nrunning the selftest \u201cprivate_mem_conversions_test\u201d, which produces the\noutput like the following:\n\nBUG: KASAN: vmalloc-out-of-bounds in hugepage_has_attrs+0x7e/0x110\nRead of size 4 at addr ffffc900000a3008 by task private_mem_con/169\nCall Trace:\n  dump_stack_lvl\n  print_report\n  ? __virt_addr_valid\n  ? hugepage_has_attrs\n  ? hugepage_has_attrs\n  kasan_report\n  ? hugepage_has_attrs\n  hugepage_has_attrs\n  kvm_arch_post_set_memory_attributes\n  kvm_vm_ioctl\n\nIt is a little ambiguous whether the unaligned head page (in the bug case\nalso the tail page) should be expected to have KVM_LPAGE_MIXED_FLAG set.\nIt is not functionally required, as the unal\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:08:17.905Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/048cc4a028e635d339687ed968985d2d1669494c"
        },
        {
          "url": "https://git.kernel.org/stable/c/992b54bd083c5bee24ff7cc35991388ab08598c4"
        }
      ],
      "title": "KVM: x86/mmu: x86: Don\u0027t overflow lpage_info when checking attributes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26991",
    "datePublished": "2024-05-01T05:27:53.427Z",
    "dateReserved": "2024-02-19T14:20:24.205Z",
    "dateUpdated": "2026-05-11T20:08:17.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-27022 (GCVE-0-2024-27022)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:35 – Updated: 2026-08-05 11:29

Title

fork: defer linking file vma until vma is fully initialized

Summary

In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_hole i_mmap_lock_write(mapping); vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. i_mmap_unlock_write(mapping); hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping); hugetlb_vmdelete_list vma_interval_tree_foreach hugetlb_vma_trylock_write -- Vma_lock is cleared. tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! hugetlb_vma_unlock_write -- Vma_lock is assigned!!! i_mmap_unlock_write(mapping); hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside i_mmap_rwsem lock while vma lock can be used in the same time. Fix this by deferring linking file vma until vma is fully initialized. Those vmas should be initialized first before they can be used.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:44 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/2e5cbab8ccbfc7d4a…
https://git.kernel.org/stable/c/abdb88dd272bbeb93…
https://git.kernel.org/stable/c/35e351780fa9d8240…
https://git.kernel.org/stable/c/0c42f7e039aba3de6…	x_transferred
https://git.kernel.org/stable/c/04b0c41912349aff1…	x_transferred
https://git.kernel.org/stable/c/cec11fa2eb512ebe3…	x_transferred
https://git.kernel.org/stable/c/dd782da470761077f…	x_transferred
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8d9bfb2608145cf3e408428c224099e1585471af , < 2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b (git) Affected: 8d9bfb2608145cf3e408428c224099e1585471af , < abdb88dd272bbeb93efe01d8e0b7b17e24af3a34 (git) Affected: 8d9bfb2608145cf3e408428c224099e1585471af , < 35e351780fa9d8240dd6f7e4f245f9ea37e96c19 (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.8.8 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:17:44.767Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c42f7e039aba3de6d7dbf92da708e2b2ecba557"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04b0c41912349aff11a1bbaef6a722bd7fbb90ac"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cec11fa2eb512ebe3a459c185f4aca1d44059bbf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd782da470761077f4d1120e191f1a35787cda6e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27022",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:44:40.515074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:37.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            },
            {
              "lessThan": "abdb88dd272bbeb93efe01d8e0b7b17e24af3a34",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            },
            {
              "lessThan": "35e351780fa9d8240dd6f7e4f245f9ea37e96c19",
              "status": "affected",
              "version": "8d9bfb2608145cf3e408428c224099e1585471af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/fork.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfork: defer linking file vma until vma is fully initialized\n\nThorvald reported a WARNING [1]. And the root cause is below race:\n\n CPU 1\t\t\t\t\tCPU 2\n fork\t\t\t\t\thugetlbfs_fallocate\n  dup_mmap\t\t\t\t hugetlbfs_punch_hole\n   i_mmap_lock_write(mapping);\n   vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.\n   i_mmap_unlock_write(mapping);\n   hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t i_mmap_lock_write(mapping);\n   \t\t\t\t\t hugetlb_vmdelete_list\n\t\t\t\t\t  vma_interval_tree_foreach\n\t\t\t\t\t   hugetlb_vma_trylock_write -- Vma_lock is cleared.\n   tmp-\u003evm_ops-\u003eopen -- Alloc new vma_lock outside i_mmap_rwsem!\n\t\t\t\t\t   hugetlb_vma_unlock_write -- Vma_lock is assigned!!!\n\t\t\t\t\t i_mmap_unlock_write(mapping);\n\nhugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside\ni_mmap_rwsem lock while vma lock can be used in the same time.  Fix this\nby deferring linking file vma until vma is fully initialized.  Those vmas\nshould be initialized first before they can be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local syscalls \u2014 `memfd_create(MFD_HUGETLB)`/`ftruncate`/`mmap`, `fork()`, and `fallocate(FALLOC_FL_PUNCH_HOLE)` \u2014 on the attacker\u0027s own process. There is no network or remote-peer input path into `dup_mmap()` or `hugetlbfs_punch_hole()`.\nAC:L - The attacker controls both sides of the race, looping `fork()` in one thread while another loops hole-punch/truncate on the same hugetlbfs fd, and the vulnerable window spans `hugetlb_dup_vma_private()` through `copy_page_range()` to `vm_ops-\u003eopen()`, which is widened to milliseconds simply by using a multi-GB mapping. No condition outside the attacker\u0027s influence is required.\nPR:L - Any unprivileged local user can reach this: `memfd_create(name, MFD_HUGETLB)` uses `HUGETLB_ANONHUGE_INODE`, which bypasses the `can_do_hugetlb_shm()`/`CAP_IPC_LOCK` check, and `MAP_NORESERVE` lets the mapping succeed even with no huge pages configured. No hugetlbfs mount, capability, or namespace privilege is needed.\nUI:N - The attacker\u0027s own process performs both the `fork()` and the `fallocate()`/`ftruncate()` that collide; no victim action, mount, or file open by another user is involved.\nS:U - The corruption is confined to kernel memory-management state (rwsem counters and hugetlb page tables) within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Running `huge_pmd_unshare()` without the VMA lock reintroduces the shared-PMD page-table use-after-free that lock was added to prevent, letting a freed page-table page remain installed in another mm\u0027s PUD and be reallocated \u2014 yielding arbitrary physical memory read. Per kernel guidance, memory corruption of this class scores High.\nI:H - The same PMD page-table UAF gives an arbitrary-write primitive (attacker-controlled PTEs written into freed-and-reallocated memory map arbitrary physical frames), and the unbalanced `up_write()` underflows `sem-\u003ecount`, destroying mutual exclusion on the lock that guards hugetlb page-table teardown.\nA:H - The mismatched lock/unlock leaves the parent\u0027s `hugetlb_vma_lock-\u003erw_sema` permanently write-held, so every subsequent hugetlb fault, unmap, or `exit_mmap()` on that VMA blocks forever in D state \u2014 unkillable tasks and hung-task panic \u2014 in addition to the reported WARNING and UAF-induced oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:04.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e5cbab8ccbfc7d4a3d8a21d3c2a1f2c1aa29b5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/abdb88dd272bbeb93efe01d8e0b7b17e24af3a34"
        },
        {
          "url": "https://git.kernel.org/stable/c/35e351780fa9d8240dd6f7e4f245f9ea37e96c19"
        }
      ],
      "title": "fork: defer linking file vma until vma is fully initialized",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-27022",
    "datePublished": "2024-05-01T05:35:39.627Z",
    "dateReserved": "2024-02-19T14:20:24.210Z",
    "dateUpdated": "2026-08-05T11:29:04.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35895 (GCVE-0-2024-35895)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-05-12 11:52

Title

bpf, sockmap: Prevent lock inversion deadlock in map delete elem

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&host->lock); lock(&htab->buckets[i].lock); <Interrupt> lock(&host->lock); Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context. Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error. Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-23 19:25 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/f7990498b05ac41f7…
https://git.kernel.org/stable/c/dd54b48db0c822ae7…
https://git.kernel.org/stable/c/d1e73fb19a4c872d7…
https://git.kernel.org/stable/c/a44770fed86515eed…
https://git.kernel.org/stable/c/668b3074aa14829e2…
https://git.kernel.org/stable/c/6af057ccdd8e76199…
https://git.kernel.org/stable/c/ff91059932401894e…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < f7990498b05ac41f7d6a190dc0418ef1d21bf058 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < dd54b48db0c822ae7b520bc80751f0a0a173ef75 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < a44770fed86515eedb5a7c00b787f847ebb134a5 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 668b3074aa14829e2ac2759799537a93b60fef86 (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < 6af057ccdd8e7619960aca1f0428339f213b31cd (git) Affected: 604326b41a6fb9b4a78b6179335decee0365cd8c , < ff91059932401894e6c86341915615c5eb0eca48 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.85 , ≤ 6.1.* (semver) Unaffected: 6.6.26 , ≤ 6.6.* (semver) Unaffected: 6.8.5 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35895",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:25:39.256006Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:48.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7990498b05ac41f7d6a190dc0418ef1d21bf058"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd54b48db0c822ae7b520bc80751f0a0a173ef75"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a44770fed86515eedb5a7c00b787f847ebb134a5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/668b3074aa14829e2ac2759799537a93b60fef86"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6af057ccdd8e7619960aca1f0428339f213b31cd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ff91059932401894e6c86341915615c5eb0eca48"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:52:30.641Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7990498b05ac41f7d6a190dc0418ef1d21bf058",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "dd54b48db0c822ae7b520bc80751f0a0a173ef75",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "a44770fed86515eedb5a7c00b787f847ebb134a5",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "668b3074aa14829e2ac2759799537a93b60fef86",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "6af057ccdd8e7619960aca1f0428339f213b31cd",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            },
            {
              "lessThan": "ff91059932401894e6c86341915615c5eb0eca48",
              "status": "affected",
              "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\n\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\n\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026htab-\u003ebuckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026host-\u003elock);\n                               lock(\u0026htab-\u003ebuckets[i].lock);\n  \u003cInterrupt\u003e\n    lock(\u0026host-\u003elock);\n\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\n\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\n\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:13:19.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7990498b05ac41f7d6a190dc0418ef1d21bf058"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd54b48db0c822ae7b520bc80751f0a0a173ef75"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/a44770fed86515eedb5a7c00b787f847ebb134a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/668b3074aa14829e2ac2759799537a93b60fef86"
        },
        {
          "url": "https://git.kernel.org/stable/c/6af057ccdd8e7619960aca1f0428339f213b31cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff91059932401894e6c86341915615c5eb0eca48"
        }
      ],
      "title": "bpf, sockmap: Prevent lock inversion deadlock in map delete elem",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35895",
    "datePublished": "2024-05-19T08:34:50.276Z",
    "dateReserved": "2024-05-17T13:50:33.113Z",
    "dateUpdated": "2026-05-12T11:52:30.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2024:6997

CVE-2023-52439 (GCVE-0-2023-52439)

CVE-2023-52884 (GCVE-0-2023-52884)

CVE-2024-26739 (GCVE-0-2024-26739)

CVE-2024-26929 (GCVE-0-2024-26929)

CVE-2024-26930 (GCVE-0-2024-26930)

CVE-2024-26931 (GCVE-0-2024-26931)

CVE-2024-26947 (GCVE-0-2024-26947)

CVE-2024-26991 (GCVE-0-2024-26991)

CVE-2024-27022 (GCVE-0-2024-27022)

CVE-2024-35895 (GCVE-0-2024-35895)

Tags

Sightings

Nomenclature