GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

RHSA-2025:6966

Vulnerability from csaf_redhat - Published: 2025-05-13 08:28 - Updated: 2026-09-14 12:21
Summary
Red Hat Security Advisory: kernel security update
Severity
Moderate
Notes
Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm: nv04: Fix out of bounds access (CVE-2024-27008) * kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398) * kernel: pipe: wakeup wr_wait after setting max_usage (CVE-2023-52672) * kernel: net: phy: micrel: Fix potential null pointer dereference (CVE-2024-35891) * kernel: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934) * kernel: Bluetooth: btintel: Fix null ptr deref in btintel_read_version (CVE-2024-35933) * kernel: Bluetooth: Fix memory leak in hci_req_sync_complete() (CVE-2024-35978) * kernel: Bluetooth: SCO: Fix not validating setsockopt user input (CVE-2024-35967) * kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input (CVE-2024-35966) * kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input (CVE-2024-35965) * kernel: Bluetooth: ISO: Fix not validating setsockopt user input (CVE-2024-35964) * kernel: Bluetooth: hci_sock: Fix not validating setsockopt user input (CVE-2024-35963) * kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (CVE-2024-36013) * kernel: Bluetooth: msft: fix slab-use-after-free in msft_do_close() (CVE-2024-36012) * kernel: Bluetooth: HCI: Fix potential null-ptr-deref (CVE-2024-36011) * kernel: Bluetooth: qca: add missing firmware sanity checks (CVE-2024-36880) * kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (CVE-2024-36968) * kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541) * kernel: sock_map: avoid race between sock_map_close and sk_psock_put (CVE-2024-39500) * kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (CVE-2024-40956) * kernel: bpf: Fix too early release of tcx_entry (CVE-2024-41010) * kernel: bluetooth/l2cap: sync sock recv cb and release (CVE-2024-41062) * kernel: Bluetooth: Ignore too large handle values in BIG (CVE-2024-42133) * kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (CVE-2024-42253) * kernel: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CVE-2024-42265) * kernel: ASoC: TAS2781: Fix tasdev_load_calibrated_data() (CVE-2024-42278) * kernel: ice: Add a per-VF limit on number of FDIR filters (CVE-2024-42291) * kernel: block: fix deadlock between sd_remove & sd_release (CVE-2024-42294) * kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal (CVE-2024-42302) * kernel: ext4: make sure the first directory block is not a hole (CVE-2024-42304) * kernel: ext4: check dot and dotdot of dx_root before making dir indexed (CVE-2024-42305) * kernel: sysctl: always initialize i_uid/i_gid (CVE-2024-42312) * kernel: exfat: fix potential deadlock on __exfat_get_dentry_set (CVE-2024-42315) * kernel: mm/mglru: fix div-by-zero in vmpressure_calc_level() (CVE-2024-42316) * kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE (CVE-2024-42321) * kernel: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume (CVE-2024-43820) * kernel: scsi: lpfc: Fix a possible null pointer dereference (CVE-2024-43821) * kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() (CVE-2024-43823) * kernel: ext4: fix infinite loop when replaying fast_commit (CVE-2024-43828) * kernel: xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834) * kernel: lib: objagg: Fix general protection fault (CVE-2024-43846) * kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show() (CVE-2024-43853) * kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() (CVE-2024-43871) * kernel: vhost/vsock: always initialize seqpacket_allow (CVE-2024-43873) * kernel: exec: Fix ToCToU between perm check and set-uid/gid usage (CVE-2024-43882) * kernel: Bluetooth: MGMT: Add error handling to pair_device() (CVE-2024-43884) * kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889) * kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown (CVE-2024-43898) * kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses (CVE-2024-43910) * kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling (CVE-2024-43914) * kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc() (CVE-2024-44931) * kernel: idpf: fix UAFs when destroying the queues (CVE-2024-44932) * kernel: net: bridge: mcast: wait for previous gc cycles when removing port (CVE-2024-44934) * kernel: driver core: Fix uevent_show() vs driver detach race (CVE-2024-44952) * kernel: sched/smt: Fix unbalance sched_smt_present dec/inc (CVE-2024-44958) * kernel: idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964) * kernel: cgroup/cpuset: fix panic caused by partcmd_update (CVE-2024-44975) * kernel: ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987) * kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989) * kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check (CVE-2024-45000) * kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req (CVE-2024-45009) * kernel: mptcp: pm: only mark 'subflow' endp as available (CVE-2024-45010) * kernel: netem: fix return value if duplicate enqueue fails (CVE-2024-45016) * kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 (CVE-2024-45022) * kernel: scsi: aacraid: Fix double-free on probe failure (CVE-2024-46673) * kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access (CVE-2024-46675) * kernel: mptcp: pm: fix ID 0 endp usage after multiple re-creations (CVE-2024-46711) * kernel: drm/amdgpu: fix mc_data out-of-bounds read warning (CVE-2024-46722) * kernel: drm/amdgpu: fix ucode out-of-bounds read warning (CVE-2024-46723) * kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (CVE-2024-46724) * kernel: drm/amdgpu: Fix out-of-bounds write warning (CVE-2024-46725) * kernel: of/irq: Prevent device address out-of-bounds read in interrupt map walk (CVE-2024-46743) * kernel: Input: uinput - reject requests with unreasonable number of slots (CVE-2024-46745) * kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (CVE-2024-46747) * kernel: PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750) * kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops. (CVE-2024-46754) * kernel: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (CVE-2024-46756) * kernel: hwmon: (lm95234) Fix underflows seen when writing limit attributes (CVE-2024-46758) * kernel: hwmon: (adc128d818) Fix underflows seen when writing limit attributes (CVE-2024-46759) * kernel: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (CVE-2024-46761) * kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783) * kernel: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (CVE-2024-46786) * kernel: userfaultfd: fix checks for huge PMDs (CVE-2024-46787) * kernel: sch/netem: fix use after free in netem_dequeue (CVE-2024-46800) * kernel: drm/amdgpu: fix the waring dereferencing hive (CVE-2024-46805) * kernel: drm/amdgpu: Fix the warning division or modulo by zero (CVE-2024-46806) * kernel: drm/amd/amdgpu: Check tbo resource pointer (CVE-2024-46807) * kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (CVE-2024-46819) * kernel: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend (CVE-2024-46820) * kernel: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (CVE-2024-46822) * kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness (CVE-2024-46828) * kernel: drm/amdgpu: Fix smatch static checker warning (CVE-2024-46835) * kernel: workqueue: Improve scalability of workqueue watchdog touch (CVE-2024-46839) * kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug (CVE-2024-46853) * kernel: x86/hyperv: fix kexec crash due to VP assist page corruption (CVE-2024-46864) * kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (CVE-2024-46871) * kernel: fsnotify: clear PARENT_WATCHED flags lazily (CVE-2024-47660) * kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668) * kernel: sock_map: Add a cond_resched() in sock_hash_free() (CVE-2024-47710) * kernel: iommufd: Protect against overflow of ALIGN() during iova allocation (CVE-2024-47719) * kernel: nfsd: return -EINVAL when namelen is 0 (CVE-2024-47692) * kernel: block: fix potential invalid pointer dereference in blk_add_partition (CVE-2024-47705) * kernel: ACPI: sysfs: validate return type of _STR method (CVE-2024-49860) * kernel: powercap: intel_rapl: Fix off by one in get_rpi() (CVE-2024-49862) * kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow (CVE-2024-47739) * kernel: icmp: change the order of rate limits (CVE-2024-47678) * kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (CVE-2023-52917) * kernel: vdpa/mlx5: Fix invalid mr resource destroy (CVE-2024-47687) * kernel: x86/sgx: Fix deadlock in SGX NUMA node search (CVE-2024-49856) * kernel: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 (CVE-2024-47715) * kernel: wifi: rtw88: always wait for both firmware loading attempts (CVE-2024-47718) * kernel: block, bfq: fix possible UAF for bfqq->bic with merge chain (CVE-2024-47706) * kernel: nfsd: call cache_put if xdr_reserve_space returns NULL (CVE-2024-47737) * kernel: wifi: mac80211: don't use rate mask for offchannel TX either (CVE-2024-47738) * kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (CVE-2024-47713) * kernel: vhost_vdpa: assign irq bypass producer token correctly (CVE-2024-47748) * kernel: tpm: Clean up TPM space after command failure (CVE-2024-49851) * kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages() (CVE-2024-47745) * kernel: bpf, lsm: Add check for BPF LSM return value (CVE-2024-47703) * kernel: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (CVE-2024-47685) * kernel: ext4: check stripe size compatibility on remount as well (CVE-2024-47700) * kernel: nfsd: map the EBADMSG to nfserr_io to avoid warning (CVE-2024-49875) * kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (CVE-2024-49993) * kernel: tipc: guard against string buffer overrun (CVE-2024-49995) * kernel: exfat: fix memory leak in exfat_load_bitmap() (CVE-2024-50013) * kernel: Bluetooth: L2CAP: Fix uaf in l2cap_connect (CVE-2024-49950) * kernel: ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882) * kernel: cachefiles: fix dentry leak in cachefiles_open_file() (CVE-2024-49870) * kernel: ppp: do not assume bh is held in ppp_channel_bridge_input() (CVE-2024-49946) * kernel: ext4: filesystems without casefold feature cannot be mounted with siphash (CVE-2024-49968) * kernel: net: napi: Prevent overflow of napi_defer_hard_irqs (CVE-2024-50018) * kernel: ext4: fix access to uninitialised lock in fc replay path (CVE-2024-50014) * kernel: mm, slub: avoid zeroing kmalloc redzone (CVE-2024-49885) * kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (CVE-2024-49991) * kernel: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (CVE-2024-49886) * kernel: drm/amdgpu: add list empty check to avoid null pointer issue (CVE-2024-49904) * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-49929) * kernel: uprobes: fix kernel info leak via "[uprobes]" vma (CVE-2024-49975) * kernel: ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883) * kernel: ext4: fix timer use-after-free on failed mount (CVE-2024-49960) * kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (CVE-2024-49983) * kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (CVE-2024-50009) * kernel: ext4: update orig_path in ext4_find_extent() (CVE-2024-49881) * kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (CVE-2024-49938) * kernel: wifi: cfg80211: Set correct chandef when starting CAC (CVE-2024-49937) * kernel: ext4: avoid use-after-free in ext4_ext_show_leaf() (CVE-2024-49889) * kernel: resource: fix region_intersects() vs add_memory_driver_managed() (CVE-2024-49878) * kernel: wifi: ath11k: fix array out-of-bound access in SoC stats (CVE-2024-49930) * kernel: ext4: dax: fix overflowing extents beyond inode size when partially writing (CVE-2024-50015) * kernel: r8169: add tally counter fields added with RTL8125 (CVE-2024-49973) * kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements (CVE-2024-49928) * kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (CVE-2024-50006) * kernel: static_call: Replace pointless WARN_ON() in static_call_module_notify() (CVE-2024-49954) * kernel: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (CVE-2024-49934) * kernel: ext4: no need to continue when the number of entries is 1 (CVE-2024-49967) * kernel: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (CVE-2024-49959) * kernel: net: add more sanity checks to qdisc_pkt_len_init() (CVE-2024-49948) * kernel: block: fix integer overflow in BLKSECDISCARD (CVE-2024-49994) * kernel: afs: Fix the setting of the server responding flag (CVE-2024-49999) * kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (CVE-2024-49962) * kernel: NFSD: Limit the number of concurrent async COPY operations (CVE-2024-49974) * kernel: wifi: rtw89: avoid to add interface to list twice when SER (CVE-2024-49939) * kernel: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (CVE-2024-49951) * kernel: drm/amd/display: Increase array size of dummy_boolean (CVE-2024-49971) * kernel: ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935) * kernel: static_call: Handle module init failure correctly in static_call_del_module() (CVE-2024-50002) * kernel: x86/ioapic: Handle allocation failures gracefully (CVE-2024-49927) * kernel: ext4: fix slab-use-after-free in ext4_split_extent_at() (CVE-2024-49884) * kernel: net: stmmac: Fix zero-division error when disabling tc cbs (CVE-2024-49977) * kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (CVE-2024-50008) * kernel: blk_iocost: fix more out of bound shifts (CVE-2024-49933) * kernel: smb: client: fix UAF in async decryption (CVE-2024-50047) * kernel: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (CVE-2024-50038) * kernel: slip: make slhc_remember() more robust against malicious packets (CVE-2024-50033) * kernel: zram: free secondary algorithms names (CVE-2024-50064) * kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (CVE-2024-50044) * kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (CVE-2024-50029) * kernel: device-dax: correct pgoff align in dax_set_mapping() (CVE-2024-50022) * kernel: usb: typec: tipd: Free IRQ only if it was requested before (CVE-2024-50057) * kernel: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() (CVE-2024-50046) * kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id() (CVE-2024-50028) * kernel: net: Fix an unsafe loop on the list (CVE-2024-50024) * kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too (CVE-2024-50058) * kernel: driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055) * kernel: net/sched: accept TCA_STAB only for root qdisc (CVE-2024-50039) * kernel: kthread: unpark only parked kthread (CVE-2024-50019) * kernel: net: phy: Remove LED entry from LEDs list on unregister (CVE-2024-50023) * kernel: thermal: core: Free tzp copy along with the thermal zone (CVE-2024-50027) * kernel: ppp: fix ppp_async_encode() illegal access (CVE-2024-50035) * kernel: xen-netfront: Fix NULL sring after live migration (CVE-2022-48969) * kernel: net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014) * kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (CVE-2022-49029) * kernel: fscache: Fix oops due to race with cookie_lru and use_cookie (CVE-2022-48989) * kernel: tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006) * kernel: uprobe: avoid out-of-bounds memory access of fetching args (CVE-2024-50067) * kernel: Bluetooth: ISO: Fix multiple init when debugfs is disabled (CVE-2024-50077) * kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (CVE-2024-50082) * kernel: parport: Proper fix for array out-of-bounds access (CVE-2024-50074) * kernel: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (CVE-2024-50073) * kernel: blk-mq: setup queue ->tag_set before initializing hctx (CVE-2024-50081) * kernel: xhci: tegra: fix checked USB2 port number (CVE-2024-50075) * kernel: Bluetooth: Call iso_exit() on module unload (CVE-2024-50078) * kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net (CVE-2024-50121) * kernel: md/raid10: fix null ptr dereference in raid10_size() (CVE-2024-50109) * kernel: net: wwan: fix global oob in wwan_rtnl_policy (CVE-2024-50128) * kernel: net: sched: use RCU read-side critical section in taprio_dump() (CVE-2024-50126) * kernel: net: sched: fix use-after-free in taprio_change() (CVE-2024-50127) * kernel: x86: fix user address masking non-canonical speculation issue (CVE-2024-50102) * kernel: drm/amd: Guard against bad data for ATIF ACPI method (CVE-2024-50117) * kernel: smb: client: Handle kstrdup failures for passwords (CVE-2024-50120) * kernel: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses (CVE-2024-50107) * kernel: nfsd: fix race between laundromat and free_stateid (CVE-2024-50106) * kernel: thermal: intel: int340x: processor: Fix warning during module unload (CVE-2024-50093) * kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (CVE-2024-50101) * kernel: netfilter: bpf: must hold reference on net namespace (CVE-2024-50130) * kernel: bpf: devmap: provide rxq after redirect (CVE-2024-50162) * kernel: udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143) * kernel: scsi: target: core: Fix null-ptr-deref in target_alloc_device() (CVE-2024-50153) * kernel: smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151) * kernel: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (CVE-2024-50163) * kernel: vsock: Update rx_bytes on read_skb() (CVE-2024-50169) * kernel: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (CVE-2024-50141) * kernel: usb: typec: altmode should keep reference to parent (CVE-2024-50150) * kernel: smb: client: fix possible double free in smb2_set_ea() (CVE-2024-50152) * kernel: ext4: don't set SB_RDONLY after filesystem errors (CVE-2024-50191) * kernel: maple_tree: correct tree corruption on spanning store (CVE-2024-50200) * kernel: pinctrl: intel: platform: fix error path in device_for_each_child_node() (CVE-2024-50197) * kernel: net: explicitly clear the sk pointer, when pf->create fails (CVE-2024-50186) * kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() (CVE-2024-50189) * kernel: drm/radeon: Fix encoder->possible_clones (CVE-2024-50201) * kernel: mm/swapfile: skip HugeTLB pages for unuse_vma (CVE-2024-50199) * kernel: secretmem: disable memfd_secret() if arch cannot set direct map (CVE-2024-50182) * kernel: wifi: ath10k: Fix memory leak in management tx (CVE-2024-50236) * kernel: mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (CVE-2024-50219) * kernel: mm: shmem: fix data-race in shmem_getattr() (CVE-2024-50228) * kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free (CVE-2024-50235) * kernel: nvmet-auth: assign dh_key to NULL after kfree_sensitive (CVE-2024-50215) * kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (CVE-2024-50256) * kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (CVE-2024-50237) * kernel: xfs: fix finding a last resort AG in xfs_filestream_pick_ag (CVE-2024-50216) * kernel: macsec: Fix use-after-free while sending the offloading packet (CVE-2024-50261) * kernel: signal: restore the override_rlimit logic (CVE-2024-50271) * kernel: dm cache: fix potential out-of-bounds access on the first resume (CVE-2024-50278) * kernel: filemap: Fix bounds checking in filemap_read() (CVE-2024-50272) * kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() (CVE-2024-50282) * kernel: sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299) * kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended (CVE-2024-53070) * kernel: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (CVE-2024-53060) * kernel: virtio_net: Add hash_key_length check (CVE-2024-53082) * kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (CVE-2024-53042) * kernel: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057) * kernel: wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055) * kernel: tpm: Lock TPM chip in tpm_pm_suspend() first (CVE-2024-53085) * kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (CVE-2024-50304) * kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (CVE-2024-53050) * kernel: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051) * kernel: mptcp: init: protect sched with rcu_read_lock (CVE-2024-53047) * kernel: platform/x86/amd/pmc: Detect when STB is not available (CVE-2024-53072) * kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal (CVE-2024-53074) * kernel: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() (CVE-2024-53044) * kernel: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (CVE-2024-53059) * kernel: smb: client: Fix use-after-free of network namespace. (CVE-2024-53095) * kernel: nvme-multipath: defer partition scanning (CVE-2024-53093) * kernel: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (CVE-2024-53091) * kernel: mm: resolve faulty mmap_region() error path behaviour (CVE-2024-53096) * kernel: mm: krealloc: Fix MTE false alarm in __do_krealloc (CVE-2024-53097) * kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (CVE-2024-53103) * kernel: vsock: Fix sk_error_queue memory leak (CVE-2024-53118) * kernel: mptcp: error out earlier on disconnect (CVE-2024-53123) * kernel: net: fix data-races around sk->sk_forward_alloc (CVE-2024-53124) * kernel: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (CVE-2024-53105) * kernel: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (CVE-2024-53120) * kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling (CVE-2024-53117) * kernel: net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121) * kernel: vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110) * kernel: mm: revert "mm: shmem: fix data-race in shmem_getattr()" (CVE-2024-53136) * kernel: pmdomain: imx93-blk-ctrl: correct remove path (CVE-2024-53134) * kernel: initramfs: avoid filename buffer overrun (CVE-2024-53142) * kernel: NFSD: Prevent a potential integer overflow (CVE-2024-53146) * kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() (CVE-2024-53152) * kernel: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (CVE-2024-53156) * kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161) * kernel: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (CVE-2024-53160) * kernel: net: sched: fix ordering of qlen adjustment (CVE-2024-53164) * kernel: PCI: Fix use-after-free of slot->bus on hot remove (CVE-2024-53194) * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222) * kernel: block, bfq: fix bfqq uaf in bfq_limit_depth() (CVE-2024-53166) * kernel: Bluetooth: fix use-after-free in device_for_each_child() (CVE-2024-53237) * kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation (CVE-2024-53213) * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (CVE-2024-53208) * kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (CVE-2024-53173) * kernel: RDMA/mlx5: Move events notifier registration to be after device registration (CVE-2024-53224) * kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (CVE-2024-53190) * kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (CVE-2024-53203) * kernel: SUNRPC: make sure cache entry active before cache_show (CVE-2024-53174) * kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync (CVE-2024-56591) * kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() (CVE-2024-56562) * kernel: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (CVE-2024-56611) * kernel: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() (CVE-2024-56535) * kernel: net: inet6: do not leave a dangling sk pointer in inet6_create() (CVE-2024-56600) * kernel: scsi: qla2xxx: Fix use after free on unload (CVE-2024-56623) * kernel: mm/slub: Avoid list corruption when removing a slab from the full list (CVE-2024-56566) * kernel: ovl: Filter invalid inodes with missing lookup function (CVE-2024-56570) * kernel: net: inet: do not leave a dangling sk pointer in inet_create() (CVE-2024-56601) * kernel: drm/amdgpu: fix usage slab after free (CVE-2024-56551) * kernel: drm/dp_mst: Fix MST sideband message body length check (CVE-2024-56616) * kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (CVE-2024-56590) * kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (CVE-2024-56604) * kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (CVE-2024-56602) * kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (CVE-2024-56605) * kernel: scsi: sg: Fix slab-use-after-free read in sg_release() (CVE-2024-56631) * kernel: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump (CVE-2024-56653) * kernel: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (CVE-2024-56663) * kernel: drm/i915: Fix NULL pointer dereference in capture_engine (CVE-2024-56667) * kernel: net/ipv6: release expired exception dst cached in socket (CVE-2024-56644) * kernel: net: Fix icmp host relookup triggering ip_rt_bug (CVE-2024-56647) * kernel: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (CVE-2024-56642) * kernel: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (CVE-2024-56654) * kernel: xsk: fix OOB map writes when deleting elements (CVE-2024-56614) * kernel: nfsd: make sure exp active before svc_export_show (CVE-2024-56558) * kernel: bpf, sockmap: Fix race between element replace and close() (CVE-2024-56664) * kernel: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (CVE-2024-56688) * kernel: brd: defer automatic disk creation until module initialization succeeds (CVE-2024-56693) * kernel: smb: Initialize cfid->tcon before performing network ops (CVE-2024-56729) * kernel: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect (CVE-2024-56757) * kernel: PCI/MSI: Handle lack of irqdomain gracefully (CVE-2024-56760) * kernel: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level (CVE-2024-56783) * kernel: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (CVE-2024-56779) * kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (CVE-2024-48873) * kernel: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (CVE-2024-57798) * kernel: Bluetooth: iso: Fix circular lock in iso_listen_bis (CVE-2024-54460) * kernel: smb: client: fix TCP timers deadlock after rmmod (CVE-2024-54680) * kernel: nvme-rdma: unquiesce admin_q before destroy it (CVE-2024-49569) * kernel: virtio-net: fix overflow inside virtnet_rq_alloc (CVE-2024-57843) * kernel: Bluetooth: iso: Always release hdev at the end of iso_listen_bis (CVE-2024-57879) * kernel: pinmux: Use sequential access to access desc->pinmux data (CVE-2024-47141) * kernel: PCI: imx6: Fix suspend/resume support on i.MX6QDL (CVE-2024-57809) * kernel: Bluetooth: hci_core: Fix sleeping function called from invalid context (CVE-2024-57894) * kernel: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (CVE-2024-57888) * kernel: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (CVE-2024-57884) * kernel: wifi: cfg80211: clear link ID from bitmap during link delete after clean up (CVE-2024-57898) * kernel: RDMA/uverbs: Prevent integer overflow issue (CVE-2024-57890) * kernel: nvmet: Don't overflow subsysnqn (CVE-2024-53681) * kernel: afs: Fix the maximum cell name length (CVE-2025-21646) * kernel: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (CVE-2024-57929) * kernel: exfat: fix the infinite loop in exfat_readdir() (CVE-2024-57940) * kernel: selinux: ignore unknown extended permissions (CVE-2024-57931) * kernel: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (CVE-2025-21663) * kernel: vsock/virtio: discard packets if the transport changes (CVE-2025-21669) * kernel: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] (CVE-2025-21666) * kernel: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (CVE-2025-21668) * kernel: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (CVE-2025-21689) * kernel: fs/proc: fix softlockup in __read_vmcore (part 2) (CVE-2025-21694) * kernel: Secure Boot does not automatically enable kernel lockdown (CVE-2025-1272) * kernel: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame (CVE-2024-58099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2022-48969

A flaw was found in the Linux kernel's xen-netfront component. During a live migration of a virtual machine, the Networked Asynchronous Packet Interface (NAPI) for the old network shared ring (sring) is not properly removed before a new one is established. A local attacker with low privileges could exploit this timing issue by enabling `busy_poll` or `busy_read` when resuming a virtual machine. This can lead to a NULL pointer dereference, causing a system crash and a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-debug-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-debug-devel-matched-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-64k-devel-matched-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-matched-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-matched-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-matched-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debug-devel-matched-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-common-aarch64-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-common-ppc64le-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-common-s390x-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-debuginfo-common-x86_64-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-matched-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-matched-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-matched-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-devel-matched-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-doc-0:5.14.0-570.12.1.el9_6.noarch —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-zfcpdump-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-zfcpdump-devel-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:kernel-zfcpdump-devel-matched-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rtla-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rtla-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rtla-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rtla-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rv-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rv-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rv-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.6.0.GA:rv-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-0:5.14.0-570.12.1.el9_6.src —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debug-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-64k-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-abi-stablelists-0:5.14.0-570.12.1.el9_6.noarch —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-core-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-core-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-core-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-extra-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-extra-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debug-uki-virt-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-common-aarch64-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-common-ppc64le-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-common-s390x-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-debuginfo-common-x86_64-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-core-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-extra-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-extra-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-libs-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-libs-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-tools-libs-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-uki-virt-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-uki-virt-addons-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-modules-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-modules-core-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:kernel-zfcpdump-modules-extra-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: BaseOS-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-common-aarch64-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-common-ppc64le-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-common-s390x-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-debuginfo-common-x86_64-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-libs-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-libs-devel-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-tools-libs-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:kernel-zfcpdump-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.s390x —
Vendor Fix fix
Workaround
Unresolved product id: CRB-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-debuginfo-common-x86_64-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-kvm-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debug-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-kvm-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-rt-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: NFV-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debuginfo-common-aarch64-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-debuginfo-common-x86_64-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debug-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-64k-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debug-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-devel-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-devel-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-core-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-core-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-extra-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-rt-modules-extra-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:kernel-tools-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:libperf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: RT-9.6.0.GA:python3-perf-debuginfo-0:5.14.0-570.12.1.el9_6.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2022-48989

A flaw was found in the Linux kernel's fscache component. A race condition can occur when a cached object is being discarded while another process attempts to use it. This timing issue can lead to a null pointer dereference, causing the system to crash and resulting in a denial of service.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49006

A flaw was found in the Linux kernel's tracing component. A local attacker can exploit this vulnerability by repeatedly adding and removing dynamic tracing events. This action can lead to the reuse of event type numbers, causing the kernel to crash and resulting in a denial of service. Additionally, it may lead to information disclosure by misinterpreting data in the tracing ring buffer.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49014

A flaw was found in the Linux kernel's `net: tun` module. A use-after-free vulnerability exists in the `tun_detach()` function. An attacker with administrative (root) privileges could exploit this by causing a network structure to be prematurely released and then accessed, leading to a system crash (denial of service). This vulnerability could potentially be leveraged for arbitrary code execution.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49029

A flaw was found in the `hwmon` (hardware monitoring) subsystem of the Linux kernel, specifically within the `ibmpex` driver. This vulnerability is a Use-After-Free (UAF) error, which occurs when the system attempts to use memory that has already been released. An attacker with administrative privileges could exploit this flaw, potentially leading to a system crash or other unpredictable behavior.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49747

In the Linux kernel, the following vulnerability has been resolved: erofs/zmap.c: Fix incorrect offset calculation Effective offset to add to length was being incorrectly calculated, which resulted in iomap->length being set to 0, triggering a WARN_ON in iomap_iter_done(). Fix that, and describe it in comments. This was reported as a crash by syzbot under an issue about a warning encountered in iomap_iter_done(), but unrelated to erofs. C reproducer: https://syzkaller.appspot.com/text?tag=ReproC&x=1037a6b2880000 Kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=e2021a61197ebe02 Dashboard link: https://syzkaller.appspot.com/bug?extid=a8e049cd3abd342936b6

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-682 - Incorrect Calculation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-49778

In the Linux kernel, the following vulnerability has been resolved: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud The page table check trigger BUG_ON() unexpectedly when collapse hugepage: ------------[ cut here ]------------ kernel BUG at mm/page_table_check.c:82! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 6 PID: 68 Comm: khugepaged Not tainted 6.1.0-rc3+ #750 Hardware name: linux,dummy-virt (DT) pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : page_table_check_clear.isra.0+0x258/0x3f0 lr : page_table_check_clear.isra.0+0x240/0x3f0 [...] Call trace: page_table_check_clear.isra.0+0x258/0x3f0 __page_table_check_pmd_clear+0xbc/0x108 pmdp_collapse_flush+0xb0/0x160 collapse_huge_page+0xa08/0x1080 hpage_collapse_scan_pmd+0xf30/0x1590 khugepaged_scan_mm_slot.constprop.0+0x52c/0xac8 khugepaged+0x338/0x518 kthread+0x278/0x2f8 ret_from_fork+0x10/0x20 [...] Since pmd_user_accessible_page() doesn't check if a pmd is leaf, it decrease file_map_count for a non-leaf pmd comes from collapse_huge_page(). and so trigger BUG_ON() unexpectedly. Fix this problem by using pmd_leaf() insteal of pmd_present() in pmd_user_accessible_page(). Moreover, use pud_leaf() for pud_user_accessible_page() too.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49804

In the Linux kernel, the following vulnerability has been resolved: s390: avoid using global register for current_stack_pointer Commit 30de14b1884b ("s390: current_stack_pointer shouldn't be a function") made current_stack_pointer a global register variable like on many other architectures. Unfortunately on s390 it uncovers old gcc bug which is fixed only since gcc-9.1 [gcc commit 3ad7fed1cc87 ("S/390: Fix PR89775. Stackpointer save/restore instructions removed")] and backported to gcc-8.4 and later. Due to this bug gcc versions prior to 8.4 generate broken code which leads to stack corruptions. Current minimal gcc version required to build the kernel is declared as 5.1. It is not possible to fix all old gcc versions, so work around this problem by avoiding using global register variable for current_stack_pointer.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-49815

In the Linux kernel, the following vulnerability has been resolved: erofs: fix missing xas_retry() in fscache mode The xarray iteration only holds the RCU read lock and thus may encounter XA_RETRY_ENTRY if there's process modifying the xarray concurrently. This will cause oops when referring to the invalid entry. Fix this by adding the missing xas_retry(), which will make the iteration wind back to the root node if XA_RETRY_ENTRY is encountered.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50112

In the Linux kernel, the following vulnerability has been resolved: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-50121

In the Linux kernel, the following vulnerability has been resolved: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init Every iteration of for_each_available_child_of_node() decrements the reference count of the previous node. When breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node. Add missing of_node_put() to avoid refcount leak.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-911 - Improper Update of Reference Count
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50159

In the Linux kernel, the following vulnerability has been resolved: of: check previous kernel's ima-kexec-buffer against memory bounds Presently ima_get_kexec_buffer() doesn't check if the previous kernel's ima-kexec-buffer lies outside the addressable memory range. This can result in a kernel panic if the new kernel is booted with 'mem=X' arg and the ima-kexec-buffer was allocated beyond that range by the previous kernel. The panic is usually of the form below: $ sudo kexec --initrd initrd vmlinux --append='mem=16G' <snip> BUG: Unable to handle kernel data access on read at 0xc000c01fff7f0000 Faulting instruction address: 0xc000000000837974 Oops: Kernel access of bad area, sig: 11 [#1] <snip> NIP [c000000000837974] ima_restore_measurement_list+0x94/0x6c0 LR [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160 Call Trace: [c00000000371fa80] [c00000000083b55c] ima_load_kexec_buffer+0xac/0x160 [c00000000371fb00] [c0000000020512c4] ima_init+0x80/0x108 [c00000000371fb70] [c0000000020514dc] init_ima+0x4c/0x120 [c00000000371fbf0] [c000000000012240] do_one_initcall+0x60/0x2c0 [c00000000371fcc0] [c000000002004ad0] kernel_init_freeable+0x344/0x3ec [c00000000371fda0] [c0000000000128a4] kernel_init+0x34/0x1b0 [c00000000371fe10] [c00000000000ce64] ret_from_kernel_thread+0x5c/0x64 Instruction dump: f92100b8 f92100c0 90e10090 910100a0 4182050c 282a0017 3bc00000 40810330 7c0802a6 fb610198 7c9b2378 f80101d0 <a1240000> 2c090001 40820614 e9240010 ---[ end trace 0000000000000000 ]--- Fix this issue by checking returned PFN range of previous kernel's ima-kexec-buffer with page_is_ram() to ensure correct memory bounds.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50214

In the Linux kernel, the following vulnerability has been resolved: coresight: Clear the connection field properly coresight devices track their connections (output connections) and hold a reference to the fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the references are dropped. This happens both ways: a) For all output connections from the device, drop the reference to the target device via coresight_release_platform_data() b) Iterate over all the devices on the coresight bus and drop the reference to fwnode if *this* device is the target of the output connection, via coresight_remove_conns()->coresight_remove_match(). However, the coresight_remove_match() doesn't clear the fwnode field, after dropping the reference, this causes use-after-free and additional refcount drops on the fwnode. e.g., if we have two devices, A and B, with a connection, A -> B. If we remove B first, B would clear the reference on B, from A via coresight_remove_match(). But when A is removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops the reference in coresight_release_platform_data(), raising the bells like : [ 91.990153] ------------[ cut here ]------------ [ 91.990163] refcount_t: addition on 0; use-after-free. [ 91.990212] WARNING: CPU: 0 PID: 461 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x144 [ 91.990260] Modules linked in: coresight_funnel coresight_replicator coresight_etm4x(-) crct10dif_ce coresight ip_tables x_tables ipv6 [last unloaded: coresight_cpu_debug] [ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+ #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 [ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 91.990454] pc : refcount_warn_saturate+0xa0/0x144 [ 91.990476] lr : refcount_warn_saturate+0xa0/0x144 [ 91.990496] sp : ffff80000c843640 [ 91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27: ffff80000c8439a8 [ 91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8 [ 91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20: 0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40 [ 91.990708] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80000abf6fa0 [ 91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12: 657466612d657375 [ 91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28 [ 91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572 [ 91.990903] x5 : ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027 [ 91.990952] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012] refcount_warn_saturate+0xa0/0x144 [ 91.991034] kobject_get+0xac/0xb0 [ 91.991055] of_node_get+0x2c/0x40 [ 91.991076] of_fwnode_get+0x40/0x60 [ 91.991094] fwnode_handle_get+0x3c/0x60 [ 91.991116] fwnode_get_nth_parent+0xf4/0x110 [ 91.991137] fwnode_full_name_string+0x48/0xc0 [ 91.991158] device_node_string+0x41c/0x530 [ 91.991178] pointer+0x320/0x3ec [ 91.991198] vsnprintf+0x23c/0x750 [ 91.991217] vprintk_store+0x104/0x4b0 [ 91.991238] vprintk_emit+0x8c/0x360 [ 91.991257] vprintk_default+0x44/0x50 [ 91.991276] vprintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315] of_node_release+0x13c/0x14c [ 91.991334] kobject_put+0x98/0x114 [ 91.991354] of_node_put+0x24/0x34 [ 91.991372] of_fwnode_put+0x40/0x5c [ 91.991390] fwnode_handle_put+0x38/0x50 [ 91.991411] coresight_release_platform_data+0x74/0xb0 [coresight] [ 91.991472] coresight_unregister+0x64/0xcc [coresight] [ 91.991525] etm4_remove_dev+0x64/0x78 [coresight_etm4x] [ 91.991563] etm4_remove_amba+0x1c/0x2c [coresight_etm4x] [ 91.991598] amba_remove+0x3c/0x19c ---truncated---

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50319

A flaw was found in the Linux kernel. A local user can trigger a Denial of Service (DoS) in the coresight: trbe module. This occurs when the module is removed, as it improperly manages CPU hotplug instances, leading to a system warning and an error.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-431 - Missing Handler
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-50421

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Avoid double destroy of default endpoint The rpmsg_dev_remove() in rpmsg_core is the place for releasing this default endpoint. So need to avoid destroying the default endpoint in rpmsg_chrdev_eptdev_destroy(), this should be the same as rpmsg_eptdev_release(). Otherwise there will be double destroy issue that ept->refcount report warning: refcount_t: underflow; use-after-free. Call trace: refcount_warn_saturate+0xf8/0x150 virtio_rpmsg_destroy_ept+0xd4/0xec rpmsg_dev_remove+0x60/0x70 The issue can be reproduced by stopping remoteproc before closing the /dev/rpmsgX.

5.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50491

A context violation bug was found in the Linux kernel's CoreSight CTI (Cross Trigger Interface) driver in the hardware enable/disable functions. These functions are called from atomic context but attempt runtime PM operations that can sleep when communicating with firmware. This causes "sleeping function called from invalid context" errors and system hangs when enabling CoreSight tracing, particularly on ARM Juno platforms, resulting in denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-1322 - Use of Blocking Code in Single-threaded, Non-blocking Context
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-50511

In the Linux kernel, the following vulnerability has been resolved: lib/fonts: fix undefined behavior in bit shift for get_default_font Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20 left shift of 1 by 31 places cannot be represented in type 'int' <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c get_default_font+0x1c7/0x1f0 fbcon_startup+0x347/0x3a0 do_take_over_console+0xce/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-1335 - Incorrect Bitwise Shift of Integer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-50614

A flaw was found in the Linux kernel's `pci_endpoint_test` module. A local attacker with low privileges could exploit this vulnerability by providing a zero-length Direct Memory Access (DMA) mapping to the `dma_map_single()` function. This improper input validation can lead to a kernel panic, resulting in a Denial of Service (DoS) on the affected system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-130 - Improper Handling of Length Parameter Inconsistency
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2022-50743

A flaw was found in the Linux kernel's erofs filesystem. A local user can trigger a memory leak by exploiting a condition in the `z_erofs_register_pcluster()` function where a pcluster's block address is zero, leading to an unreleased reference count. This vulnerability can result in resource exhaustion, causing a Denial of Service (DoS) on the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2022-50811

A resource leak flaw was found in the Linux kernel's EROFS filesystem. When z_erofs_get_extent_compressedlen() fails, the corresponding meta buffer is not properly unmapped, leading to a memory leak over time.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-52672

CVE-2023-52672 is a vulnerability in the Linux kernel's pipe subsystem caused by a regression in how pipes are resized. When a pipe is full and resized, incorrect handling of wakeups for writers can lead to deadlocks or system lockups. This issue has been resolved by ensuring that the pipe's usage limits are updated before wakeup calls are triggered, avoiding race conditions. Updating to a patched kernel version will mitigate this vulnerability and ensure system stability.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-52917

[REJECTED CVE] In the Linux kernel, the following vulnerability has been resolved: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-253 - Incorrect Check of Function Return Value
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53066

A flaw was found in the QED SR-IOV support in the Linux kernel. Improper validation of the value returned from the qed_iov_get_vf_info function can cause a NULL pointer dereference and result in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53117

In the Linux kernel, the following vulnerability has been resolved: fs: prevent out-of-bounds array speculation when closing a file descriptor Google-Bug-Id: 114199369

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-385 - Covert Timing Channel
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53196

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix potential memory leak Function dwc3_qcom_probe() allocates memory for resource structure which is pointed by parent_res pointer. This memory is not freed. This leads to memory leak. Use stack memory to prevent memory leak. Found by Linux Verification Center (linuxtesting.org) with SVACE.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53260

In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_permission() Following process: P1 P2 path_lookupat link_path_walk inode_permission ovl_permission ovl_i_path_real(inode, &realpath) path->dentry = ovl_i_dentry_upper(inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL realinode = d_inode(realpath.dentry) // return NULL inode_permission(realinode) inode->i_sb // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 335.664979] BUG: kernel NULL pointer dereference, address: 0000000000000002 [ 335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0 [ 335.669956] RIP: 0010:inode_permission+0x33/0x2c0 [ 335.678939] Call Trace: [ 335.679165] <TASK> [ 335.679371] ovl_permission+0xde/0x320 [ 335.679723] inode_permission+0x15e/0x2c0 [ 335.680090] link_path_walk+0x115/0x550 [ 335.680771] path_lookupat.isra.0+0xb2/0x200 [ 335.681170] filename_lookup+0xda/0x240 [ 335.681922] vfs_statx+0xa6/0x1f0 [ 335.682233] vfs_fstatat+0x7b/0xb0 Fetch a reproducer in [Link]. Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53261

In the Linux kernel, the following vulnerability has been resolved: coresight: Fix memory leak in acpi_buffer->pointer There are memory leaks reported by kmemleak: ... unreferenced object 0xffff00213c141000 (size 1024): comm "systemd-udevd", pid 2123, jiffies 4294909467 (age 6062.160s) hex dump (first 32 bytes): 04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff ...........<!... 00 00 00 00 00 00 00 00 03 00 00 00 10 00 00 00 ................ backtrace: [<000000004b7c9001>] __kmem_cache_alloc_node+0x2f8/0x348 [<00000000b0fc7ceb>] __kmalloc+0x58/0x108 [<0000000064ff4695>] acpi_os_allocate+0x2c/0x68 [<000000007d57d116>] acpi_ut_initialize_buffer+0x54/0xe0 [<0000000024583908>] acpi_evaluate_object+0x388/0x438 [<0000000017b2e72b>] acpi_evaluate_object_typed+0xe8/0x240 [<000000005df0eac2>] coresight_get_platform_data+0x1b4/0x988 [coresight] ... The ACPI buffer memory (buf.pointer) should be freed. But the buffer is also used after returning from acpi_get_dsd_graph(). Move the temporary variables buf to acpi_coresight_parse_graph(), and free it before the function return to prevent memory leak.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53287

A flaw was found in the Linux kernel's cdns3 USB driver. During the device resume process, the pm_runtime_set_active function was incorrectly called from within a spin lock, which is an atomic operation. This improper handling can lead to a system crash, resulting in a Denial of Service (DoS). A local attacker could potentially trigger this condition.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-663 - Use of a Non-reentrant Function in a Concurrent Context
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53510

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0

5.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-821 - Incorrect Synchronization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53519

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: add lock to protect parameter num_rdy Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function: v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&] kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: kworker/u16:3:  v4l2_m2m_buf_queue+0xd8/0x10c

5.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CWE-820 - Missing Synchronization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53555

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: initialize damo_filter->list from damos_new_filter() damos_new_filter() is not initializing the list field of newly allocated filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not initializing it after calling damos_new_filter(). As a result, accessing uninitialized memory is possible. Actually, adding multiple DAMOS filters via DAMON sysfs interface caused NULL pointer dereferencing. Initialize the field just after the allocation from damos_new_filter().

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53568

A resource leak was found in the Linux kernel's s390 cryptographic device driver in the device creation path. When the dev_set_name function fails during creation of a zcrypt device node, the zcdn_create function returns an error without freeing the newly allocated device structure and associated resources. This creates a permanent memory leak, leading to resource exhaustion and denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53595

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: mcs: Fix NULL pointer dereferences When system is rebooted after creating macsec interface below NULL pointer dereference crashes occurred. This patch fixes those crashes by using correct order of teardown [ 3324.406942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 3324.415726] Mem abort info: [ 3324.418510] ESR = 0x96000006 [ 3324.421557] EC = 0x25: DABT (current EL), IL = 32 bits [ 3324.426865] SET = 0, FnV = 0 [ 3324.429913] EA = 0, S1PTW = 0 [ 3324.433047] Data abort info: [ 3324.435921] ISV = 0, ISS = 0x00000006 [ 3324.439748] CM = 0, WnR = 0 .... [ 3324.575915] Call trace: [ 3324.578353] cn10k_mdo_del_secy+0x24/0x180 [ 3324.582440] macsec_common_dellink+0xec/0x120 [ 3324.586788] macsec_notify+0x17c/0x1c0 [ 3324.590529] raw_notifier_call_chain+0x50/0x70 [ 3324.594965] call_netdevice_notifiers_info+0x34/0x7c [ 3324.599921] rollback_registered_many+0x354/0x5bc [ 3324.604616] unregister_netdevice_queue+0x88/0x10c [ 3324.609399] unregister_netdev+0x20/0x30 [ 3324.613313] otx2_remove+0x8c/0x310 [ 3324.616794] pci_device_shutdown+0x30/0x70 [ 3324.620882] device_shutdown+0x11c/0x204 [ 966.664930] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 966.673712] Mem abort info: [ 966.676497] ESR = 0x96000006 [ 966.679543] EC = 0x25: DABT (current EL), IL = 32 bits [ 966.684848] SET = 0, FnV = 0 [ 966.687895] EA = 0, S1PTW = 0 [ 966.691028] Data abort info: [ 966.693900] ISV = 0, ISS = 0x00000006 [ 966.697729] CM = 0, WnR = 0 [ 966.833467] Call trace: [ 966.835904] cn10k_mdo_stop+0x20/0xa0 [ 966.839557] macsec_dev_stop+0xe8/0x11c [ 966.843384] __dev_close_many+0xbc/0x140 [ 966.847298] dev_close_many+0x84/0x120 [ 966.851039] rollback_registered_many+0x114/0x5bc [ 966.855735] unregister_netdevice_many.part.0+0x14/0xa0 [ 966.860952] unregister_netdevice_many+0x18/0x24 [ 966.865560] macsec_notify+0x1ac/0x1c0 [ 966.869303] raw_notifier_call_chain+0x50/0x70 [ 966.873738] call_netdevice_notifiers_info+0x34/0x7c [ 966.878694] rollback_registered_many+0x354/0x5bc [ 966.883390] unregister_netdevice_queue+0x88/0x10c [ 966.888173] unregister_netdev+0x20/0x30 [ 966.892090] otx2_remove+0x8c/0x310 [ 966.895571] pci_device_shutdown+0x30/0x70 [ 966.899660] device_shutdown+0x11c/0x204 [ 966.903574] __do_sys_reboot+0x208/0x290 [ 966.907487] __arm64_sys_reboot+0x20/0x30 [ 966.911489] el0_svc_handler+0x80/0x1c0 [ 966.915316] el0_svc+0x8/0x180 [ 966.918362] Code: f9400000 f9400a64 91220014 f94b3403 (f9400060) [ 966.924448] ---[ end trace 341778e799c3d8d7 ]---

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53654

A bounds-checking error was found in the Linux kernel Marvell OcteonTX2 network driver's initialization code. On systems with newer CN10K RPM or CN10KB RPM_USX hardware, a local user with privileges to initialize the driver can trigger driver probe, causing the driver to make incorrect assumptions about hardware topology and access Coherent Global Interconnect eXchange blocks and Logical MAC interfaces using invalid array indices, which leads to out-of-bounds memory access and denial of service through kernel panic.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-53859

A kernel warning vulnerability was found in the s390 architecture idle handling in the Linux kernel. The arch_cpu_idle() function was not marked as noinstr (no instrumentation), causing RCU and tracing warnings when ftrace is enabled. This can trigger kernel warnings and potential issues with tracing in idle paths on s390 systems.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-166 - Improper Handling of Missing Special Element
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-53989

A logic flaw was found in the Linux kernel's arm64 memory management subsystem. The virtual address range sanity check in create_mapping_noalloc() and update_mapping_prot() uses an incorrect condition that only excludes the KASAN shadow region and module region, rather than properly validating addresses translated via TTBR1. This check was the result of historical code changes that inadvertently introduced an erroneous condition.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-54089

A flaw was discovered in the virtio_pmem driver in the Linux kernel, where flush block I/O requests did not have the required REQ_OP_WRITE operation code assigned before submission. Under workloads involving persistent memory block devices — for example, running mkfs.xfs on a pmem device,this omission can lead to bio submission warnings and improper block I/O handling.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-672 - Operation on a Resource after Expiration or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-54117

A kernel crash vulnerability was found in the Linux kernel's s390 dcssblk driver. Missing dax_remove_host() calls in the device removal path, combined with broken error handling in the device add path, cause stale xarray entries and list_add corruption. When a previously used gendisk pointer is reused, the kernel crashes with list corruption during subsequent device operations.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-459 - Incomplete Cleanup
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-54230

A reference count leak was found in the ARM AMBA bus driver. When AMBA devices are created from device tree, the of_node reference count is incremented but never decremented in amba_device_release(), causing gradual memory leaks.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-911 - Improper Update of Reference Count
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-54278

In the Linux kernel’s s390/vmem subsystem, a flaw exists in the handling of virtual memory area initialization when debug pagealloc is enabled. Under certain conditions, the kernel may access memory after it has been freed or mishandled during early boot or subsystem initialization, resulting in a use-after-free condition that can cause an early kernel crash or undefined behavior on affected s390 systems.

5.8 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2023-54313

A flaw was found in the OverlayFS (ovl) component of the Linux kernel. A local user can trigger a null pointer dereference by performing a specific sequence of file system operations. This vulnerability occurs when the ovl_get_acl_rcu() function attempts to access a real inode that has been set to NULL due to a race condition during inode destruction. Successful exploitation leads to a kernel crash, causing a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2023-54322

A stack trace handling issue was found in ARM64 kernels. Without CONFIG_FUNCTION_GRAPH_TRACER, the IRQ entry function is not properly marked, causing filter_irq_stacks() to fail and potentially causing stack depot overflow warnings under KASAN.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-440 - Expected Behavior Violation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-27008

A flaw was found in the Linux kernel’s nouveau module. An out-of-bounds access issue can be triggered when the Output Resource is zero, resulting in a denial of service.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-27398

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated---

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-35891

A flaw was found in the Linux kernel's net: phy: micrel component. Specifically, within the lan8814_get_sig_rx() and lan8814_get_sig_tx() functions, a null pointer dereference can occur if ptp_parse_header() returns a NULL ptp_header due to an abnormal or corrupted packet. A remote attacker could exploit this by sending specially crafted network packets, leading to a system crash and a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35933

A NULL pointer dereference flaw was found in btintel_read_version in the Linux kernel. This issue may result in a crash.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35934

In the Linux kernel, the following vulnerability has been resolved: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() Many syzbot reports show extreme rtnl pressure, and many of them hint that smc acquires rtnl in netns creation for no good reason [1] This patch returns early from smc_pnet_net_init() if there is no netdevice yet. I am not even sure why smc_pnet_create_pnetids_list() even exists, because smc_pnet_netdev_event() is also calling smc_pnet_add_base_pnetid() when handling NETDEV_UP event. [1] extract of typical syzbot reports 2 locks held by syz-executor.3/12252: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12253: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12257: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12261: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.0/12265: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.3/12268: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.4/12271: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.1/12274: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878 2 locks held by syz-executor.2/12280: #0: ffffffff8f369610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x4c7/0x7b0 net/core/net_namespace.c:491 #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:809 [inline] #1: ffffffff8f375b88 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x10a/0x1e0 net/smc/smc_pnet.c:878

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-35963

A denial of service vulnerability was found in the Linux kernel. No input validation is performed in the Bluetooth hci_sock function. This vulnerability could lead to a crash, resulting in the loss of system availability.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35964

CVE-2024-35964 is a vulnerability in the Linux kernel’s Bluetooth ISO implementation. It occurs because the setsockopt function does not properly validate the size of user-provided data before copying it into kernel memory. This flaw can lead to buffer overflows, potentially resulting in crashes or code execution.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35965

CVE-2024-35965 is a vulnerability in the Linux kernel's Bluetooth L2CAP implementation, caused by inadequate input length validation in the setsockopt function. This flaw allows overly large user-provided data to be copied into kernel memory, potentially leading to buffer overflows, system instability, or privilege escalation. The issue has been fixed by adding proper checks to ensure data size is within acceptable limits. Users should update their Linux kernel to the patched version to mitigate this risk.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35966

This is a vulnerability in the Linux kernel's Bluetooth RFCOMM protocol. It occurs because the rfcomm_sock_setsockopt_old() function fails to properly validate the length of user-supplied data, leading to out-of-bounds memory reads. This flaw could result in system instability or crashes.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35967

This CVE pertains to a vulnerability in the Linux kernel's Bluetooth subsystem, specifically within the SCO (Synchronous Connection-Oriented) protocol. The issue arises from the sco_sock_setsockopt() function, which copies data without properly validating the length of user input. This oversight can lead to a slab-out-of-bounds read, potentially causing system instability or crashes.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-35978

This CVE identifies a memory leak in the Linux kernel's Bluetooth subsystem, specifically within the hci_req_sync_complete() function. The issue arises because the function fails to release the previous synchronization request state before assigning a new one, leading to increased memory usage over time. This flaw can degrade system performance and potentially cause a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-36011

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_sync_established_evt().

5.7 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-36012

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-36013

A use-after-free vulnerability exists in the Bluetooth stack of the Linux kernel. The l2cap_connect() does not return void during the function return, potentially leading to a loss of system availability.

7.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-36880

A flaw was found in the Linux kernel's Bluetooth QCA driver. This vulnerability is caused by missing sanity checks when parsing firmware files before downloading them. A local attacker with low privileges could exploit this to corrupt memory beyond a vmalloced buffer, potentially leading to a system compromise affecting confidentiality, integrity, and availability.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Important
CVE-2024-36968

in linux kernel bluetooth L2CAP, l2cap_le_flowctl_init() can cause both div-by-zero and an integer overflow since hdev->le_mtu may not fall in the valid range.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-38541

A buffer overflow flaw was found in of_modalias() in the Linux kernel, occurring after the first snprintf() call. This issue could result in loss of availability of the system.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-121 - Stack-based Buffer Overflow
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-39500

A flaw was found in the Linux kernel's `sock_map` component. A local attacker could exploit a race condition between the `sock_map_close` and `sk_psock_put` functions. This race condition can lead to a null pointer dereference, which triggers a kernel warning and may result in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-40956

A vulnerability was found in the Linux kernel's DMA engine component in the irq_process_work_list() function. A possible use-after-free condition can occur during list iteration, which is because a descriptor may be freed while another thread is reusing it, potentially leading to access to freed memory.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-41010

A flaw was found in the Linux kernel in which certain sequences of network namespace activity can cause a use-after-free, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-41062

In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it without lock protection. CPU0 CPU1 ---- ---- sock_close hci_rx_work l2cap_sock_release hci_acldata_packet l2cap_sock_kill l2cap_recv_frame sk_free l2cap_conless_channel l2cap_sock_recv_cb If hci_rx_work processes the data that needs to be received before the sock is closed, then everything is normal; Otherwise, the work thread may access the released sock when receiving data. Add a chan mutex in the rx callback of the sock to achieve synchronization between the sock release and recv cb. Sock is dead, so set chan data to NULL, avoid others use invalid sock pointer.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-413 - Improper Resource Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42094

A flaw was found in the Linux kernel's net/iucv component. This vulnerability arises when a specific kernel configuration (CONFIG_CPUMASK_OFFSTACK=y) is enabled, allowing for explicit allocation of cpumask variables directly on the system's memory stack. An attacker could exploit this to trigger a stack overflow, potentially leading to a Denial of Service (DoS) condition, which would make the system unavailable.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42133

A vulnerability was found in the Linux kernel's bluetooth subsystem in the function hci_le_big_sync_established_evt() where a lack of proper checks does not validate whether a received connection handle exceeds the maximum allowed value. This could lead to system instability or crashes.

5.2 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42253

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races. The other (non-probe) call site pca953x_gpio_set_multiple() ensures the lock is held before calling pca953x_write_regs(). The problem occurred when a request raced against irq_bus_sync_unlock() approximately once per thousand reboots on an i.MX8MP based system. * Normal case 0-0022: write register AI|3a {03,02,00,00,01} Input latch P0 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 * Race case 0-0022: write register AI|08 {ff,00,00,00,00} Output P3 0-0022: write register AI|08 {03,02,00,00,01} *** Wrong register *** 0-0022: write register AI|12 {fc,00,00,00,00} Config P3 0-0022: write register AI|49 {fc,fd,ff,ff,fe} Interrupt mask P0

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-42265

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42278

In the Linux kernel, the following vulnerability has been resolved: ASoC: TAS2781: Fix tasdev_load_calibrated_data(). This function has a reversed if statement resulting in a no-op or leading to a NULL dereference.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42291

ice in linux kernel permits VF driver to request more than designated limit of FDIR filters, which can lead to resource exhaustion for other VFs.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42294

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between sd_remove & sd_release Our test report the following hung task: [ 2538.459400] INFO: task "kworker/0:0":7 blocked for more than 188 seconds. [ 2538.459427] Call trace: [ 2538.459430] __switch_to+0x174/0x338 [ 2538.459436] __schedule+0x628/0x9c4 [ 2538.459442] schedule+0x7c/0xe8 [ 2538.459447] schedule_preempt_disabled+0x24/0x40 [ 2538.459453] __mutex_lock+0x3ec/0xf04 [ 2538.459456] __mutex_lock_slowpath+0x14/0x24 [ 2538.459459] mutex_lock+0x30/0xd8 [ 2538.459462] del_gendisk+0xdc/0x350 [ 2538.459466] sd_remove+0x30/0x60 [ 2538.459470] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459474] device_release_driver+0x18/0x28 [ 2538.459478] bus_remove_device+0x15c/0x174 [ 2538.459483] device_del+0x1d0/0x358 [ 2538.459488] __scsi_remove_device+0xa8/0x198 [ 2538.459493] scsi_forget_host+0x50/0x70 [ 2538.459497] scsi_remove_host+0x80/0x180 [ 2538.459502] usb_stor_disconnect+0x68/0xf4 [ 2538.459506] usb_unbind_interface+0xd4/0x280 [ 2538.459510] device_release_driver_internal+0x1c4/0x2c4 [ 2538.459514] device_release_driver+0x18/0x28 [ 2538.459518] bus_remove_device+0x15c/0x174 [ 2538.459523] device_del+0x1d0/0x358 [ 2538.459528] usb_disable_device+0x84/0x194 [ 2538.459532] usb_disconnect+0xec/0x300 [ 2538.459537] hub_event+0xb80/0x1870 [ 2538.459541] process_scheduled_works+0x248/0x4dc [ 2538.459545] worker_thread+0x244/0x334 [ 2538.459549] kthread+0x114/0x1bc [ 2538.461001] INFO: task "fsck.":15415 blocked for more than 188 seconds. [ 2538.461014] Call trace: [ 2538.461016] __switch_to+0x174/0x338 [ 2538.461021] __schedule+0x628/0x9c4 [ 2538.461025] schedule+0x7c/0xe8 [ 2538.461030] blk_queue_enter+0xc4/0x160 [ 2538.461034] blk_mq_alloc_request+0x120/0x1d4 [ 2538.461037] scsi_execute_cmd+0x7c/0x23c [ 2538.461040] ioctl_internal_command+0x5c/0x164 [ 2538.461046] scsi_set_medium_removal+0x5c/0xb0 [ 2538.461051] sd_release+0x50/0x94 [ 2538.461054] blkdev_put+0x190/0x28c [ 2538.461058] blkdev_release+0x28/0x40 [ 2538.461063] __fput+0xf8/0x2a8 [ 2538.461066] __fput_sync+0x28/0x5c [ 2538.461070] __arm64_sys_close+0x84/0xe8 [ 2538.461073] invoke_syscall+0x58/0x114 [ 2538.461078] el0_svc_common+0xac/0xe0 [ 2538.461082] do_el0_svc+0x1c/0x28 [ 2538.461087] el0_svc+0x38/0x68 [ 2538.461090] el0t_64_sync_handler+0x68/0xbc [ 2538.461093] el0t_64_sync+0x1a8/0x1ac T1: T2: sd_remove del_gendisk __blk_mark_disk_dead blk_freeze_queue_start ++q->mq_freeze_depth bdev_release mutex_lock(&disk->open_mutex) sd_release scsi_execute_cmd blk_queue_enter wait_event(!q->mq_freeze_depth) mutex_lock(&disk->open_mutex) SCSI does not set GD_OWNS_QUEUE, so QUEUE_FLAG_DYING is not set in this scenario. This is a classic ABBA deadlock. To fix the deadlock, make sure we don't try to acquire disk->open_mutex after freezing the queue.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-833 - Deadlock
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42302

A use-after-free flaw was found in concurrent DPC and hot-removal in the Linux kernel. This issue may result in a crash.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42304

The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory. Then, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42305

A flaw was found in the Linux kernel's ext4 filesystem. When converting a directory to an indexed format, the system incorrectly assumes the presence of "dot" and "dotdot" entries. A local attacker could create a specially crafted filesystem image that, when processed during a rename operation, triggers an out-of-bounds access. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42312

In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42315

A potential deadlock on __exfat_get_dentry_set was found in the Linux kernel. This may lead to decreased Availability.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42316

In the Linux kernel, the following vulnerability has been resolved: mm/mglru: fix div-by-zero in vmpressure_calc_level() evict_folios() uses a second pass to reclaim folios that have gone through page writeback and become clean before it finishes the first pass, since folio_rotate_reclaimable() cannot handle those folios due to the isolation. The second pass tries to avoid potential double counting by deducting scan_control->nr_scanned. However, this can result in underflow of nr_scanned, under a condition where shrink_folio_list() does not increment nr_scanned, i.e., when folio_trylock() fails. The underflow can cause the divisor, i.e., scale=scanned+reclaimed in vmpressure_calc_level(), to become zero, resulting in the following crash: [exception RIP: vmpressure_work_fn+101] process_one_work at ffffffffa3313f2b Since scan_control->nr_scanned has no established semantics, the potential double counting has minimal risks. Therefore, fix the problem by not deducting scan_control->nr_scanned in evict_folios().

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-42321

In the Linux kernel, the following vulnerability has been resolved: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE The following splat is easy to reproduce upstream as well as in -stable kernels. Florian Westphal provided the following commit: d1dab4f71d37 ("net: add and use __skb_get_hash_symmetric_net") but this complementary fix has been also suggested by Willem de Bruijn and it can be easily backported to -stable kernel which consists in using DEBUG_NET_WARN_ON_ONCE instead to silence the following splat given __skb_get_hash() is used by the nftables tracing infrastructure to to identify packets in traces. [69133.561393] ------------[ cut here ]------------ [69133.561404] WARNING: CPU: 0 PID: 43576 at net/core/flow_dissector.c:1104 __skb_flow_dissect+0x134f/ [...] [69133.561944] CPU: 0 PID: 43576 Comm: socat Not tainted 6.10.0-rc7+ #379 [69133.561959] RIP: 0010:__skb_flow_dissect+0x134f/0x2ad0 [69133.561970] Code: 83 f9 04 0f 84 b3 00 00 00 45 85 c9 0f 84 aa 00 00 00 41 83 f9 02 0f 84 81 fc ff ff 44 0f b7 b4 24 80 00 00 00 e9 8b f9 ff ff <0f> 0b e9 20 f3 ff ff 41 f6 c6 20 0f 84 e4 ef ff ff 48 8d 7b 12 e8 [69133.561979] RSP: 0018:ffffc90000006fc0 EFLAGS: 00010246 [69133.561988] RAX: 0000000000000000 RBX: ffffffff82f33e20 RCX: ffffffff81ab7e19 [69133.561994] RDX: dffffc0000000000 RSI: ffffc90000007388 RDI: ffff888103a1b418 [69133.562001] RBP: ffffc90000007310 R08: 0000000000000000 R09: 0000000000000000 [69133.562007] R10: ffffc90000007388 R11: ffffffff810cface R12: ffff888103a1b400 [69133.562013] R13: 0000000000000000 R14: ffffffff82f33e2a R15: ffffffff82f33e28 [69133.562020] FS: 00007f40f7131740(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 [69133.562027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [69133.562033] CR2: 00007f40f7346ee0 CR3: 000000015d200001 CR4: 00000000001706f0 [69133.562040] Call Trace: [69133.562044] <IRQ> [69133.562049] ? __warn+0x9f/0x1a0 [ 1211.841384] ? __skb_flow_dissect+0x107e/0x2860 [...] [ 1211.841496] ? bpf_flow_dissect+0x160/0x160 [ 1211.841753] __skb_get_hash+0x97/0x280 [ 1211.841765] ? __skb_get_hash_symmetric+0x230/0x230 [ 1211.841776] ? mod_find+0xbf/0xe0 [ 1211.841786] ? get_stack_info_noinstr+0x12/0xe0 [ 1211.841798] ? bpf_ksym_find+0x56/0xe0 [ 1211.841807] ? __rcu_read_unlock+0x2a/0x70 [ 1211.841819] nft_trace_init+0x1b9/0x1c0 [nf_tables] [ 1211.841895] ? nft_trace_notify+0x830/0x830 [nf_tables] [ 1211.841964] ? get_stack_info+0x2b/0x80 [ 1211.841975] ? nft_do_chain_arp+0x80/0x80 [nf_tables] [ 1211.842044] nft_do_chain+0x79c/0x850 [nf_tables]

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-43820

In the Linux kernel, the following vulnerability has been resolved: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume rm-raid devices will occasionally trigger the following warning when being resumed after a table load because DM_RECOVERY_RUNNING is set: WARNING: CPU: 7 PID: 5660 at drivers/md/dm-raid.c:4105 raid_resume+0xee/0x100 [dm_raid] The failing check is: WARN_ON_ONCE(test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)); This check is designed to make sure that the sync thread isn't registered, but md_check_recovery can set MD_RECOVERY_RUNNING without the sync_thread ever getting registered. Instead of checking if MD_RECOVERY_RUNNING is set, check if sync_thread is non-NULL.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-839 - Numeric Range Comparison Without Minimum Check
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-43821

A flaw was found in the Linux kernel. A local attacker with elevated privileges could exploit a null pointer dereference vulnerability within the `scsi: lpfc` component. This occurs when memory allocation fails in the `lpfc_xcvr_data_show` function, causing a critical pointer to become null. Subsequent operations attempt to use this null pointer, which can lead to a system crash and result in a denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43823

A NULL pointer dereference was found in the Linux kernel in case of DT error in ks_pcie_setup_rc_app_regs(). This may lead to a crash.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43828

In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem!

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43834

In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page pool will be destroyed only when a reference count reaches 0. page_pool_destroy() is used to destroy page pool, it decreases a reference count. When a page pool is destroyed, ->disconnect() is called, which is mem_allocator_disconnect(). This function internally acquires mutex_lock(). If the driver uses XDP, it registers a memory model with xdp_rxq_info_reg_mem_model(). The xdp_rxq_info_reg_mem_model() internally increases a page pool reference count if a memory model is a page pool. Now the reference count is 2. To destroy a page pool, the driver should call both page_pool_destroy() and xdp_unreg_mem_model(). The xdp_unreg_mem_model() internally calls page_pool_destroy(). Only page_pool_destroy() decreases a reference count. If a driver calls page_pool_destroy() then xdp_unreg_mem_model(), we will face an invalid wait context warning. Because xdp_unreg_mem_model() calls page_pool_destroy() with rcu_read_lock(). The page_pool_destroy() internally acquires mutex_lock(). Splat looks like: ============================= [ BUG: Invalid wait context ] 6.10.0-rc6+ #4 Tainted: G W ----------------------------- ethtool/1806 is trying to lock: ffffffff90387b90 (mem_id_lock){+.+.}-{4:4}, at: mem_allocator_disconnect+0x73/0x150 other info that might help us debug this: context-{5:5} 3 locks held by ethtool/1806: stack backtrace: CPU: 0 PID: 1806 Comm: ethtool Tainted: G W 6.10.0-rc6+ #4 f916f41f172891c800f2fed Hardware name: ASUS System Product Name/PRIME Z690-P D4, BIOS 0603 11/01/2021 Call Trace: <TASK> dump_stack_lvl+0x7e/0xc0 __lock_acquire+0x1681/0x4de0 ? _printk+0x64/0xe0 ? __pfx_mark_lock.part.0+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x1b3/0x580 ? mem_allocator_disconnect+0x73/0x150 ? __wake_up_klogd.part.0+0x16/0xc0 ? __pfx_lock_acquire+0x10/0x10 ? dump_stack_lvl+0x91/0xc0 __mutex_lock+0x15c/0x1690 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_prb_read_valid+0x10/0x10 ? mem_allocator_disconnect+0x73/0x150 ? __pfx_llist_add_batch+0x10/0x10 ? console_unlock+0x193/0x1b0 ? lockdep_hardirqs_on+0xbe/0x140 ? __pfx___mutex_lock+0x10/0x10 ? tick_nohz_tick_stopped+0x16/0x90 ? __irq_work_queue_local+0x1e5/0x330 ? irq_work_queue+0x39/0x50 ? __wake_up_klogd.part.0+0x79/0xc0 ? mem_allocator_disconnect+0x73/0x150 mem_allocator_disconnect+0x73/0x150 ? __pfx_mem_allocator_disconnect+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? rcu_is_watching+0x11/0xb0 page_pool_release+0x36e/0x6d0 page_pool_destroy+0xd7/0x440 xdp_unreg_mem_model+0x1a7/0x2a0 ? __pfx_xdp_unreg_mem_model+0x10/0x10 ? kfree+0x125/0x370 ? bnxt_free_ring.isra.0+0x2eb/0x500 ? bnxt_free_mem+0x5ac/0x2500 xdp_rxq_info_unreg+0x4a/0xd0 bnxt_free_mem+0x1356/0x2500 bnxt_close_nic+0xf0/0x3b0 ? __pfx_bnxt_close_nic+0x10/0x10 ? ethnl_parse_bit+0x2c6/0x6d0 ? __pfx___nla_validate_parse+0x10/0x10 ? __pfx_ethnl_parse_bit+0x10/0x10 bnxt_set_features+0x2a8/0x3e0 __netdev_update_features+0x4dc/0x1370 ? ethnl_parse_bitset+0x4ff/0x750 ? __pfx_ethnl_parse_bitset+0x10/0x10 ? __pfx___netdev_update_features+0x10/0x10 ? mark_held_locks+0xa5/0xf0 ? _raw_spin_unlock_irqrestore+0x42/0x70 ? __pm_runtime_resume+0x7d/0x110 ethnl_set_features+0x32d/0xa20 To fix this problem, it uses rhashtable_lookup_fast() instead of rhashtable_lookup() with rcu_read_lock(). Using xa without rcu_read_lock() here is safe. xa is freed by __xdp_mem_allocator_rcu_free() and this is called by call_rcu() of mem_xa_remove(). The mem_xa_remove() is called by page_pool_destroy() if a reference count reaches 0. The xa is already protected by the reference count mechanism well in the control plane. So removing rcu_read_lock() for page_pool_destroy() is safe.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-764 - Multiple Locks of a Critical Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43846

linux kernel's lib objagg can incorrectly permit object nesting in an unallowed circumstance, based on lack of appropriate checks stemming from assumption violations. The incorrect object creation from this assumption can lead to general protection fault.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43853

A use-after-free (UAF) flaw was found in the proc_cpuset_show() function. This issue can allow an attacker to access the css of the root caused by a race condition when the cgroup_root should be freed when it is unmounted from the resource.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43871

In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed by using devres_release() instead of devres_destroy() within devm_free_percpu().

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43873

Improper handling of seqpacket_allow initialization was found in the Linux kernel in drivers/vhost/vsock.c.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43882

A vulnerability was found in the Linux kernel. The fix addresses a race condition during file execution (exec), where a file’s permissions could change between an initial check and execution, potentially allowing unauthorized privilege escalation. Specifically, a non-privileged user could gain root access by exploiting a brief window during which file permissions are modified, such as when package managers update executables with setuid.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-266 - Incorrect Privilege Assignment
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43884

Bluetooth in the Linux kernel does not check for a NULL value, which could lead to dereferencing a null pointed and an eventual crash.

5.7 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43889

A denial of service vulnerability exists in the Linux kernel. A possible divide-by-0 is in the padata_mt_helper() function when the ps->chunk_size is 0. This vulnerability could result in a loss of system availability.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43898

[REJECTED CVE] A NULL pointer dereference vulnerability has been identified in the Linux Kernel's ext4 filesystem. The issue occurs during concurrent write operations with inline data, where an ext4_force_shutdown is triggered due to inconsistencies like "block bitmap and bg descriptor inconsistent." This shutdown disrupts inline data handling, failing to restore the EXT4_STATE_MAY_INLINE_DATA flag. As a result, subsequent operations, such as in ext4_da_write_end, may attempt to dereference an unset page folio private pointer, leading to potential kernel crashes.

0.0 (None)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43910

bpf in linux kernel permits passing in a modified CONST_PTR_TO_DYNPTR to a global function as an argument. BPF helpers can use the modified CONST_PTR_TO_DYNPTR within a global function context, which can lead to out of bounds memory accesses.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-43914

A flaw was found in the Linux kernel's MD (Multiple Device) RAID5 implementation. A local attacker, with privileges to manage RAID arrays, could trigger a kernel panic by reassembling a RAID5 array after an aborted reshape operation. This occurs due to an inconsistency between the `raid_disks` and `reshape position` values, leading to a failed integrity check during a subsequent reshape. Successful exploitation results in a system crash, causing a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44931

A flaw was found in the Linux kernel's General Purpose Input/Output (GPIO) subsystem. A local user can exploit this vulnerability by providing an out-of-range offset to the `gpio_ioctl()` function. This can lead to a speculative read of memory outside the intended GPIO descriptor array, potentially disclosing sensitive information through speculative execution side channels.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44932

In the Linux kernel, the following vulnerability has been resolved: idpf: fix UAFs when destroying the queues The second tagged commit started sometimes (very rarely, but possible) throwing WARNs from net/core/page_pool.c:page_pool_disable_direct_recycling(). Turned out idpf frees interrupt vectors with embedded NAPIs *before* freeing the queues making page_pools' NAPI pointers lead to freed memory before these pools are destroyed by libeth. It's not clear whether there are other accesses to the freed vectors when destroying the queues, but anyway, we usually free queue/interrupt vectors only when the queues are destroyed and the NAPIs are guaranteed to not be referenced anywhere. Invert the allocation and freeing logic making queue/interrupt vectors be allocated first and freed last. Vectors don't require queues to be present, so this is safe. Additionally, this change allows to remove that useless queue->q_vector pointer cleanup, as vectors are still valid when freeing the queues (+ both are freed within one function, so it's not clear why nullify the pointers at all).

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44934

A possible use-after-free was found in the Linux kernel in net/bridge/br_multicast.c.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44952

No description is available for this CVE.

CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-44958

A flaw was found in the Linux kernel. An unbalanced decrement and increment of the sched_smt_present counter can occur during CPU deactivation if the cpuset_cpu_inactive() function fails. A local attacker could exploit this condition, leading to a kernel warning and potentially a denial of service (DoS) as the system becomes unstable or crashes.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-665 - Improper Initialization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44964

In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leaks and crashes while performing a soft reset The second tagged commit introduced a UAF, as it removed restoring q_vector->vport pointers after reinitializating the structures. This is due to that all queue allocation functions are performed here with the new temporary vport structure and those functions rewrite the backpointers to the vport. Then, this new struct is freed and the pointers start leading to nowhere. But generally speaking, the current logic is very fragile. It claims to be more reliable when the system is low on memory, but in fact, it consumes two times more memory as at the moment of running this function, there are two vports allocated with their queues and vectors. Moreover, it claims to prevent the driver from running into "bad state", but in fact, any error during the rebuild leaves the old vport in the partially allocated state. Finally, if the interface is down when the function is called, it always allocates a new queue set, but when the user decides to enable the interface later on, vport_open() allocates them once again, IOW there's a clear memory leak here. Just don't allocate a new queue set when performing a reset, that solves crashes and memory leaks. Readd the old queue number and reopen the interface on rollback - that solves limbo states when the device is left disabled and/or without HW queues enabled.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44975

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: fix panic caused by partcmd_update We find a bug as below: BUG: unable to handle page fault for address: 00000003 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 358 Comm: bash Tainted: G W I 6.6.0-10893-g60d6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/4 RIP: 0010:partition_sched_domains_locked+0x483/0x600 Code: 01 48 85 d2 74 0d 48 83 05 29 3f f8 03 01 f3 48 0f bc c2 89 c0 48 9 RSP: 0018:ffffc90000fdbc58 EFLAGS: 00000202 RAX: 0000000100000003 RBX: ffff888100b3dfa0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000002fe80 RBP: ffff888100b3dfb0 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc90000fdbcb0 R11: 0000000000000004 R12: 0000000000000002 R13: ffff888100a92b48 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f44a5425740(0000) GS:ffff888237d80000(0000) knlGS:0000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000100030973 CR3: 000000010722c000 CR4: 00000000000006e0 Call Trace: <TASK> ? show_regs+0x8c/0xa0 ? __die_body+0x23/0xa0 ? __die+0x3a/0x50 ? page_fault_oops+0x1d2/0x5c0 ? partition_sched_domains_locked+0x483/0x600 ? search_module_extables+0x2a/0xb0 ? search_exception_tables+0x67/0x90 ? kernelmode_fixup_or_oops+0x144/0x1b0 ? __bad_area_nosemaphore+0x211/0x360 ? up_read+0x3b/0x50 ? bad_area_nosemaphore+0x1a/0x30 ? exc_page_fault+0x890/0xd90 ? __lock_acquire.constprop.0+0x24f/0x8d0 ? __lock_acquire.constprop.0+0x24f/0x8d0 ? asm_exc_page_fault+0x26/0x30 ? partition_sched_domains_locked+0x483/0x600 ? partition_sched_domains_locked+0xf0/0x600 rebuild_sched_domains_locked+0x806/0xdc0 update_partition_sd_lb+0x118/0x130 cpuset_write_resmask+0xffc/0x1420 cgroup_file_write+0xb2/0x290 kernfs_fop_write_iter+0x194/0x290 new_sync_write+0xeb/0x160 vfs_write+0x16f/0x1d0 ksys_write+0x81/0x180 __x64_sys_write+0x21/0x30 x64_sys_call+0x2f25/0x4630 do_syscall_64+0x44/0xb0 entry_SYSCALL_64_after_hwframe+0x78/0xe2 RIP: 0033:0x7f44a553c887 It can be reproduced with cammands: cd /sys/fs/cgroup/ mkdir test cd test/ echo +cpuset > ../cgroup.subtree_control echo root > cpuset.cpus.partition cat /sys/fs/cgroup/cpuset.cpus.effective 0-3 echo 0-3 > cpuset.cpus // taking away all cpus from root This issue is caused by the incorrect rebuilding of scheduling domains. In this scenario, test/cpuset.cpus.partition should be an invalid root and should not trigger the rebuilding of scheduling domains. When calling update_parent_effective_cpumask with partcmd_update, if newmask is not null, it should recheck newmask whether there are cpus is available for parect/cs that has tasks.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44987

A possible use-after-free was found in the Linux kernel in net/ipv6/ip6_output.c.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-44989

A flaw was found in the Linux kernel's bonding module. A local attacker with low privileges could exploit a null pointer dereference by manipulating network operations. This vulnerability can cause the system to crash, leading to a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-45000

A race condition vulnerability was found in the Linux kernel. A race condition in the `fscache_cookie` subsystem leads to a NULL pointer dereference. The issue occurred when multiple processes accessed a cached file while it was being withdrawn, causing the cache's metadata to clear prematurely.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-45009

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) path manager. A remote attacker could potentially exploit an issue where the `add_addr_accepted` counter is incorrectly decremented during subflow removal. This can lead to an inconsistent state within the MPTCP connection, potentially resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-45010

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) Path Manager. When a 'signal' endpoint is removed, the `local_addr_used` counter is incorrectly decremented, even though this counter is intended for 'subflow' endpoints. This miscounting can lead to an inconsistent state in the MPTCP Path Manager, potentially allowing a local attacker to cause a Denial of Service (DoS) by disrupting network connectivity.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-691 - Insufficient Control Flow Management
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-45016

A flaw use after free in the Linux kernel Network emulator (NETEM) functionality was found. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-45022

Incorrect mappings in __vmap_pages_range_noflush() in the Linux kernel, may lead to memory corruption.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46673

A flaw was found in the Linux kernel. Specifically, a double-free vulnerability exists in the `aacraid` SCSI driver. This occurs during probe failure when the `aac_init_adapter()` function frees memory for `aac_dev::queues` but fails to clear the pointer, leading `aac_probe_one()` to attempt a second free of the same memory. A local attacker could exploit this memory corruption to cause a denial of service (DoS) or potentially achieve arbitrary code execution.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46675

A flaw was found in the Linux kernel's USB dwc3 core. During runtime suspend, the USB core could attempt to access an invalid event buffer address. This issue, particularly affecting Exynos platforms, can lead to System Memory Management Unit (SMMU) faults and other memory-related problems, potentially causing system instability or denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46711

A flaw incorrect behavior in the Linux kernel Multipath TCP (MPTCP) functionality was found in the way. A local user could use this flaw to crash the system.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46722

A flaw was found in the Linux kernel's `drm/amdgpu` component. A local attacker could exploit an out-of-bounds read vulnerability when processing `mc_data`. This could lead to the disclosure of sensitive information and potentially cause a denial of service.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46723

A flaw was found in the Linux kernel's `amdgpu` graphics driver. This issue involves an out-of-bounds read when handling microcode (ucode) that was identified as a warning. While not a direct security vulnerability on its own, this flaw could potentially be leveraged by a local attacker with low privileges to trigger further issues that might lead to information disclosure or a denial of service.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46724

A flaw was found in the `drm/amdgpu` component of the Linux kernel. An improper range check of the `fb_channel_number` could allow a local attacker to perform an out-of-bounds read. This could lead to information disclosure or a denial of service (DoS).

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46725

A flaw was found in the `drm/amdgpu` component of the Linux kernel. This out-of-bounds write vulnerability occurs due to an improper check of the ring type value. A local attacker with high privileges could exploit this flaw to cause data corruption, system instability, or potentially achieve privilege escalation.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46743

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit an out-of-bounds read vulnerability in the interrupt map walk function (`of_irq_parse_raw`). This flaw occurs when a device address is improperly handled, potentially leading to the disclosure of sensitive information and causing the system to become unavailable (denial of service).

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46745

A flaw was found in the Linux kernel's `uinput` interface. A local user could exploit this vulnerability by attempting to set up a `uinput` device with an unreasonably large number of slots. This action triggers a memory allocation failure, which can place a significant burden on the system, potentially leading to a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46747

A flaw was found in the Linux kernel's HID (Human Interface Device) subsystem, specifically within the driver for the Cougar 500k Gaming Keyboard. The `report_fixup` function failed to validate the size of the report descriptor before processing it. This oversight could allow a local attacker to trigger a slab-out-of-bounds read, potentially leading to information disclosure or a denial of service.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46750

A flaw was found in the Linux kernel's PCI subsystem. A local attacker could exploit a missing bridge lock in the `pci_bus_lock()` function. This vulnerability allows users of `pci_reset_bus()` to trigger unlocked secondary bus resets, which can lead to a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46754

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This vulnerability allows BPF operations related to lwt_seg6local_prog_ops to be invoked via bpf_test_run() without proper initialization of a critical per-CPU variable. This could lead to a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-666 - Operation on Resource in Wrong Phase of Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46756

This CVE has been marked as Rejected by the assigning CNA.

0.0 (None)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-46758

No description is available for this CVE.

CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-46759

A flaw was found and resolved in the Linux kernel. DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is provided by the user.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46761

A flaw was found in the Linux kernel's Powernv hotplug driver. This vulnerability allows a local attacker to trigger a system crash by attempting to remove or disable a PCIe device from the system. The issue arises from the driver trying to access a memory location that has already been cleared, leading to a null pointer dereference. This can result in a denial of service, making the system unavailable.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46783

A flaw was found in the Linux kernel's `tcp_bpf` component. A local attacker with low privileges could exploit a vulnerability in the `tcp_bpf_sendmsg()` function. This flaw occurs when messages are handled in a specific way, leading to an unexpected negative return value. Successful exploitation can cause a kernel bug, resulting in a system crash and a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46786

In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows: ================================================================== BUG: unable to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ> tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 </TASK> Modules linked in: [last unloaded: netfs] ================================================================== Therefore delete fscache_cookie_lru_timer when removing the fscahe module.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46787

A flaw was found in the Linux kernel's userfaultfd component. A local user could exploit a race condition in the handling of huge page table entries (PMDs). This vulnerability can lead to a kernel crash, resulting in a Denial of Service (DoS). In older kernel versions, this flaw could also potentially cause memory corruption by misinterpreting memory regions.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46800

A use-after-free vulnerability was found in the Linux kernel. If netem_dequeue() enqueues a packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN, the packet is dropped but qdisc_tree_reduce_backlog() is not called to update the parent's q.qlen.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46805

A flaw was found in the `drm/amdgpu` component of the Linux kernel. This vulnerability occurs due to a missing null pointer check when dereferencing `amdgpu_hive_info *hive`. A local attacker could exploit this flaw to cause a system crash, leading to a denial of service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46806

A flaw was found in the Linux kernel's amdgpu graphics driver. A local attacker could exploit a division by zero error by triggering an invalid partition mode. This could lead to a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46807

A flaw was found in the Linux kernel's `drm/amd/amdgpu` component. This vulnerability occurs due to insufficient validation of a `tbo resource pointer`. A local attacker could exploit this missing check to cause a system crash, leading to a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46819

A flaw was found in the Linux kernel's `drm/amdgpu` component. A local attacker with low privileges could trigger a null pointer dereference by interacting with the `nbio_v7_4` functionality when the `ras_manager` object is null. This could lead to a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46820

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend We do not directly enable/disable VCN IRQ in vcn 5.0.0. And we do not handle the IRQ state as well. So the calls to disable IRQ and set state are removed. This effectively gets rid of the warining of "WARN_ON(!amdgpu_irq_enabled(adev, src, type))" in amdgpu_irq_put().

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-46822

A flaw was found in the Linux kernel, specifically within the ACPI (Advanced Configuration and Power Interface) CPU hotplug functionality. This vulnerability occurs when the system attempts to retrieve CPU information, and a missing CPU entry can lead to a NULL pointer dereference. A local attacker could potentially exploit this to trigger a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46828

A flaw was found in the `sch_cake` component of the Linux kernel. A local attacker could exploit a vulnerability in the bulk flow accounting logic, specifically during hash collision handling when host fairness is disabled. This can lead to an array out-of-bounds write due to a spurious decrement and wrap-around of a counter. If the `qdisc` (queueing discipline) is subsequently reconfigured to enable host fairness, the retained wrapped-around value is used as an array index, potentially causing a denial of service or information disclosure.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46835

A flaw was found in the `drm/amdgpu` driver of the Linux kernel. A local attacker could exploit this vulnerability by triggering a null pointer dereference. This could lead to a system crash, causing a denial of service (DoS) on the affected system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46839

No description is available for this CVE.

CWE-364 - Signal Handler Race Condition
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-46853

A flaw was found in the Linux kernel. An out-of-bounds write vulnerability exists in the `nxp-fspi` driver when handling data that is not 4-byte aligned during write operations to the TX FIFO. A local attacker with administrative privileges could exploit this flaw, potentially leading to a system crash (denial of service) or arbitrary code execution.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-46864

in cpuhp_setup_state() a requisite condition of "hyperv_init_cpuhp > 0" for the hyperv case will never be true, and then hv_cpu_die() won't be called on all CPUs and the VP assist page will not be reset. This leads to corruption of the previous VP assist page and ultimately panic if the kexec kernel is using that memory. The hyperv_init_cpuhp condition should be removed entirely.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-46871

A flaw was found in the AMD Radeon graphics card driver in the Linux kernel. Out-of-bounds access can be triggered due to arrays being created based on the wrong number of maximum DMUB notification types available, resulting in a denial of service.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-129 - Improper Validation of Array Index
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47141

In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc->pinmux data When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner. Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer. Serialize the access to mux related setting with a mutex lock. cpu0 (process A) cpu1(process B) pinctrl_select_state() { pinctrl_select_state() { pin_request() { pin_request() { ... .... } else { desc->mux_usecount++; desc->mux_usecount && strcmp(desc->mux_owner, owner)) { if (desc->mux_usecount > 1) return 0; desc->mux_owner = owner; } }

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47660

A flaw was found in the Linux kernel's fsnotify subsystem. When a parent directory stops watching its children, a race condition can occur during the clearing of PARENT_WATCHED flags. This contention on the inode->i_lock can lead to system unresponsiveness or softlockups, effectively causing a Denial of Service (DoS) for a local user.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47668

A flaw was found in the Linux kernel. A race condition in the `__genradix_ptr_alloc()` function, responsible for allocating nodes in the generic radix tree, can occur when increasing the tree depth. This race can lead to a preallocated node retaining a pointer to an old root instead of being properly zeroed. An attacker could potentially exploit this to cause system instability or a denial of service.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47678

A flaw was found in the Linux kernel related to the order of rate limits for ICMP messages. The sequence in which rate limiters are applied potentially allows a side-channel attack, resulting in information disclosure.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-203 - Observable Discrepancy
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47685

A flaw was found in the Netfilter and IPV6 functionality in the Linux kernel leading to a leak of 4 random bits. This issue may allow a remote user to preform an unauthorized read of random bits from the server.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47687

In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix invalid mr resource destroy Certain error paths from mlx5_vdpa_dev_add() can end up releasing mr resources which never got initialized in the first place. This patch adds the missing check in mlx5_vdpa_destroy_mr_resources() to block releasing non-initialized mr resources. Reference trace: mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned? BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 140216067 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] Code: [...] RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246 RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670 R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000 R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] ? __die_body.cold+0x8/0xd ? page_fault_oops+0x134/0x170 ? __irq_work_queue_local+0x2b/0xc0 ? irq_work_queue+0x2c/0x50 ? exc_page_fault+0x62/0x150 ? asm_exc_page_fault+0x22/0x30 ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa] ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa] genl_family_rcv_msg_doit+0xd9/0x130 genl_family_rcv_msg+0x14d/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] ? _copy_to_user+0x1a/0x30 ? move_addr_to_user+0x4b/0xe0 genl_rcv_msg+0x47/0xa0 ? __import_iovec+0x46/0x150 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x245/0x370 netlink_sendmsg+0x206/0x440 __sys_sendto+0x1dc/0x1f0 ? do_read_fault+0x10c/0x1d0 ? do_pte_missing+0x10d/0x190 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x5c/0xf0 ? __count_memcg_events+0x4f/0xb0 ? mm_account_fault+0x6c/0x100 ? handle_mm_fault+0x116/0x270 ? do_user_addr_fault+0x1d6/0x6a0 ? do_syscall_64+0x6b/0xf0 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 entry_SYSCALL_64_after_hwframe+0x78/0x80

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47692

A flaw was found in the Linux kernel's nfsd component. A local attacker with low privileges could manipulate the `main.sqlite` file, causing a zero-length name to be processed. This improper handling leads to a null pointer dereference in the `nfs4_client_to_reclaim()` function, which can result in a system crash and a Denial of Service (DoS).

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47700

In the Linux kernel, the following vulnerability has been resolved: ext4: check stripe size compatibility on remount as well We disable stripe size in __ext4_fill_super if it is not a multiple of the cluster ratio however this check is missed when trying to remount. This can leave us with cases where stripe < cluster_ratio after remount:set making EXT4_B2C(sbi->s_stripe) become 0 that can cause some unforeseen bugs like divide by 0. Fix that by adding the check in remount path as well.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47703

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) and Linux Security Module (LSM) subsystems. A privileged local attacker could exploit this by attaching a BPF program that returns a positive number to the file_alloc_security hook. This misinterpretation of the return value by the file system can lead to a kernel panic, resulting in a Denial of Service (DoS).

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-681 - Incorrect Conversion between Numeric Types
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47705

A flaw was found in the Linux kernel's block device subsystem. An invalid pointer dereference could occur within the `blk_add_partition()` function due to incorrect error handling. A local attacker could exploit this vulnerability to cause a system crash, leading to a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47706

A flaw was found in the Budget Fair Queueing (BFQ) I/O scheduler in the Linux kernel. Handling merged chains of BFQ queues can cause a use-after-free condition and result in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47710

A flaw was found in the Linux kernel's `sock_map` component, which handles network-related data structures. A local user could exploit this vulnerability by destroying a `sock_map` with a large number of buckets. This improper resource handling can lead to a soft lockup, causing the system to become unresponsive and resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-400 - Uncontrolled Resource Consumption
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47713

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker with low privileges could trigger a condition where the system attempts to transmit data with interrupts disabled during the `ieee80211_do_stop()` function. This incorrect handling of network packet buffers (SKBs) can lead to system instability or a denial of service (DoS), making the system unresponsive.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47715

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 mt7915_band_config() sets band_idx = 1 on the main phy for mt7986 with MT7975_ONE_ADIE or MT7976_ONE_ADIE. Commit 0335c034e726 ("wifi: mt76: fix race condition related to checking tx queue fill status") introduced a dereference of the phys array indirectly indexed by band_idx via wcid->phy_idx in mt76_wcid_cleanup(). This caused the following Oops on affected mt7986 devices: Unable to handle kernel read from unreadable memory at virtual address 0000000000000024 Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=0000000042545000 [0000000000000024] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: ... mt7915e mt76_connac_lib mt76 mac80211 cfg80211 ... CPU: 2 PID: 1631 Comm: hostapd Not tainted 5.15.150 #0 Hardware name: ZyXEL EX5700 (Telenor) (DT) pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mt76_wcid_cleanup+0x84/0x22c [mt76] lr : mt76_wcid_cleanup+0x64/0x22c [mt76] sp : ffffffc00a803700 x29: ffffffc00a803700 x28: ffffff80008f7300 x27: ffffff80003f3c00 x26: ffffff80000a7880 x25: ffffffc008c26e00 x24: 0000000000000001 x23: ffffffc000a68114 x22: 0000000000000000 x21: ffffff8004172cc8 x20: ffffffc00a803748 x19: ffffff8004152020 x18: 0000000000000000 x17: 00000000000017c0 x16: ffffffc008ef5000 x15: 0000000000000be0 x14: ffffff8004172e28 x13: ffffff8004172e28 x12: 0000000000000000 x11: 0000000000000000 x10: ffffff8004172e30 x9 : ffffff8004172e28 x8 : 0000000000000000 x7 : ffffff8004156020 x6 : 0000000000000000 x5 : 0000000000000031 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : ffffff80008f7300 x0 : 0000000000000024 Call trace: mt76_wcid_cleanup+0x84/0x22c [mt76] __mt76_sta_remove+0x70/0xbc [mt76] mt76_sta_state+0x8c/0x1a4 [mt76] mt7915_eeprom_get_power_delta+0x11e4/0x23a0 [mt7915e] drv_sta_state+0x144/0x274 [mac80211] sta_info_move_state+0x1cc/0x2a4 [mac80211] sta_set_sinfo+0xaf8/0xc24 [mac80211] sta_info_destroy_addr_bss+0x4c/0x6c [mac80211] ieee80211_color_change_finish+0x1c08/0x1e70 [mac80211] cfg80211_check_station_change+0x1360/0x4710 [cfg80211] genl_family_rcv_msg_doit+0xb4/0x110 genl_rcv_msg+0xd0/0x1bc netlink_rcv_skb+0x58/0x120 genl_rcv+0x34/0x50 netlink_unicast+0x1f0/0x2ec netlink_sendmsg+0x198/0x3d0 ____sys_sendmsg+0x1b0/0x210 ___sys_sendmsg+0x80/0xf0 __sys_sendmsg+0x44/0xa0 __arm64_sys_sendmsg+0x20/0x30 invoke_syscall.constprop.0+0x4c/0xe0 do_el0_svc+0x40/0xd0 el0_svc+0x14/0x4c el0t_64_sync_handler+0x100/0x110 el0t_64_sync+0x15c/0x160 Code: d2800002 910092c0 52800023 f9800011 (885f7c01) ---[ end trace 7e42dd9a39ed2281 ]--- Fix by using mt76_dev_phy() which will map band_idx to the correct phy for all hardware combinations.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-823 - Use of Out-of-range Pointer Offset
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-47718

A use-after-free flaw was found in the Linux kernel's mac80211-based wireless driver when firmware loading fails. This issue could allow a local user to crash the system as result of driver failure on an error path during power on.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47719

A flaw was found in the Linux kernel's iommufd component. A local user could exploit this vulnerability by supplying specially crafted input values during an input/output virtual address (IOVA) allocation. This manipulation causes an overflow in the ALIGN() function, leading to the corruption of the selected memory area. The primary consequence of this flaw is a denial of service (DoS), which could make the system unavailable.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47737

A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. This vulnerability occurs when the system attempts to allocate buffer space but fails, yet a related lookup operation succeeds. This leads to a resource leak where a cache entry is acquired but not properly released. A local attacker could exploit this issue to cause a Denial of Service (DoS) by exhausting system resources.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47738

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. Incorrect handling of rate mask settings during off-channel transmissions could lead to unsupported rate warnings. This issue may result in a denial of service (DoS) for affected systems.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-755 - Improper Handling of Exceptional Conditions
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47739

A flaw was found in the padata (parallel algorithm data) subsystem in the Linux kernel. An integer overflow can be triggered when processing more than 2^32 (~4GiB) padata objects, causing a deadlock in the serialization process, potentially resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47745

A flaw was found in the remap_file_pages function in mm/mmap.c in the Linux kernel, where it does not properly restrict execute access. This vulnerability allows local users to bypass intended SELinux W^X policy restrictions.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-670 - Always-Incorrect Control Flow Implementation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-47748

A use-after-free flaw was found in drivers/vhost/vdpa.c in the Linux kernel.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-48873

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresses-Coverity-ID: 1529805 ("Dereference null return value")

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49569

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] __schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blk_mq_freeze_queue_wait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blk_freeze_queue at ffffffff82a4113a #4 [ff61d23de260fc90] blk_cleanup_queue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvme_rdma_destroy_admin_queue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvme_rdma_setup_ctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvme_rdma_create_ctrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmf_dev_write at ffffffffc024f362 #9 [ff61d23de260fe38] vfs_write at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b This due to we have quiesced admi_q before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blk_mq_freeze_queue_wait() forever. Here try to reuse nvme_rdma_teardown_admin_queue() to fix this issue and simplify the code.

5.7 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-460 - Improper Cleanup on Thrown Exception
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49851

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. When a TPM command transmission fails, the driver does not properly clean up allocated resources, leading to a leak of transient handles. This resource exhaustion can result in a denial of service, making the TPM device unavailable for further operations.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-459 - Incomplete Cleanup
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49856

A flaw was found in the Linux kernel's handling of Intel Software Guard Extensions (SGX) Non-Uniform Memory Access (NUMA) node search. When a system's current NUMA node lacks an Enclave Page Cache (EPC) section configured by firmware, and all other EPC sections are fully utilized, a local user could trigger a condition where the CPU becomes stuck in an indefinite loop. This issue can lead to a soft lockup, resulting in a Denial of Service (DoS) for the affected system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49860

A flaw was found in the Linux kernel. This vulnerability occurs in the ACPI (Advanced Configuration and Power Interface) system file system (sysfs) when processing the `_STR` method. If a non-buffer object is returned, the system attempts to access invalid memory. A local attacker could exploit this to cause the system to crash, leading to a denial of service, and potentially gain access to sensitive information.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49861

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix helper writes to read-only maps Lonial found an issue that despite user- and BPF-side frozen BPF map (like in case of .rodata), it was still possible to write into it from a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT} as arguments. In check_func_arg() when the argument is as mentioned, the meta->raw_mode is never set. Later, check_helper_mem_access(), under the case of PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the subsequent call to check_map_access_type() and given the BPF map is read-only it succeeds. The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT when results are written into them as opposed to read out of them. The latter indicates that it's okay to pass a pointer to uninitialized memory as the memory is written to anyway. However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM just with additional alignment requirement. So it is better to just get rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the fixed size memory types. For this, add MEM_ALIGNED to additionally ensure alignment given these helpers write directly into the args via *<ptr> = val. The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>). MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated argument types, since in !MEM_FIXED_SIZE cases the verifier does not know the buffer size a priori and therefore cannot blindly write *<ptr> = val.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-49862

A flaw was found in the `intel_rapl` driver within the `powercap` subsystem of the Linux kernel. An off-by-one error in the `get_rpi()` function, caused by an incorrect array boundary check, could allow a local attacker to perform an out-of-bounds read or write. This vulnerability may lead to information disclosure or a denial of service (DoS) on the affected system.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-193 - Off-by-one Error
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49870

A flaw was found in the Linux kernel's cachefiles component. A local attacker could exploit a dentry (directory entry) leak caused by a concurrency issue between a lookup cookie and a cull operation. This flaw prevents the proper release of a reference count, which can lead to resource exhaustion and a denial of service when the affected filesystem is unmounted.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49875

In the Linux kernel, the following vulnerability has been resolved: nfsd: map the EBADMSG to nfserr_io to avoid warning Ext4 will throw -EBADMSG through ext4_readdir when a checksum error occurs, resulting in the following WARNING. Fix it by mapping EBADMSG to nfserr_io. nfsd_buffered_readdir iterate_dir // -EBADMSG -74 ext4_readdir // .iterate_shared ext4_dx_readdir ext4_htree_fill_tree htree_dirblock_to_tree ext4_read_dirblock __ext4_read_dirblock ext4_dirblock_csum_verify warn_no_space_for_csum __warn_no_space_for_csum return ERR_PTR(-EFSBADCRC) // -EBADMSG -74 nfserrno // WARNING [ 161.115610] ------------[ cut here ]------------ [ 161.116465] nfsd: non-standard errno: -74 [ 161.117315] WARNING: CPU: 1 PID: 780 at fs/nfsd/nfsproc.c:878 nfserrno+0x9d/0xd0 [ 161.118596] Modules linked in: [ 161.119243] CPU: 1 PID: 780 Comm: nfsd Not tainted 5.10.0-00014-g79679361fd5d #138 [ 161.120684] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qe mu.org 04/01/2014 [ 161.123601] RIP: 0010:nfserrno+0x9d/0xd0 [ 161.124676] Code: 0f 87 da 30 dd 00 83 e3 01 b8 00 00 00 05 75 d7 44 89 ee 48 c7 c7 c0 57 24 98 89 44 24 04 c6 05 ce 2b 61 03 01 e8 99 20 d8 00 <0f> 0b 8b 44 24 04 eb b5 4c 89 e6 48 c7 c7 a0 6d a4 99 e8 cc 15 33 [ 161.127797] RSP: 0018:ffffc90000e2f9c0 EFLAGS: 00010286 [ 161.128794] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 161.130089] RDX: 1ffff1103ee16f6d RSI: 0000000000000008 RDI: fffff520001c5f2a [ 161.131379] RBP: 0000000000000022 R08: 0000000000000001 R09: ffff8881f70c1827 [ 161.132664] R10: ffffed103ee18304 R11: 0000000000000001 R12: 0000000000000021 [ 161.133949] R13: 00000000ffffffb6 R14: ffff8881317c0000 R15: ffffc90000e2fbd8 [ 161.135244] FS: 0000000000000000(0000) GS:ffff8881f7080000(0000) knlGS:0000000000000000 [ 161.136695] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 161.137761] CR2: 00007fcaad70b348 CR3: 0000000144256006 CR4: 0000000000770ee0 [ 161.139041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 161.140291] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 161.141519] PKRU: 55555554 [ 161.142076] Call Trace: [ 161.142575] ? __warn+0x9b/0x140 [ 161.143229] ? nfserrno+0x9d/0xd0 [ 161.143872] ? report_bug+0x125/0x150 [ 161.144595] ? handle_bug+0x41/0x90 [ 161.145284] ? exc_invalid_op+0x14/0x70 [ 161.146009] ? asm_exc_invalid_op+0x12/0x20 [ 161.146816] ? nfserrno+0x9d/0xd0 [ 161.147487] nfsd_buffered_readdir+0x28b/0x2b0 [ 161.148333] ? nfsd4_encode_dirent_fattr+0x380/0x380 [ 161.149258] ? nfsd_buffered_filldir+0xf0/0xf0 [ 161.150093] ? wait_for_concurrent_writes+0x170/0x170 [ 161.151004] ? generic_file_llseek_size+0x48/0x160 [ 161.151895] nfsd_readdir+0x132/0x190 [ 161.152606] ? nfsd4_encode_dirent_fattr+0x380/0x380 [ 161.153516] ? nfsd_unlink+0x380/0x380 [ 161.154256] ? override_creds+0x45/0x60 [ 161.155006] nfsd4_encode_readdir+0x21a/0x3d0 [ 161.155850] ? nfsd4_encode_readlink+0x210/0x210 [ 161.156731] ? write_bytes_to_xdr_buf+0x97/0xe0 [ 161.157598] ? __write_bytes_to_xdr_buf+0xd0/0xd0 [ 161.158494] ? lock_downgrade+0x90/0x90 [ 161.159232] ? nfs4svc_decode_voidarg+0x10/0x10 [ 161.160092] nfsd4_encode_operation+0x15a/0x440 [ 161.160959] nfsd4_proc_compound+0x718/0xe90 [ 161.161818] nfsd_dispatch+0x18e/0x2c0 [ 161.162586] svc_process_common+0x786/0xc50 [ 161.163403] ? nfsd_svc+0x380/0x380 [ 161.164137] ? svc_printk+0x160/0x160 [ 161.164846] ? svc_xprt_do_enqueue.part.0+0x365/0x380 [ 161.165808] ? nfsd_svc+0x380/0x380 [ 161.166523] ? rcu_is_watching+0x23/0x40 [ 161.167309] svc_process+0x1a5/0x200 [ 161.168019] nfsd+0x1f5/0x380 [ 161.168663] ? nfsd_shutdown_threads+0x260/0x260 [ 161.169554] kthread+0x1c4/0x210 [ 161.170224] ? kthread_insert_work_sanity_check+0x80/0x80 [ 161.171246] ret_from_fork+0x1f/0x30

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-354 - Improper Validation of Integrity Check Value
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-49878

In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system with CXL memory, the resource tree (/proc/iomem) related to CXL memory may look like something as follows. 490000000-50fffffff : CXL Window 0 490000000-50fffffff : region0 490000000-50fffffff : dax0.0 490000000-50fffffff : System RAM (kmem) Because drivers/dax/kmem.c calls add_memory_driver_managed() during onlining CXL memory, which makes "System RAM (kmem)" a descendant of "CXL Window X". This confuses region_intersects(), which expects all "System RAM" resources to be at the top level of iomem_resource. This can lead to bugs. For example, when the following command line is executed to write some memory in CXL memory range via /dev/mem, $ dd if=data of=/dev/mem bs=$((1 << 10)) seek=$((0x490000000 >> 10)) count=1 dd: error writing '/dev/mem': Bad address 1+0 records in 0+0 records out 0 bytes copied, 0.0283507 s, 0.0 kB/s the command fails as expected. However, the error code is wrong. It should be "Operation not permitted" instead of "Bad address". More seriously, the /dev/mem permission checking in devmem_is_allowed() passes incorrectly. Although the accessing is prevented later because ioremap() isn't allowed to map system RAM, it is a potential security issue. During command executing, the following warning is reported in the kernel log for calling ioremap() on system RAM. ioremap on RAM at 0x0000000490000000 - 0x0000000490000fff WARNING: CPU: 2 PID: 416 at arch/x86/mm/ioremap.c:216 __ioremap_caller.constprop.0+0x131/0x35d Call Trace: memremap+0xcb/0x184 xlate_dev_mem_ptr+0x25/0x2f write_mem+0x94/0xfb vfs_write+0x128/0x26d ksys_write+0xac/0xfe do_syscall_64+0x9a/0xfd entry_SYSCALL_64_after_hwframe+0x4b/0x53 The details of command execution process are as follows. In the above resource tree, "System RAM" is a descendant of "CXL Window 0" instead of a top level resource. So, region_intersects() will report no System RAM resources in the CXL memory region incorrectly, because it only checks the top level resources. Consequently, devmem_is_allowed() will return 1 (allow access via /dev/mem) for CXL memory region incorrectly. Fortunately, ioremap() doesn't allow to map System RAM and reject the access. So, region_intersects() needs to be fixed to work correctly with the resource tree with "System RAM" not at top level as above. To fix it, if we found a unmatched resource in the top level, we will continue to search matched resources in its descendant resources. So, we will not miss any matched resources in resource tree anymore. In the new implementation, an example resource tree |------------- "CXL Window 0" ------------| |-- "System RAM" --| will behave similar as the following fake resource tree for region_intersects(, IORESOURCE_SYSTEM_RAM, ), |-- "System RAM" --||-- "CXL Window 0a" --| Where "CXL Window 0a" is part of the original "CXL Window 0" that isn't covered by "System RAM".

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49881

A flaw was found in the Linux kernel's ext4 filesystem. When the `ext4_find_extent()` function reallocates a path, it fails to update the original path pointer. A local attacker could exploit this by triggering a specific sequence of filesystem operations, leading to a null pointer dereference and causing a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49882

A flaw was found in the Linux kernel's ext4 filesystem. This flaw occurs due to a double `brelse()` operation on a buffer in the extents path, meaning the same memory buffer is released twice. An attacker with administrative (root) privileges could exploit this vulnerability, leading to a system crash and a Denial of Service (DoS).

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49883

In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values: ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr ================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...] Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ================================================================== So use *ppath to update the path to avoid the above problem.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49884

A flaw was found in the Linux kernel's `ext4` filesystem. A memory corruption vulnerability, specifically a use-after-free, exists in the `ext4_split_extent_at()` function. This issue arises when an error during file extent creation causes the system to attempt to use memory that has already been released. An attacker with administrative privileges could exploit this to potentially cause a system crash or disclose sensitive information.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49885

In the Linux kernel, the following vulnerability has been resolved: mm, slub: avoid zeroing kmalloc redzone Since commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested"), setting orig_size treats the wasted space (object_size - orig_size) as a redzone. However with init_on_free=1 we clear the full object->size, including the redzone. Additionally we clear the object metadata, including the stored orig_size, making it zero, which makes check_object() treat the whole object as a redzone. These issues lead to the following BUG report with "slub_debug=FUZ init_on_free=1": [ 0.000000] ============================================================================= [ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten [ 0.000000] ----------------------------------------------------------------------------- [ 0.000000] [ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc [ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc [ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff) [ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8 [ 0.000000] [ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........ [ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........ [ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........ [ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............ [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144 [ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT) [ 0.000000] Call trace: [ 0.000000] dump_backtrace+0x90/0xe8 [ 0.000000] show_stack+0x18/0x24 [ 0.000000] dump_stack_lvl+0x74/0x8c [ 0.000000] dump_stack+0x18/0x24 [ 0.000000] print_trailer+0x150/0x218 [ 0.000000] check_object+0xe4/0x454 [ 0.000000] free_to_partial_list+0x2f8/0x5ec To address the issue, use orig_size to clear the used area. And restore the value of orig_size after clear the remaining area. When CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns s->object_size. So when using memset to init the area, the size can simply be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not enabled. And orig_size can never be bigger than object_size.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49886

A flaw was found in the Linux kernel. A local attacker with privileges to manage virtual machines could exploit this vulnerability by attaching a specific Intel Speed Select Technology (ISST) PCI device to a virtual machine. This action triggers a memory error known as a slab-out-of-bounds, which can cause the system to crash. The primary consequence of this flaw is a denial of service, making the system unavailable.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49889

A flaw was found in the Linux kernel's ext4 filesystem. This use-after-free vulnerability occurs in the ext4_ext_show_leaf() function when a previously freed or reallocated memory path is incorrectly used. This issue is only triggered when the EXT_DEBUG option is enabled, which means it does not affect the system's normal operation or functionality in typical production environments. Exploitation would require administrative or root privileges.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49904

A flaw was found in the Linux kernel's `drm/amdgpu` component. A missing list empty check in certain scenarios can lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49927

A flaw was found in the Linux kernel's x86 IO-APIC (Input/Output Advanced Programmable Interrupt Controller) component. A local attacker with low privileges could trigger an interrupt allocation failure under specific runtime conditions. This failure would lead to a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-703 - Improper Check or Handling of Exceptional Conditions
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49928

A flaw was found in the Linux kernel's wifi: rtw89 component. A local attacker with low privileges could exploit an out-of-bounds read vulnerability when loading TX power firmware elements. This flaw, caused by a loop reading beyond a valid memory region, may lead to information disclosure or denial of service.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49929

A flaw was found in the Linux kernel in which certain wireless functionality could cause a null pointer dereference, resulting in a system crash.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49930

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix array out-of-bound access in SoC stats Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49933

A flaw was found in the Linux kernel's `blk_iocost` subsystem. This vulnerability, caused by out-of-bounds shifts within the `ioc_forgive_debts()` function, can lead to undefined behavior. A local attacker could exploit this to cause a Denial of Service (DoS), making the system unavailable.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-682 - Incorrect Calculation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49934

A flaw was found in the Linux kernel. A local user can trigger a kernel crash by performing specific memory operations involving `hugetlb` (a memory management feature) during the hot-removal of a memory device. This issue arises when the `dump_mapping()` function attempts to access an invalid memory address, leading to a Denial of Service (DoS) for the system.

4.3 (Medium)
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49935

In the Linux kernel, the following vulnerability has been resolved: ACPI: PAD: fix crash in exit_round_robin() The kernel occasionally crashes in cpumask_clear_cpu(), which is called within exit_round_robin(), because when executing clear_bit(nr, addr) with nr set to 0xffffffff, the address calculation may cause misalignment within the memory, leading to access to an invalid memory address. ---------- BUG: unable to handle kernel paging request at ffffffffe0740618 ... CPU: 3 PID: 2919323 Comm: acpi_pad/14 Kdump: loaded Tainted: G OE X --------- - - 4.18.0-425.19.2.el8_7.x86_64 #1 ... RIP: 0010:power_saving_thread+0x313/0x411 [acpi_pad] Code: 89 cd 48 89 d3 eb d1 48 c7 c7 55 70 72 c0 e8 64 86 b0 e4 c6 05 0d a1 02 00 01 e9 bc fd ff ff 45 89 e4 42 8b 04 a5 20 82 72 c0 <f0> 48 0f b3 05 f4 9c 01 00 42 c7 04 a5 20 82 72 c0 ff ff ff ff 31 RSP: 0018:ff72a5d51fa77ec8 EFLAGS: 00010202 RAX: 00000000ffffffff RBX: ff462981e5d8cb80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 RBP: ff46297556959d80 R08: 0000000000000382 R09: ff46297c8d0f38d8 R10: 0000000000000000 R11: 0000000000000001 R12: 000000000000000e R13: 0000000000000000 R14: ffffffffffffffff R15: 000000000000000e FS: 0000000000000000(0000) GS:ff46297a800c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffe0740618 CR3: 0000007e20410004 CR4: 0000000000771ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ? acpi_pad_add+0x120/0x120 [acpi_pad] kthread+0x10b/0x130 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x40 ... CR2: ffffffffe0740618 crash> dis -lr ffffffffc0726923 ... /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 114 0xffffffffc0726918 <power_saving_thread+776>: mov %r12d,%r12d /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./include/linux/cpumask.h: 325 0xffffffffc072691b <power_saving_thread+779>: mov -0x3f8d7de0(,%r12,4),%eax /usr/src/debug/kernel-4.18.0-425.19.2.el8_7/linux-4.18.0-425.19.2.el8_7.x86_64/./arch/x86/include/asm/bitops.h: 80 0xffffffffc0726923 <power_saving_thread+787>: lock btr %rax,0x19cf4(%rip) # 0xffffffffc0740620 <pad_busy_cpus_bits> crash> px tsk_in_cpu[14] $66 = 0xffffffff crash> px 0xffffffffc072692c+0x19cf4 $99 = 0xffffffffc0740620 crash> sym 0xffffffffc0740620 ffffffffc0740620 (b) pad_busy_cpus_bits [acpi_pad] crash> px pad_busy_cpus_bits[0] $42 = 0xfffc0 ---------- To fix this, ensure that tsk_in_cpu[tsk_index] != -1 before calling cpumask_clear_cpu() in exit_round_robin(), just as it is done in round_robin_cpu(). [ rjw: Subject edit, avoid updates to the same value ]

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49937

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. A local user could trigger a system crash, leading to a Denial of Service (DoS), due to an incorrect channel definition during the Channel Availability Check (CAC) startup when operating in a mode other than Access Point (AP) mode. This issue occurs because the channel definition is not properly set, resulting in a null channel pointer at the end of the CAC process.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49938

A flaw was found in the Linux kernel's `ath9k_htc` Wi-Fi driver. An issue exists where the `skb_trim()` function, used for resetting the length of a socket buffer (skb) before resubmitting a USB Request Block (urb), can encounter an uninitialized length value in certain error conditions. A local attacker could potentially exploit this vulnerability to cause a denial of service by triggering these error paths.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-824 - Access of Uninitialized Pointer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49939

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: avoid to add interface to list twice when SER If SER L2 occurs during the WoWLAN resume flow, the add interface flow is triggered by ieee80211_reconfig(). However, due to rtw89_wow_resume() return failure, it will cause the add interface flow to be executed again, resulting in a double add list and causing a kernel panic. Therefore, we have added a check to prevent double adding of the list. list_add double add: new=ffff99d6992e2010, prev=ffff99d6992e2010, next=ffff99d695302628. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:37! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W O 6.6.30-02659-gc18865c4dfbd #1 770df2933251a0e3c888ba69d1053a817a6376a7 Hardware name: HP Grunt/Grunt, BIOS Google_Grunt.11031.169.0 06/24/2021 Workqueue: events_freezable ieee80211_restart_work [mac80211] RIP: 0010:__list_add_valid_or_report+0x5e/0xb0 Code: c7 74 18 48 39 ce 74 13 b0 01 59 5a 5e 5f 41 58 41 59 41 5a 5d e9 e2 d6 03 00 cc 48 c7 c7 8d 4f 17 83 48 89 c2 e8 02 c0 00 00 <0f> 0b 48 c7 c7 aa 8c 1c 83 e8 f4 bf 00 00 0f 0b 48 c7 c7 c8 bc 12 RSP: 0018:ffffa91b8007bc50 EFLAGS: 00010246 RAX: 0000000000000058 RBX: ffff99d6992e0900 RCX: a014d76c70ef3900 RDX: ffffa91b8007bae8 RSI: 00000000ffffdfff RDI: 0000000000000001 RBP: ffffa91b8007bc88 R08: 0000000000000000 R09: ffffa91b8007bae0 R10: 00000000ffffdfff R11: ffffffff83a79800 R12: ffff99d695302060 R13: ffff99d695300900 R14: ffff99d6992e1be0 R15: ffff99d6992e2010 FS: 0000000000000000(0000) GS:ffff99d6aac00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000078fbdba43480 CR3: 000000010e464000 CR4: 00000000001506f0 Call Trace: <TASK> ? __die_body+0x1f/0x70 ? die+0x3d/0x60 ? do_trap+0xa4/0x110 ? __list_add_valid_or_report+0x5e/0xb0 ? do_error_trap+0x6d/0x90 ? __list_add_valid_or_report+0x5e/0xb0 ? handle_invalid_op+0x30/0x40 ? __list_add_valid_or_report+0x5e/0xb0 ? exc_invalid_op+0x3c/0x50 ? asm_exc_invalid_op+0x16/0x20 ? __list_add_valid_or_report+0x5e/0xb0 rtw89_ops_add_interface+0x309/0x310 [rtw89_core 7c32b1ee6854761c0321027c8a58c5160e41f48f] drv_add_interface+0x5c/0x130 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ieee80211_reconfig+0x241/0x13d0 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] ? finish_wait+0x3e/0x90 ? synchronize_rcu_expedited+0x174/0x260 ? sync_rcu_exp_done_unlocked+0x50/0x50 ? wake_bit_function+0x40/0x40 ieee80211_restart_work+0xf0/0x140 [mac80211 83e989e6e616bd5b4b8a2b0a9f9352a2c385a3bc] process_scheduled_works+0x1e5/0x480 worker_thread+0xea/0x1e0 kthread+0xdb/0x110 ? move_linked_works+0x90/0x90 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork+0x3b/0x50 ? kthread_associate_blkcg+0xa0/0xa0 ret_from_fork_asm+0x11/0x20 </TASK> Modules linked in: dm_integrity async_xor xor async_tx lz4 lz4_compress zstd zstd_compress zram zsmalloc rfcomm cmac uinput algif_hash algif_skcipher af_alg btusb btrtl iio_trig_hrtimer industrialio_sw_trigger btmtk industrialio_configfs btbcm btintel uvcvideo videobuf2_vmalloc iio_trig_sysfs videobuf2_memops videobuf2_v4l2 videobuf2_common uvc snd_hda_codec_hdmi veth snd_hda_intel snd_intel_dspcfg acpi_als snd_hda_codec industrialio_triggered_buffer kfifo_buf snd_hwdep industrialio i2c_piix4 snd_hda_core designware_i2s ip6table_nat snd_soc_max98357a xt_MASQUERADE xt_cgroup snd_soc_acp_rt5682_mach fuse rtw89_8922ae(O) rtw89_8922a(O) rtw89_pci(O) rtw89_core(O) 8021q mac80211(O) bluetooth ecdh_generic ecc cfg80211 r8152 mii joydev gsmi: Log Shutdown Reason 0x03 ---[ end trace 0000000000000000 ]---

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49946

In the Linux kernel, the following vulnerability has been resolved: ppp: do not assume bh is held in ppp_channel_bridge_input() Networking receive path is usually handled from BH handler. However, some protocols need to acquire the socket lock, and packets might be stored in the socket backlog is the socket was owned by a user process. In this case, release_sock(), __release_sock(), and sk_backlog_rcv() might call the sk->sk_backlog_rcv() handler in process context. sybot caught ppp was not considering this case in ppp_channel_bridge_input() : WARNING: inconsistent lock state 6.11.0-rc7-syzkaller-g5f5673607153 #0 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. ksoftirqd/1/24 [HC0[0]:SC1[1]:HE1:SE0] takes: ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ffff0000db7f11e0 (&pch->downl){+.?.}-{2:2}, at: ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x240/0x728 kernel/locking/lockdep.c:5759 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2272 [inline] ppp_input+0x16c/0x854 drivers/net/ppp/ppp_generic.c:2304 pppoe_rcv_core+0xfc/0x314 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv include/net/sock.h:1111 [inline] __release_sock+0x1a8/0x3d8 net/core/sock.c:3004 release_sock+0x68/0x1b8 net/core/sock.c:3558 pppoe_sendmsg+0xc8/0x5d8 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x374/0x4f4 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __arm64_sys_sendto+0xd8/0xf8 net/socket.c:2212 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 irq event stamp: 282914 hardirqs last enabled at (282914): [<ffff80008b42e30c>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (282914): [<ffff80008b42e30c>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194 hardirqs last disabled at (282913): [<ffff80008b42e13c>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (282913): [<ffff80008b42e13c>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:162 softirqs last enabled at (282904): [<ffff8000801f8e88>] softirq_handle_end kernel/softirq.c:400 [inline] softirqs last enabled at (282904): [<ffff8000801f8e88>] handle_softirqs+0xa3c/0xbfc kernel/softirq.c:582 softirqs last disabled at (282909): [<ffff8000801fbdf8>] run_ksoftirqd+0x70/0x158 kernel/softirq.c:928 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&pch->downl); <Interrupt> lock(&pch->downl); *** DEADLOCK *** 1 lock held by ksoftirqd/1/24: #0: ffff80008f74dfa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x10/0x4c include/linux/rcupdate.h:325 stack backtrace: CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326 __dump_sta ---truncated---

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49948

A flaw was found in the Linux kernel's network handling, specifically within the `qdisc_pkt_len_init()` function. A local user could exploit this by crafting a malicious Generic Segmentation Offload (GSO) packet. Insufficient sanity checks in the `virtio_net_hdr_to_skb()` function allow for an underflow in the packet length calculation. This underflow can lead to a denial of service (DoS) condition, making the system unavailable.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49950

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. This use-after-free vulnerability in the l2cap_connect function could allow a local attacker with administrative privileges to cause a denial of service or potentially execute arbitrary code.

6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed If mgmt_index_removed is called while there are commands queued on cmd_sync it could lead to crashes like the bellow trace: 0x0000053D: __list_del_entry_valid_or_report+0x98/0xdc 0x0000053D: mgmt_pending_remove+0x18/0x58 [bluetooth] 0x0000053E: mgmt_remove_adv_monitor_complete+0x80/0x108 [bluetooth] 0x0000053E: hci_cmd_sync_work+0xbc/0x164 [bluetooth] So while handling mgmt_index_removed this attempts to dequeue commands passed as user_data to cmd_sync.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49954

In the Linux kernel, the following vulnerability has been resolved: static_call: Replace pointless WARN_ON() in static_call_module_notify() static_call_module_notify() triggers a WARN_ON(), when memory allocation fails in __static_call_add_module(). That's not really justified, because the failure case must be correctly handled by the well known call chain and the error code is passed through to the initiating userspace application. A memory allocation fail is not a fatal problem, but the WARN_ON() takes the machine out when panic_on_warn is set. Replace it with a pr_warn().

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49959

A flaw was found in the `jbd2` component of the Linux kernel. When an input/output (I/O) error occurs during the journal cleanup process, the system may continue to wait for journal space that cannot be freed. This improper error handling can lead to a system becoming unresponsive or experiencing a denial of service (DoS) condition.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49960

In the Linux kernel, the following vulnerability has been resolved: ext4: fix timer use-after-free on failed mount Syzbot has found an ODEBUG bug in ext4_fill_super The del_timer_sync function cancels the s_err_report timer, which reminds about filesystem errors daily. We should guarantee the timer is no longer active before kfree(sbi). When filesystem mounting fails, the flow goes to failed_mount3, where an error occurs when ext4_stop_mmpd is called, causing a read I/O failure. This triggers the ext4_handle_error function that ultimately re-arms the timer, leaving the s_err_report timer active before kfree(sbi) is called. Fix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49962

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) Component Architecture (ACPICA). A missing check for a null return value from a memory allocation function (`ACPI_ALLOCATE_ZEROED()`) in the `acpi_db_convert_to_package()` function can lead to a null pointer dereference. This vulnerability could allow a local attacker to cause a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49967

No description is available for this CVE.

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-49968

A flaw was found in the Linux kernel's ext4 filesystem. This vulnerability occurs when an attempt is made to mount an ext4 filesystem using the DX_HASH_SIPHASH default hash version on a filesystem that does not have the casefold feature enabled. Under these specific conditions, the mounting process will fail, leading to a denial of service by preventing access to the filesystem.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49971

A flaw was found in the Linux kernel's `drm/amd/display` component. This vulnerability occurs because the `dml2_core_shared_mode_support` and `dml_core_mode_support` functions attempt to access an array element beyond its allocated size. A local attacker could potentially exploit this out-of-bounds write, leading to a system crash or denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49973

In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the tally counter, what may result in the chip dma'ing these new fields to unallocated memory. Therefore make sure that the allocated memory area is big enough to hold all of the tally counter values, even if we use only parts of it.

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49974

A flaw was found in the Linux kernel's Network File System Daemon (NFSD). An attacker can exploit this by initiating an unlimited number of concurrent asynchronous copy operations. This can lead to resource exhaustion and a Denial of Service (DoS) condition, making the system unresponsive to legitimate requests.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49975

In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_READ, VM_EXEC results in the same pgprot_t as VM_EXEC|VM_READ, although this doesn't really matter, debugger can read this memory anyway.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49977

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix zero-division error when disabling tc cbs The commit b8c43360f6e4 ("net: stmmac: No need to calculate speed divider when offload is disabled") allows the "port_transmit_rate_kbps" to be set to a value of 0, which is then passed to the "div_s64" function when tc-cbs is disabled. This leads to a zero-division error. When tc-cbs is disabled, the idleslope, sendslope, and credit values the credit values are not required to be configured. Therefore, adding a return statement after setting the txQ mode to DCB when tc-cbs is disabled would prevent a zero-division error.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-369 - Divide By Zero
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-49983

In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process: ext4_ext_replay_update_ex ppath = path ext4_force_split_extent_at(&ppath) ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth ext4_find_extent if (depth > path[0].p_maxdepth) kfree(path) ---> path First freed *orig_path = path = NULL ---> null ppath kfree(path) ---> path double-free !!! So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4_find_extent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4_find_extent() instead of using strange error codes.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49991

A flaw was found in the Linux kernel's drm/amdkfd component. This use-after-free vulnerability occurs in the amdkfd_free_gtt_mem function due to incorrect pointer handling. An attacker with administrative privileges could exploit this flaw, potentially leading to information disclosure or a denial of service.

6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49993

This CVE has been marked as Rejected by the assigning CNA.

0.0 (None)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-49994

A flaw was found in the Linux kernel's block subsystem. A local attacker with sufficient privileges could exploit an integer overflow vulnerability in the `BLKSECDISCARD` ioctl. This could lead to a near infinite loop within the `blkdev_issue_secure_erase()` function, resulting in a Denial of Service (DoS) for the affected system.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-49995

No description is available for this CVE.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-49999

A flaw was found in the Linux kernel's AFS (Andrew File System) module. This vulnerability occurs in the afs_wait_for_operation() function, where the op->server pointer is not properly validated for NULL before being used. A local attacker with low privileges could exploit this flaw, leading to a system crash and resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50002

In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __static_call_init(), which allocates a struct static_call_mod to either encapsulate the built-in static call sites of the associated key into it so further modules can be added or to append the module to the module chain. If that allocation fails the function returns with an error code and the module core invokes static_call_del_module() to clean up eventually added static_call_mod entries. This works correctly, when all keys used by the module were converted over to a module chain before the failure. If not then static_call_del_module() causes a #GP as it blindly assumes that key::mods points to a valid struct static_call_mod. The problem is that key::mods is not a individual struct member of struct static_call_key, it's part of a union to save space: union { /* bit 0: 0 = mods, 1 = sites */ unsigned long type; struct static_call_mod *mods; struct static_call_site *sites; }; key::sites is a pointer to the list of built-in usage sites of the static call. The type of the pointer is differentiated by bit 0. A mods pointer has the bit clear, the sites pointer has the bit set. As static_call_del_module() blidly assumes that the pointer is a valid static_call_mod type, it fails to check for this failure case and dereferences the pointer to the list of built-in call sites, which is obviously bogus. Cure it by checking whether the key has a sites or a mods pointer. If it's a sites pointer then the key is not to be touched. As the sites are walked in the same order as in __static_call_init() the site walk can be terminated because all subsequent sites have not been touched by the init code due to the error exit. If it was converted before the allocation fail, then the inner loop which searches for a module match will find nothing. A fail in the second allocation in __static_call_init() is harmless and does not require special treatment. The first allocation succeeded and converted the key to a module chain. That first entry has mod::mod == NULL and mod::next == NULL, so the inner loop of static_call_del_module() will neither find a module match nor a module chain. The next site in the walk was either already converted, but can't match the module, or it will exit the outer loop because it has a static_call_site pointer and not a static_call_mod pointer.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-755 - Improper Handling of Exceptional Conditions
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50006

A flaw was found in the kernel's ext4 filesystem. When an EXT4_IOC_MIGRATE ioctl (input/output control) operation, requiring synchronous updates, races with a write(2) system call, it can lead to a deadlock. This deadlock occurs specifically when the CONFIG_PROVE_LOCKING option is enabled, potentially causing a Denial of Service (DoS) by making the system unresponsive.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50008

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A local attacker could exploit a field-spanning write vulnerability within the `mwifiex_cmd_802_11_scan_ext()` function. This issue could lead to a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50009

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return in case of error. Found by Linux Verification Center (linuxtesting.org) with SVACE.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50013

In the Linux kernel, the following vulnerability has been resolved: exfat: fix memory leak in exfat_load_bitmap() If the first directory entry in the root directory is not a bitmap directory entry, 'bh' will not be released and reassigned, which will cause a memory leak.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50014

A flaw was found in the Linux kernel. When the ext4 filesystem's fast-commit feature is enabled, a local attacker could trigger a condition where an uninitialized lock is accessed during the filesystem's replay path. This can lead to a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50015

An inode corruption flaw was found in the Linux kernel's Ext4 file system functionality related to how a user can interrupt a write using the dax_iomap_rw()function. This flaw allows a local user to make non-fatal mistakes with Ext4, leading to a file system denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50018

This CVE has been marked as Rejected by the assigning CNA.

0.0 (None)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-50019

In the Linux kernel, the following vulnerability has been resolved: kthread: unpark only parked kthread Calling into kthread unparking unconditionally is mostly harmless when the kthread is already unparked. The wake up is then simply ignored because the target is not in TASK_PARKED state. However if the kthread is per CPU, the wake up is preceded by a call to kthread_bind() which expects the task to be inactive and in TASK_PARKED state, which obviously isn't the case if it is unparked. As a result, calling kthread_stop() on an unparked per-cpu kthread triggers such a warning: WARNING: CPU: 0 PID: 11 at kernel/kthread.c:525 __kthread_bind_mask kernel/kthread.c:525 <TASK> kthread_stop+0x17a/0x630 kernel/kthread.c:707 destroy_workqueue+0x136/0xc40 kernel/workqueue.c:5810 wg_destruct+0x1e2/0x2e0 drivers/net/wireguard/device.c:257 netdev_run_todo+0xe1a/0x1000 net/core/dev.c:10693 default_device_exit_batch+0xa14/0xa90 net/core/dev.c:11769 ops_exit_list net/core/net_namespace.c:178 [inline] cleanup_net+0x89d/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Fix this with skipping unecessary unparking while stopping a kthread.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50022

In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that can result in memory failure getting the wrong address. It's a subtle situation that only can be observed in page_mapped_in_vma() after the page is page fault handled by dev_dax_huge_fault. Generally, there is little chance to perform page_mapped_in_vma in dev-dax's page unless in specific error injection to the dax device to trigger an MCE - memory-failure. In that case, page_mapped_in_vma() will be triggered to determine which task is accessing the failure address and kill that task in the end. We used self-developed dax device (which is 2M aligned mapping) , to perform error injection to random address. It turned out that error injected to non-2M-aligned address was causing endless MCE until panic. Because page_mapped_in_vma() kept resulting wrong address and the task accessing the failure address was never killed properly: [ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.049006] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.448042] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.792026] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.162502] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.461116] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.764730] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.042128] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.464293] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.818090] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3787.085297] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page: Recovered It took us several weeks to pinpoint this problem,  but we eventually used bpftrace to trace the page fault and mce address and successfully identified the issue. Joao added: ; Likely we never reproduce in production because we always pin : device-dax regions in the region align they provide (Qemu does : similarly with prealloc in hugetlb/file backed memory). I think this : bug requires that we touch *unpinned* device-dax regions unaligned to : the device-dax selected alignment (page size i.e. 4K/2M/1G)

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-126 - Buffer Over-read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50023

A flaw was found in the Linux kernel's network physical layer (PHY) driver. When a PHY device is unregistered, a missing step to remove its associated LED entry from a list can occur. This vulnerability can be triggered in a specific scenario where a PHY port is repeatedly brought down and up, and its kernel module is removed and re-added. Successful exploitation of this flaw leads to a kernel panic, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50024

In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetlink family if there are still listeners for that family: Oops: Kernel access of bad area, sig: 11 [#1] ... NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 Call Trace: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0 Change the unsafe loop on the list to a safe one, because inside the loop there is an element removal from this list.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-404 - Improper Resource Shutdown or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50027

A flaw was found in the Linux kernel's thermal core component. A local attacker could exploit a use-after-free vulnerability, where a memory object is accessed after it has been released. This improper handling of the thermal zone object during unregistration can lead to a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50028

A flaw was found in the Linux kernel's thermal management component. This vulnerability arises from improper handling of thermal zone objects, where an object could be accessed after it has been released. A local attacker could potentially exploit this to cause a system crash, leading to a denial of service.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50029

A flaw was found in the Linux kernel's Bluetooth subsystem. When an Asynchronous Connection-Less (ACL) connection is destroyed while the `hci_enhanced_setup_sync` function is processing a command, it can lead to a use-after-free (UAF) condition. An adjacent attacker could exploit this vulnerability to cause a denial of service (DoS), disclose sensitive information, or potentially execute arbitrary code.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50033

A flaw was found in the Linux kernel. The `slhc_remember()` function, which handles Serial Line Internet Protocol (SLIP) header compression, did not properly validate incoming packet sizes and headers. A local attacker could exploit this by sending specially crafted malicious packets, leading to an uninitialized memory read and potentially causing a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50035

A flaw was found in the Linux kernel's Point-to-Point Protocol (PPP) implementation. A local attacker can exploit this vulnerability by sending a specially crafted message with a zero size to the `pppoe_sendmsg()` function, which leads to an uninitialized value being used in the `ppp_async_encode()` function. This can result in information disclosure and a denial of service (DoS).

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50038

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: avoid NFPROTO_UNSPEC where needed syzbot managed to call xt_cluster match via ebtables: WARNING: CPU: 0 PID: 11 at net/netfilter/xt_cluster.c:72 xt_cluster_mt+0x196/0x780 [..] ebt_do_table+0x174b/0x2a40 Module registers to NFPROTO_UNSPEC, but it assumes ipv4/ipv6 packet processing. As this is only useful to restrict locally terminating TCP/UDP traffic, register this for ipv4 and ipv6 family only. Pablo points out that this is a general issue, direct users of the set/getsockopt interface can call into targets/matches that were only intended for use with ip(6)tables. Check all UNSPEC matches and targets for similar issues: - matches and targets are fine except if they assume skb_network_header() is valid -- this is only true when called from inet layer: ip(6) stack pulls the ip/ipv6 header into linear data area. - targets that return XT_CONTINUE or other xtables verdicts must be restricted too, they are incompatbile with the ebtables traverser, e.g. EBT_CONTINUE is a completely different value than XT_CONTINUE. Most matches/targets are changed to register for NFPROTO_IPV4/IPV6, as they are provided for use by ip(6)tables. The MARK target is also used by arptables, so register for NFPROTO_ARP too. While at it, bail out if connbytes fails to enable the corresponding conntrack family. This change passes the selftests in iptables.git.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50039

A flaw was found in the Linux kernel's network scheduler. A local attacker with low privileges could exploit a vulnerability related to the handling of the `TCA_STAB` traffic control attribute when used with certain queueing disciplines (qdiscs) like TBF and SFQ. This improper handling can lead to a kernel NULL pointer dereference, causing the system to crash and resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50044

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_state_change attempts to use sock_lock so it must never be called with it locked but rfcomm_sock_ioctl always attempt to lock it causing the following trace: ====================================================== WARNING: possible circular locking dependency detected 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted ------------------------------------------------------ syz-executor386/5093 is trying to acquire lock: ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline] ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73 but task is already holding lock: ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50046

A flaw was found in the Linux kernel's NFSv4 component. A local user, when copying files on an NFS client's mountpoint to another location on the same NFS server, can trigger a null-pointer dereference. This vulnerability can lead to a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50047

A flaw was found in the Linux kernel's Server Message Block (SMB) client. An authenticated local attacker with administrative or root privileges could trigger a use-after-free vulnerability during asynchronous decryption of large reads. This flaw could lead to a system crash, resulting in a denial of service (DoS).

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50055

A flaw was found in the Linux kernel, specifically within the driver core bus API. An issue in the `bus_register()` function can lead to a double free vulnerability. A local attacker with administrative privileges could exploit this to cause memory corruption, potentially resulting in a denial of service or other unpredictable system behavior.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50057

A flaw was found in the Linux kernel's USB Type-C (tipd) driver. When the tps6598x module is removed, the system attempts to free an Interrupt Request (IRQ) even if one was not previously allocated. This improper resource handling can lead to a system warning and potential instability, which may result in a denial of service.

0.0 (None)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CWE-763 - Release of Invalid Pointer or Reference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50058

A flaw was found in the Linux kernel's serial subsystem. This vulnerability occurs in the `uart_shutdown()` function, where a null pointer dereference can happen if the `HUPCL` flag is set. A local attacker could potentially exploit this flaw to cause a system crash, leading to a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50064

A flaw was found in the zram component of the Linux kernel. When a zram device with multiple streams is reset, the secondary algorithm names are not properly freed. This oversight leads to a memory leak, which a local attacker could potentially exploit to cause a Denial of Service (DoS) by exhausting system memory.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50067

An out-of-bounds overflow vulnerability was found in the Linux kernel. When Uprobe needs to fetch args into a per-CPU buffer and then copy to a ring buffer, sometimes user-space strings and arrays can be very large, but the size of the per-CPU buffer is only page size and checking is not performed, so an overflow can occur. This can result in a loss of confidentiality, availability, and integrity

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50073

A user after free vulnerability exists in the linux kernel such that when gsm_cleanup_mux is called,the gsm_msg on the tx_ctrl_list is not freed,resulting in loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50074

An out-of-bounds array access memory flaw was found in the Linux kernel. When snprintf() returns the would-be-printed size, not the actual output size, the length calculation can still go over the given limit and cause an overflow, resulting in loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50075

A flaw was found in the Linux kernel's xHCI (eXtensible Host Controller Interface) Tegra driver. When USB virtualization is enabled and USB2 ports are shared across virtual functions, an incorrect port number check can lead to invalid memory access. A local attacker with high privileges could exploit this vulnerability to cause a system crash (Denial of Service) or potentially disclose sensitive information.

6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50077

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. When the debug file system (debugfs) is not enabled, a logic error can cause the ISO subsystem to be initialized multiple times. This issue can be exploited by a local attacker with low privileges, leading to a kernel error that crashes the system. The primary consequence is a denial of service, making the system unavailable.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-665 - Improper Initialization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50078

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Call iso_exit() on module unload If iso_init() has been called, iso_exit() must be called on module unload. Without that, the struct proto that iso_init() registered with proto_register() becomes invalid, which could cause unpredictable problems later. In my case, with CONFIG_LIST_HARDENED and CONFIG_BUG_ON_DATA_CORRUPTION enabled, loading the module again usually triggers this BUG(): list_add corruption. next->prev should be prev (ffffffffb5355fd0), but was 0000000000000068. (next=ffffffffc0a010d0). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:29! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 4159 Comm: modprobe Not tainted 6.10.11-4+bt2-ao-desktop #1 RIP: 0010:__list_add_valid_or_report+0x61/0xa0 ... __list_add_valid_or_report+0x61/0xa0 proto_register+0x299/0x320 hci_sock_init+0x16/0xc0 [bluetooth] bt_init+0x68/0xd0 [bluetooth] __pfx_bt_init+0x10/0x10 [bluetooth] do_one_initcall+0x80/0x2f0 do_init_module+0x8b/0x230 __do_sys_init_module+0x15f/0x190 do_syscall_64+0x68/0x110 ...

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50081

In the Linux kernel, the following vulnerability has been resolved: blk-mq: setup queue ->tag_set before initializing hctx Commit 7b815817aa58 ("blk-mq: add helper for checking if one CPU is mapped to specified hctx") needs to check queue mapping via tag set in hctx's cpuhp handler. However, q->tag_set may not be setup yet when the cpuhp handler is enabled, then kernel oops is triggered. Fix the issue by setup queue tag_set before initializing hctx.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50082

In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing crashes from rq_qos_wake_function that look like this: BUG: unable to handle page fault for address: ffffafe180a40084 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 100000067 P4D 100000067 PUD 10027c067 PMD 10115d067 PTE 0 Oops: Oops: 0002 [#1] PREEMPT SMP PTI CPU: 17 UID: 0 PID: 0 Comm: swapper/17 Not tainted 6.12.0-rc3-00013-geca631b8fe80 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:_raw_spin_lock_irqsave+0x1d/0x40 Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 9c 41 5c fa 65 ff 05 62 97 30 4c 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 0a 4c 89 e0 41 5c c3 cc cc cc cc 89 c6 e8 2c 0b 00 RSP: 0018:ffffafe180580ca0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffffafe180a3f7a8 RCX: 0000000000000011 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffafe180a40084 RBP: 0000000000000000 R08: 00000000001e7240 R09: 0000000000000011 R10: 0000000000000028 R11: 0000000000000888 R12: 0000000000000002 R13: ffffafe180a40084 R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff9aaf1f280000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffafe180a40084 CR3: 000000010e428002 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> try_to_wake_up+0x5a/0x6a0 rq_qos_wake_function+0x71/0x80 __wake_up_common+0x75/0xa0 __wake_up+0x36/0x60 scale_up.part.0+0x50/0x110 wb_timer_fn+0x227/0x450 ... So rq_qos_wake_function() calls wake_up_process(data->task), which calls try_to_wake_up(), which faults in raw_spin_lock_irqsave(&p->pi_lock). p comes from data->task, and data comes from the waitqueue entry, which is stored on the waiter's stack in rq_qos_wait(). Analyzing the core dump with drgn, I found that the waiter had already woken up and moved on to a completely unrelated code path, clobbering what was previously data->task. Meanwhile, the waker was passing the clobbered garbage in data->task to wake_up_process(), leading to the crash. What's happening is that in between rq_qos_wake_function() deleting the waitqueue entry and calling wake_up_process(), rq_qos_wait() is finding that it already got a token and returning. The race looks like this: rq_qos_wait() rq_qos_wake_function() ============================================================== prepare_to_wait_exclusive() data->got_token = true; list_del_init(&curr->entry); if (data.got_token) break; finish_wait(&rqw->wait, &data.wq); ^- returns immediately because list_empty_careful(&wq_entry->entry) is true ... return, go do something else ... wake_up_process(data->task) (NO LONGER VALID!)-^ Normally, finish_wait() is supposed to synchronize against the waker. But, as noted above, it is returning immediately because the waitqueue entry has already been removed from the waitqueue. The bug is that rq_qos_wake_function() is accessing the waitqueue entry AFTER deleting it. Note that autoremove_wake_function() wakes the waiter and THEN deletes the waitqueue entry, which is the proper order. Fix it by swapping the order. We also need to use list_del_init_careful() to match the list_empty_careful() in finish_wait().

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50093

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: int340x: processor: Fix warning during module unload The processor_thermal driver uses pcim_device_enable() to enable a PCI device, which means the device will be automatically disabled on driver detach. Thus there is no need to call pci_disable_device() again on it. With recent PCI device resource management improvements, e.g. commit f748a07a0b64 ("PCI: Remove legacy pcim_release()"), this problem is exposed and triggers the warining below. [ 224.010735] proc_thermal_pci 0000:00:04.0: disabling already-disabled device [ 224.010747] WARNING: CPU: 8 PID: 4442 at drivers/pci/pci.c:2250 pci_disable_device+0xe5/0x100 ... [ 224.010844] Call Trace: [ 224.010845] <TASK> [ 224.010847] ? show_regs+0x6d/0x80 [ 224.010851] ? __warn+0x8c/0x140 [ 224.010854] ? pci_disable_device+0xe5/0x100 [ 224.010856] ? report_bug+0x1c9/0x1e0 [ 224.010859] ? handle_bug+0x46/0x80 [ 224.010862] ? exc_invalid_op+0x1d/0x80 [ 224.010863] ? asm_exc_invalid_op+0x1f/0x30 [ 224.010867] ? pci_disable_device+0xe5/0x100 [ 224.010869] ? pci_disable_device+0xe5/0x100 [ 224.010871] ? kfree+0x21a/0x2b0 [ 224.010873] pcim_disable_device+0x20/0x30 [ 224.010875] devm_action_release+0x16/0x20 [ 224.010878] release_nodes+0x47/0xc0 [ 224.010880] devres_release_all+0x9f/0xe0 [ 224.010883] device_unbind_cleanup+0x12/0x80 [ 224.010885] device_release_driver_internal+0x1ca/0x210 [ 224.010887] driver_detach+0x4e/0xa0 [ 224.010889] bus_remove_driver+0x6f/0xf0 [ 224.010890] driver_unregister+0x35/0x60 [ 224.010892] pci_unregister_driver+0x44/0x90 [ 224.010894] proc_thermal_pci_driver_exit+0x14/0x5f0 [processor_thermal_device_pci] ... [ 224.010921] ---[ end trace 0000000000000000 ]--- Remove the excess pci_disable_device() calls. [ rjw: Subject and changelog edits ]

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-459 - Incomplete Cleanup
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50101

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices Previously, the domain_context_clear() function incorrectly called pci_for_each_dma_alias() to set up context entries for non-PCI devices. This could lead to kernel hangs or other unexpected behavior. Add a check to only call pci_for_each_dma_alias() for PCI devices. For non-PCI devices, domain_context_clear_one() is called directly.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50102

A flaw was found in the Linux kernel's handling of user address masking on x86 architectures. This vulnerability, similar to "Meltdown Lite," allows for speculative execution (a CPU optimization technique) to be exploited due to incorrect handling of non-canonical memory accesses in kernel space. A local attacker with low privileges could leverage this issue to potentially leak sensitive data from kernel memory. This affects AMD Zen 5 and newer processors, where the speculation window remains open.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE-203 - Observable Discrepancy
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50106

A vulnerability was found in the Linux kernel. This issue occurs due to a race condition between the laundromat thread handling revoking delegations and the `free_stateid` operation, leading to a use-after-free issue. The error occurs when a freed stateid is accessed by another operation, which can cause memory corruption.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50107

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses Commit 50c6dbdfd16e ("x86/ioremap: Improve iounmap() address range checks") introduces a WARN when adrress ranges of iounmap are invalid. On Thinkpad P1 Gen 7 (Meteor Lake-P) this caused the following warning to appear: WARNING: CPU: 7 PID: 713 at arch/x86/mm/ioremap.c:461 iounmap+0x58/0x1f0 Modules linked in: rfkill(+) snd_timer(+) fjes(+) snd soundcore intel_pmc_core(+) int3403_thermal(+) int340x_thermal_zone intel_vsec pmt_telemetry acpi_pad pmt_class acpi_tad int3400_thermal acpi_thermal_rel joydev loop nfnetlink zram xe drm_suballoc_helper nouveau i915 mxm_wmi drm_ttm_helper gpu_sched drm_gpuvm drm_exec drm_buddy i2c_algo_bit crct10dif_pclmul crc32_pclmul ttm crc32c_intel polyval_clmulni rtsx_pci_sdmmc ucsi_acpi polyval_generic mmc_core hid_multitouch drm_display_helper ghash_clmulni_intel typec_ucsi nvme sha512_ssse3 video sha256_ssse3 nvme_core intel_vpu sha1_ssse3 rtsx_pci cec typec nvme_auth i2c_hid_acpi i2c_hid wmi pinctrl_meteorlake serio_raw ip6_tables ip_tables fuse CPU: 7 UID: 0 PID: 713 Comm: (udev-worker) Not tainted 6.12.0-rc2iounmap+ #42 Hardware name: LENOVO 21KWCTO1WW/21KWCTO1WW, BIOS N48ET19W (1.06 ) 07/18/2024 RIP: 0010:iounmap+0x58/0x1f0 Code: 85 6a 01 00 00 48 8b 05 e6 e2 28 04 48 39 c5 72 19 eb 26 cc cc cc 48 ba 00 00 00 00 00 00 32 00 48 8d 44 02 ff 48 39 c5 72 23 <0f> 0b 48 83 c4 08 5b 5d 41 5c c3 cc cc cc cc 48 ba 00 00 00 00 00 RSP: 0018:ffff888131eff038 EFLAGS: 00010207 RAX: ffffc90000000000 RBX: 0000000000000000 RCX: ffff888e33b80000 RDX: dffffc0000000000 RSI: ffff888e33bc29c0 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8881598a8000 R09: ffff888e2ccedc10 R10: 0000000000000003 R11: ffffffffb3367634 R12: 00000000fe000000 R13: ffff888101d0da28 R14: ffffffffc2e437e0 R15: ffff888110b03b28 FS: 00007f3c1d4b3980(0000) GS:ffff888e33b80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005651cfc93578 CR3: 0000000124e4c002 CR4: 0000000000f70ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn.cold+0xb6/0x176 ? iounmap+0x58/0x1f0 ? report_bug+0x1f4/0x2b0 ? handle_bug+0x58/0x90 ? exc_invalid_op+0x17/0x40 ? asm_exc_invalid_op+0x1a/0x20 ? iounmap+0x58/0x1f0 pmc_core_ssram_get_pmc+0x477/0x6c0 [intel_pmc_core] ? __pfx_pmc_core_ssram_get_pmc+0x10/0x10 [intel_pmc_core] ? __pfx_do_pci_enable_device+0x10/0x10 ? pci_wait_for_pending+0x60/0x110 ? pci_enable_device_flags+0x1e3/0x2e0 ? __pfx_mtl_core_init+0x10/0x10 [intel_pmc_core] pmc_core_ssram_init+0x7f/0x110 [intel_pmc_core] mtl_core_init+0xda/0x130 [intel_pmc_core] ? __mutex_init+0xb9/0x130 pmc_core_probe+0x27e/0x10b0 [intel_pmc_core] ? _raw_spin_lock_irqsave+0x96/0xf0 ? __pfx_pmc_core_probe+0x10/0x10 [intel_pmc_core] ? __pfx_mutex_unlock+0x10/0x10 ? __pfx_mutex_lock+0x10/0x10 ? device_pm_check_callbacks+0x82/0x370 ? acpi_dev_pm_attach+0x234/0x2b0 platform_probe+0x9f/0x150 really_probe+0x1e0/0x8a0 __driver_probe_device+0x18c/0x370 ? __pfx___driver_attach+0x10/0x10 driver_probe_device+0x4a/0x120 __driver_attach+0x190/0x4a0 ? __pfx___driver_attach+0x10/0x10 bus_for_each_dev+0x103/0x180 ? __pfx_bus_for_each_dev+0x10/0x10 ? klist_add_tail+0x136/0x270 bus_add_driver+0x2fc/0x540 driver_register+0x1a5/0x360 ? __pfx_pmc_core_driver_init+0x10/0x10 [intel_pmc_core] do_one_initcall+0xa4/0x380 ? __pfx_do_one_initcall+0x10/0x10 ? kasan_unpoison+0x44/0x70 do_init_module+0x296/0x800 load_module+0x5090/0x6ce0 ? __pfx_load_module+0x10/0x10 ? ima_post_read_file+0x193/0x200 ? __pfx_ima_post_read_file+0x10/0x10 ? rw_verify_area+0x152/0x4c0 ? kernel_read_file+0x257/0x750 ? __pfx_kernel_read_file+0x10/0x10 ? __pfx_filemap_get_read_batch+0x10/0x10 ? init_module_from_file+0xd1/0x130 init_module_from_file+0xd1/0x130 ? __pfx_init_module_from_file+0x10/0 ---truncated---

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50109

A flaw was found in the Linux kernel's `md/raid10` component. A local attacker could trigger a null pointer dereference in the `raid10_size()` function. This occurs when an internal function returns zero, but a critical data structure remains uninitialized, leading to a system crash. This vulnerability can result in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50117

A flaw was found in the Linux kernel's drm/amd graphics driver. If a system's BIOS (Basic Input/Output System) provides malformed data in response to an ATIF (AMD Thermal and Interrupt Function) ACPI (Advanced Configuration and Power Interface) method call, it can lead to a NULL pointer dereference. This vulnerability could allow a local attacker with low privileges to cause a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50120

In the Linux kernel, the following vulnerability has been resolved: smb: client: Handle kstrdup failures for passwords In smb3_reconfigure(), after duplicating ctx->password and ctx->password2 with kstrdup(), we need to check for allocation failures. If ses->password allocation fails, return -ENOMEM. If ses->password2 allocation fails, free ses->password, set it to NULL, and return -ENOMEM.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50121

In the Linux kernel, the following vulnerability has been resolved: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_state_shutdown_net` will release all resources related to the hashed `nfs4_client`. If the `nfsd_client_shrinker` is running concurrently, the `expire_client` function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well. nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads expire_client nfsd_shutdown_net unhash_client ... nfs4_state_shutdown_net /* won't wait shrinker exit */ /* cancel_work(&nn->nfsd_shrinker_work) * nfsd_file for this /* won't destroy unhashed client1 */ * client1 still alive nfs4_state_destroy_net */ nfsd_file_cache_shutdown /* trigger warning */ kmem_cache_destroy(nfsd_file_slab) kmem_cache_destroy(nfsd_file_mark_slab) /* release nfsd_file and mark */ __destroy_client ==================================================================== BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() -------------------------------------------------------------------- CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1 dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e ==================================================================== BUG nfsd_file_mark (Tainted: G B W ): Objects remaining nfsd_file_mark on __kmem_cache_shutdown() -------------------------------------------------------------------- dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xc8/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e To resolve this issue, cancel `nfsd_shrinker_work` using synchronous mode in nfs4_state_shutdown_net.

5.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50126

A use-after-free vulnerability was found in the taprio_dump() function in the Linux kernel.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50127

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin' pointer may become dangling due to sched switch / removal caused by 'advance_sched()', and critical section protected by 'q->current_entry_lock' is too small to prevent from such a scenario (which causes use-after-free detected by KASAN). Fix this by prefer 'rcu_replace_pointer()' over 'rcu_assign_pointer()' to update 'admin' immediately before an attempt to schedule freeing.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50128

A flaw was found in the Wireless Wide Area Network (WWAN) subsystem of the Linux kernel. This vulnerability, an out-of-bounds read, occurs when the system incorrectly processes network communication attributes due to an improperly sized variable. A local attacker with low privileges could exploit this to read sensitive information from memory. Successful exploitation could also lead to a system crash, resulting in a denial of service.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50130

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: must hold reference on net namespace BUG: KASAN: slab-use-after-free in __nf_unregister_net_hook+0x640/0x6b0 Read of size 8 at addr ffff8880106fe400 by task repro/72= bpf_nf_link_release+0xda/0x1e0 bpf_link_free+0x139/0x2d0 bpf_link_release+0x68/0x80 __fput+0x414/0xb60 Eric says: It seems that bpf was able to defer the __nf_unregister_net_hook() after exit()/close() time. Perhaps a netns reference is missing, because the netns has been dismantled/freed already. bpf_nf_link_attach() does : link->net = net; But I do not see a reference being taken on net. Add such a reference and release it after hook unreg. Note that I was unable to get syzbot reproducer to work, so I do not know if this resolves this splat.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50141

A flaw was found in the Linux kernel's ACPI Platform Runtime Mechanism (PRM) functionality. The Platform Runtime Mechanism Translator (PRMT) incorrectly attempts to use conventional memory instead of runtime memory for EFI (Extensible Firmware Interface) runtime services, specifically for the PRM handler and its context. This misconfiguration can lead to a paging request error when the PRM handler is invoked. A local attacker could potentially exploit this to cause a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50143

In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50150

A flaw was found in the Linux kernel's USB Type-C alternate mode (altmode) driver. A local attacker could exploit a use-after-free vulnerability when the altmode device release refers to its parent without maintaining a proper reference. This could lead to a system crash, resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50151

A flaw was found in the cifs module in the Linux kernel. When building SMB2_IOCTL requests using encryption, either enforced by the server or using the 'seal' mount option, an out-of-bounds write can be triggered when the user passes an input buffer greater than 328 bytes, resulting in memory corruption and a kernel crash.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50152

A doubly freeing memory vulnerability exists in the Linux kernel smb client. After the first successful memory allocation for 'ea', the second memory release for 'ea' will result in double free, leading to loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50153

A flaw was found in the Linux kernel's SCSI target core. When memory allocation for device queues fails within the `target_alloc_device()` function, the system attempts to free an uninitialized device transport structure. This can lead to a null pointer dereference, allowing a local attacker with low privileges to cause a system crash, resulting in a Denial of Service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50162

In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect rxq contains a pointer to the device from where the redirect happened. Currently, the BPF program that was executed after a redirect via BPF_MAP_TYPE_DEVMAP* does not have it set. This is particularly bad since accessing ingress_ifindex, e.g. SEC("xdp") int prog(struct xdp_md *pkt) { return bpf_redirect_map(&dev_redirect_map, 0, 0); } SEC("xdp/devmap") int prog_after_redirect(struct xdp_md *pkt) { bpf_printk("ifindex %i", pkt->ingress_ifindex); return XDP_PASS; } depends on access to rxq, so a NULL pointer gets dereferenced: <1>[ 574.475170] BUG: kernel NULL pointer dereference, address: 0000000000000000 <1>[ 574.475188] #PF: supervisor read access in kernel mode <1>[ 574.475194] #PF: error_code(0x0000) - not-present page <6>[ 574.475199] PGD 0 P4D 0 <4>[ 574.475207] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI <4>[ 574.475217] CPU: 4 UID: 0 PID: 217 Comm: kworker/4:1 Not tainted 6.11.0-rc5-reduced-00859-g780801200300 #23 <4>[ 574.475226] Hardware name: Intel(R) Client Systems NUC13ANHi7/NUC13ANBi7, BIOS ANRPL357.0026.2023.0314.1458 03/14/2023 <4>[ 574.475231] Workqueue: mld mld_ifc_work <4>[ 574.475247] RIP: 0010:bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c <4>[ 574.475257] Code: cc cc cc cc cc cc cc 80 00 00 00 cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 0f 1e fa 48 8b 57 20 <48> 8b 52 00 8b 92 e0 00 00 00 48 bf f8 a6 d5 c4 5d a0 ff ff be 0b <4>[ 574.475263] RSP: 0018:ffffa62440280c98 EFLAGS: 00010206 <4>[ 574.475269] RAX: ffffa62440280cd8 RBX: 0000000000000001 RCX: 0000000000000000 <4>[ 574.475274] RDX: 0000000000000000 RSI: ffffa62440549048 RDI: ffffa62440280ce0 <4>[ 574.475278] RBP: ffffa62440280c98 R08: 0000000000000002 R09: 0000000000000001 <4>[ 574.475281] R10: ffffa05dc8b98000 R11: ffffa05f577fca40 R12: ffffa05dcab24000 <4>[ 574.475285] R13: ffffa62440280ce0 R14: ffffa62440549048 R15: ffffa62440549000 <4>[ 574.475289] FS: 0000000000000000(0000) GS:ffffa05f4f700000(0000) knlGS:0000000000000000 <4>[ 574.475294] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 574.475298] CR2: 0000000000000000 CR3: 000000025522e000 CR4: 0000000000f50ef0 <4>[ 574.475303] PKRU: 55555554 <4>[ 574.475306] Call Trace: <4>[ 574.475313] <IRQ> <4>[ 574.475318] ? __die+0x23/0x70 <4>[ 574.475329] ? page_fault_oops+0x180/0x4c0 <4>[ 574.475339] ? skb_pp_cow_data+0x34c/0x490 <4>[ 574.475346] ? kmem_cache_free+0x257/0x280 <4>[ 574.475357] ? exc_page_fault+0x67/0x150 <4>[ 574.475368] ? asm_exc_page_fault+0x26/0x30 <4>[ 574.475381] ? bpf_prog_5e13354d9cf5018a_prog_after_redirect+0x17/0x3c <4>[ 574.475386] bq_xmit_all+0x158/0x420 <4>[ 574.475397] __dev_flush+0x30/0x90 <4>[ 574.475407] veth_poll+0x216/0x250 [veth] <4>[ 574.475421] __napi_poll+0x28/0x1c0 <4>[ 574.475430] net_rx_action+0x32d/0x3a0 <4>[ 574.475441] handle_softirqs+0xcb/0x2c0 <4>[ 574.475451] do_softirq+0x40/0x60 <4>[ 574.475458] </IRQ> <4>[ 574.475461] <TASK> <4>[ 574.475464] __local_bh_enable_ip+0x66/0x70 <4>[ 574.475471] __dev_queue_xmit+0x268/0xe40 <4>[ 574.475480] ? selinux_ip_postroute+0x213/0x420 <4>[ 574.475491] ? alloc_skb_with_frags+0x4a/0x1d0 <4>[ 574.475502] ip6_finish_output2+0x2be/0x640 <4>[ 574.475512] ? nf_hook_slow+0x42/0xf0 <4>[ 574.475521] ip6_finish_output+0x194/0x300 <4>[ 574.475529] ? __pfx_ip6_finish_output+0x10/0x10 <4>[ 574.475538] mld_sendpack+0x17c/0x240 <4>[ 574.475548] mld_ifc_work+0x192/0x410 <4>[ 574.475557] process_one_work+0x15d/0x380 <4>[ 574.475566] worker_thread+0x29d/0x3a0 <4>[ 574.475573] ? __pfx_worker_thread+0x10/0x10 <4>[ 574.475580] ? __pfx_worker_thread+0x10/0x10 <4>[ 574.475587] kthread+0xcd/0x100 <4>[ 574.475597] ? __pfx_kthread+0x10/0x10 <4>[ 574.475606] ret_from_fork+0x31/0x50 <4>[ 574.475615] ? __pfx_kthread+0x10/0x10 <4>[ 574.475623] ret_from_fork_asm+0x1a/0x ---truncated---

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50163

In the Linux kernel, the following vulnerability has been resolved: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap The bpf_redirect_info is shared between the SKB and XDP redirect paths, and the two paths use the same numeric flag values in the ri->flags field (specifically, BPF_F_BROADCAST == BPF_F_NEXTHOP). This means that if skb bpf_redirect_neigh() is used with a non-NULL params argument and, subsequently, an XDP redirect is performed using the same bpf_redirect_info struct, the XDP path will get confused and end up crashing, which syzbot managed to trigger. With the stack-allocated bpf_redirect_info, the structure is no longer shared between the SKB and XDP paths, so the crash doesn't happen anymore. However, different code paths using identically-numbered flag values in the same struct field still seems like a bit of a mess, so this patch cleans that up by moving the flag definitions together and redefining the three flags in BPF_F_REDIRECT_INTERNAL to not overlap with the flags used for XDP. It also adds a BUILD_BUG_ON() check to make sure the overlap is not re-introduced by mistake.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50169

A flaw was found in the Linux kernel's `vsock` component. A local attacker can exploit an imbalance in the `rx_bytes` tracking mechanism, specifically after `vsock_transport::read_skb()` fails to update the received bytes count when a packet is dequeued. This can lead to a warning message indicating an empty receive queue with non-zero `rx_bytes`, potentially resulting in a denial of service (DoS) for the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50182

A flaw was found in the Linux kernel. On certain ARM64 systems, the memfd_secret() system call, intended to create secure memory regions, may appear to function correctly but fails to remove the memory from the direct map. This silent failure means that memory designated as secret is not properly protected. An attacker could potentially exploit this to access sensitive information stored in these supposedly secure memory areas, leading to information disclosure.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50186

A flaw was found in the Linux kernel's networking component. When a network socket fails to be created, a reference to a previously freed memory location, known as a "dangling pointer," is not properly cleared. This oversight could allow a local attacker with low privileges to cause the system to become unstable or crash, leading to a denial of service (DoS).

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50189

A flaw was found in the Linux kernel's AMD Sensor Fusion Hub (SFH) Human Interface Device (HID) driver. Improper memory cleanup during the device's initialization process can lead to memory errors and system instability. A local attacker with low privileges could exploit this to trigger page faults, cause the Btrfs file system to become read-only, or lead to Btrfs disk corruption, effectively causing a Denial of Service (DoS) and potential data loss.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-404 - Improper Resource Shutdown or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50191

A flaw was found in the Linux kernel's handling of filesystem errors. When a filesystem encounters an error and is configured to remount as read-only, the kernel's attempt to apply this setting can conflict with other filesystem operations, specifically during filesystem freezing. This conflict can lead to system instability, potentially resulting in a denial of service where the system becomes unresponsive.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-833 - Deadlock
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50197

In the Linux kernel, the following vulnerability has been resolved: pinctrl: intel: platform: fix error path in device_for_each_child_node() The device_for_each_child_node() loop requires calls to fwnode_handle_put() upon early returns to decrement the refcount of the child node and avoid leaking memory if that error path is triggered. There is one early returns within that loop in intel_platform_pinctrl_prepare_community(), but fwnode_handle_put() is missing. Instead of adding the missing call, the scoped version of the loop can be used to simplify the code and avoid mistakes in the future if new early returns are added, as the child node is only used for parsing, and it is never assigned.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50199

A flaw was found in the Linux kernel's memory management, specifically in how it handles HugeTLB (Huge Transparent Large Block) pages during the `swapoff` operation. A local user can trigger this by allocating anonymous HugeTLB memory, swapping out other anonymous memory, and then executing the `swapoff` command. This can lead to a 'bad pud error' and prevent the HugeTLB pages from being properly freed, resulting in a memory leak and a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50200

A flaw was found in the Linux kernel's maple tree implementation. A local attacker could exploit a tree corruption bug when performing a spanning store operation across two leaf nodes under specific conditions. This can lead to the mistaken duplication of entries, resulting in maple tree corruption. This corruption may allow an attacker to cause a denial of service or potentially gain unauthorized access to sensitive information.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50201

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix encoder->possible_clones Include the encoder itself in its possible_clones bitmask. In the past nothing validated that drivers were populating possible_clones correctly, but that changed in commit 74d2aacbe840 ("drm: Validate encoder->possible_clones"). Looks like radeon never got the memo and is still not following the rules 100% correctly. This results in some warnings during driver initialization: Bogus possible_clones: [ENCODER:46:TV-46] possible_clones=0x4 (full encoder mask=0x7) WARNING: CPU: 0 PID: 170 at drivers/gpu/drm/drm_mode_config.c:615 drm_mode_config_validate+0x113/0x39c ... (cherry picked from commit 3b6e7d40649c0d75572039aff9d0911864c689db)

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-50215

A flaw was found in the nvmet-auth component of the Linux kernel. An authenticated local attacker with administrative privileges could trigger a double free vulnerability by repeatedly calling nvmet_setup_dhgroup(). This could lead to a denial of service (DoS) or potentially arbitrary code execution.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50216

In the Linux kernel, the following vulnerability has been resolved: xfs: fix finding a last resort AG in xfs_filestream_pick_ag When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG. But the loop for that uses args->pag as loop iterator while the later code expects pag to be set. Fix this by reusing the max_pag case for this last resort, and also add a check for impossible case of no AG just to make sure that the uninitialized pag doesn't even escape in theory.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-457 - Use of Uninitialized Variable
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50219

No description is available for this CVE.

CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-50228

No description is available for this CVE.

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-50235

A flaw was found in the Linux kernel's wifi: cfg80211 subsystem. A local attacker with administrative privileges could exploit this vulnerability. When a wireless device (wdev/netdev) is unregistered, its cqm_config pointer is freed but not cleared. If the same device is re-registered in another network namespace and subsequently destroyed, it leads to a double-free. This can result in a system crash (denial of service) or potentially allow for arbitrary code execution.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-415 - Double Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50236

A flaw was found in the Linux kernel. Memory allocated for the MSDU (MAC Service Data Unit) context during management packet transmission is not properly freed upon completion or cleanup. A local attacker could exploit this memory leak to exhaust system resources, leading to a denial of service (DoS).

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50237

A flaw was found in the Linux kernel's Wi-Fi subsystem. This vulnerability occurs when a stopped virtual interface (vif) is improperly passed to the Wi-Fi driver's power management function. This can lead to the use of uninitialized data, potentially causing the system to crash and resulting in a Denial of Service (DoS). A local attacker could exploit this flaw.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50256

A flaw was found in the Linux kernel's netfilter component, specifically within the `nf_reject_ipv6` module. This vulnerability arises when the system attempts to process an IPv6 packet where the network device's header length is unexpectedly zero, leading to a kernel crash. A remote attacker could exploit this flaw by sending a specially crafted IPv6 packet, resulting in a Denial of Service (DoS) on the affected system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50261

A use-after-free vulnerability was found in the Linux kernel. The metadata_dst, which is used to store the SCI value for macsec offload, is freed by metadata_dst_free() in macsec_free_netdev(), while the driver still uses it to send the packet.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50271

In the Linux kernel, the following vulnerability has been resolved: signal: restore the override_rlimit logic Prior to commit d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of signals. However now it's enforced unconditionally, even if override_rlimit is set. This behavior change caused production issues. For example, if the limit is reached and a process receives a SIGSEGV signal, sigqueue_alloc fails to allocate the necessary resources for the signal delivery, preventing the signal from being delivered with siginfo. This prevents the process from correctly identifying the fault address and handling the error. From the user-space perspective, applications are unaware that the limit has been reached and that the siginfo is effectively 'corrupted'. This can lead to unpredictable behavior and crashes, as we observed with java applications. Fix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip the comparison to max there if override_rlimit is set. This effectively restores the old behavior.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-670 - Always-Incorrect Control Flow Implementation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50272

In the Linux kernel, the following vulnerability has been resolved: filemap: Fix bounds checking in filemap_read() If the caller supplies an iocb->ki_pos value that is close to the filesystem upper limit, and an iterator with a count that causes us to overflow that limit, then filemap_read() enters an infinite loop. This behaviour was discovered when testing xfstests generic/525 with the "localio" optimisation for loopback NFS mounts.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50278

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds access occurs if the fast device is expanded unexpectedly before the first-time resume of the cache table. This happens because expanding the fast device requires reloading the cache table for cache_create to allocate new in-core data structures that fit the new size, and the check in cache_preresume is not performed during the first resume, leading to the issue. Reproduce steps: 1. prepare component devices: dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct 2. load a cache table of 512 cache blocks, and deliberately expand the fast device before resuming the cache, making the in-core data structures inadequate. dmsetup create cache --notable dmsetup reload cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup reload cdata --table "0 131072 linear /dev/sdc 8192" dmsetup resume cdata dmsetup resume cache 3. suspend the cache to write out the in-core dirty bitset and hint array, leading to out-of-bounds access to the dirty bitset at offset 0x40: dmsetup suspend cache KASAN reports: BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80 Read of size 8 at addr ffffc90000085040 by task dmsetup/90 (...snip...) The buggy address belongs to the virtual mapping at [ffffc90000085000, ffffc90000087000) created by: cache_ctr+0x176a/0x35f0 (...snip...) Memory state around the buggy address: ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Fix by checking the size change on the first resume.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50282

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buffer overflow if size is larger than 4K. (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434)

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50299

In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctp_sf_ootb() to address a crash reported by syzbot: BUG: KMSAN: uninit-value in sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_sf_ootb+0x7f5/0xce0 net/sctp/sm_statefuns.c:3712 sctp_do_sm+0x181/0x93d0 net/sctp/sm_sideeffect.c:1166 sctp_endpoint_bh_rcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_rcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4_rcv+0x42/0x50 net/sctp/protocol.c:1159 ip_protocol_deliver_rcu+0xb51/0x13d0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x336/0x500 net/ipv4/ip_input.c:233

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 - Use of Uninitialized Resource
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-50304

In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control path where the mutex is taken. Add a lockdep expression to hlist_for_each_entry_rcu() in ip_tunnel_find() in order to validate that the mutex is held and to silence the suspicious RCU usage warning [1]. [1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gd95d9a31aceb #139 Not tainted ----------------------------- net/ipv4/ip_tunnel.c:221 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/362: #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60 stack backtrace: CPU: 12 UID: 0 PID: 362 Comm: ip Not tainted 6.12.0-rc3-custom-gd95d9a31aceb #139 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 ip_tunnel_find+0x435/0x4d0 ip_tunnel_newlink+0x517/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53042

In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() There are code paths from which the function is called without holding the RCU read lock, resulting in a suspicious RCU usage warning [1]. Fix by using l3mdev_master_upper_ifindex_by_index() which will acquire the RCU read lock before calling l3mdev_master_upper_ifindex_by_index_rcu(). [1] WARNING: suspicious RCU usage 6.12.0-rc3-custom-gac8f72681cf2 #141 Not tainted ----------------------------- net/core/dev.c:876 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/361: #0: ffffffff86fc7cb0 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x377/0xf60 stack backtrace: CPU: 3 UID: 0 PID: 361 Comm: ip Not tainted 6.12.0-rc3-custom-gac8f72681cf2 #141 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0xba/0x110 lockdep_rcu_suspicious.cold+0x4f/0xd6 dev_get_by_index_rcu+0x1d3/0x210 l3mdev_master_upper_ifindex_by_index_rcu+0x2b/0xf0 ip_tunnel_bind_dev+0x72f/0xa00 ip_tunnel_newlink+0x368/0x7a0 ipgre_newlink+0x14c/0x170 __rtnl_newlink+0x1173/0x19c0 rtnl_newlink+0x6c/0xa0 rtnetlink_rcv_msg+0x3cc/0xf60 netlink_rcv_skb+0x171/0x450 netlink_unicast+0x539/0x7f0 netlink_sendmsg+0x8c1/0xd80 ____sys_sendmsg+0x8f9/0xc20 ___sys_sendmsg+0x197/0x1e0 __sys_sendmsg+0x122/0x1f0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-662 - Improper Synchronization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53044

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() This command: $ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact Error: block dev insert failed: -EBUSY. fails because user space requests the same block index to be set for both ingress and egress. [ side note, I don't think it even failed prior to commit 913b47d3424e ("net/sched: Introduce tc block netdev tracking infra"), because this is a command from an old set of notes of mine which used to work, but alas, I did not scientifically bisect this ] The problem is not that it fails, but rather, that the second time around, it fails differently (and irrecoverably): $ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact Error: dsa_core: Flow block cb is busy. [ another note: the extack is added by me for illustration purposes. the context of the problem is that clsact_init() obtains the same &q->ingress_block pointer as &q->egress_block, and since we call tcf_block_get_ext() on both of them, "dev" will be added to the block->ports xarray twice, thus failing the operation: once through the ingress block pointer, and once again through the egress block pointer. the problem itself is that when xa_insert() fails, we have emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the offload never sees a corresponding FLOW_BLOCK_UNBIND. ] Even correcting the bad user input, we still cannot recover: $ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact Error: dsa_core: Flow block cb is busy. Basically the only way to recover is to reboot the system, or unbind and rebind the net device driver. To fix the bug, we need to fill the correct error teardown path which was missed during code movement, and call tcf_block_offload_unbind() when xa_insert() fails. [ last note, fundamentally I blame the label naming convention in tcf_block_get_ext() for the bug. The labels should be named after what they do, not after the error path that jumps to them. This way, it is obviously wrong that two labels pointing to the same code mean something is wrong, and checking the code correctness at the goto site is also easier ]

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-672 - Operation on a Resource after Expiration or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53047

In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcu_read_lock Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created: ============================= WARNING: suspicious RCU usage 6.12.0-rc2+ #11 Not tainted ----------------------------- net/mptcp/sched.c:44 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 no locks held by mptcp_connect/176. stack backtrace: CPU: 0 UID: 0 PID: 176 Comm: mptcp_connect Not tainted 6.12.0-rc2+ #11 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) lockdep_rcu_suspicious (kernel/locking/lockdep.c:6822) mptcp_sched_find (net/mptcp/sched.c:44 (discriminator 7)) mptcp_init_sock (net/mptcp/protocol.c:2867 (discriminator 1)) ? sock_init_data_uid (arch/x86/include/asm/atomic.h:28) inet_create.part.0.constprop.0 (net/ipv4/af_inet.c:386) ? __sock_create (include/linux/rcupdate.h:347 (discriminator 1)) __sock_create (net/socket.c:1576) __sys_socket (net/socket.c:1671) ? __pfx___sys_socket (net/socket.c:1712) ? do_user_addr_fault (arch/x86/mm/fault.c:1419 (discriminator 1)) __x64_sys_socket (net/socket.c:1728) do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) That's because when the socket is initialised, rcu_read_lock() is not used despite the explicit comment written above the declaration of mptcp_sched_find() in sched.c. Adding the missing lock/unlock avoids the warning.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53050

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: Add encoder check in hdcp2_get_capability Add encoder check in intel_hdcp2_get_capability to avoid null pointer error.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53051

In the Linux kernel, the following vulnerability has been resolved: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability Sometimes during hotplug scenario or suspend/resume scenario encoder is not always initialized when intel_hdcp_get_capability add a check to avoid kernel null pointer dereference.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53055

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix 6 GHz scan construction If more than 255 colocated APs exist for the set of all APs found during 2.4/5 GHz scanning, then the 6 GHz scan construction will loop forever since the loop variable has type u8, which can never reach the number found when that's bigger than 255, and is stored in a u32 variable. Also move it into the loops to have a smaller scope. Using a u32 there is fine, we limit the number of APs in the scan list and each has a limit on the number of RNR entries due to the frame size. With a limit of 1000 scan results, a frame size upper bound of 4096 (really it's more like ~2300) and a TBTT entry size of at least 11, we get an upper bound for the number of ~372k, well in the bounds of a u32.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53057

A flaw was found in the packet scheduler API in the Linux kernel. An invalid assumption about qdiscs with major handle ffff allows qdiscs, such as DRR, that maintain an active class list to cause a use-after-free with a dangling class pointer.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53059

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The size of the response packet is not validated. 2. The response buffer is not freed. Resolve these issues by switching to iwl_mvm_send_cmd_status(), which handles both size validation and frees the buffer.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-460 - Improper Cleanup on Thrown Exception
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53060

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported acpi_evaluate_object() may return AE_NOT_FOUND (failure), which would result in dereferencing buffer.pointer (obj) while being NULL. Although this case may be unrealistic for the current code, it is still better to protect against possible bugs. Bail out also when status is AE_NOT_FOUND. This fixes 1 FORWARD_NULL issue reported by Coverity Report: CID 1600951: Null pointer dereferences (FORWARD_NULL) (cherry picked from commit 91c9e221fe2553edf2db71627d8453f083de87a1)

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53070

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: fix fault at system suspend if device was already runtime suspended If the device was already runtime suspended then during system suspend we cannot access the device registers else it will crash. Also we cannot access any registers after dwc3_core_exit() on some platforms so move the dwc3_enable_susphy() call to the top.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53072

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Detect when STB is not available Loading the amd_pmc module as: amd_pmc enable_stb=1 ...can result in the following messages in the kernel ring buffer: amd_pmc AMDI0009:00: SMU cmd failed. err: 0xff ioremap on RAM at 0x0000000000000000 - 0x0000000000ffffff WARNING: CPU: 10 PID: 2151 at arch/x86/mm/ioremap.c:217 __ioremap_caller+0x2cd/0x340 Further debugging reveals that this occurs when the requests for S2D_PHYS_ADDR_LOW and S2D_PHYS_ADDR_HIGH return a value of 0, indicating that the STB is inaccessible. To prevent the ioremap warning and provide clarity to the user, handle the invalid address and display an error message.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53074

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't leak a link on AP removal Release the link mapping resource in AP removal. This impacted devices that do not support the MLD API (9260 and down). On those devices, we couldn't start the AP again after the AP has been already started and stopped.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53082

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Add hash_key_length check Add hash_key_length check in virtnet_probe() to avoid possible out of bound errors when setting/reading the hash key.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53085

In the Linux kernel, the following vulnerability has been resolved: tpm: Lock TPM chip in tpm_pm_suspend() first Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53091

In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx As the introduction of the support for vsock and unix sockets in sockmap, tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK. vsock and af_unix sockets have vsock_sock and unix_sock instead of inet_connection_sock. For these sockets, tls_get_ctx may return an invalid pointer and cause page fault in function tls_sw_ctx_rx. BUG: unable to handle page fault for address: 0000000000040030 Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:sk_psock_strp_data_ready+0x23/0x60 Call Trace: ? __die+0x81/0xc3 ? no_context+0x194/0x350 ? do_page_fault+0x30/0x110 ? async_page_fault+0x3e/0x50 ? sk_psock_strp_data_ready+0x23/0x60 virtio_transport_recv_pkt+0x750/0x800 ? update_load_avg+0x7e/0x620 vsock_loopback_work+0xd0/0x100 process_one_work+0x1a7/0x360 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? __kthread_cancel_work+0x40/0x40 ret_from_fork+0x1f/0x40 v2: - Add IS_ICSK check v3: - Update the commits in Fixes

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53093

A flaw was found in the NVMe multipath support in the Linux kernel. A deadlock can be triggered when an error occurs in the partition scan within the controller's scan_work context, potentially resulting in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-833 - Deadlock
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53095

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free of network namespace. Recently, we got a customer report that CIFS triggers oops while reconnecting to a server. [0] The workload runs on Kubernetes, and some pods mount CIFS servers in non-root network namespaces. The problem rarely happened, but it was always while the pod was dying. The root cause is wrong reference counting for network namespace. CIFS uses kernel sockets, which do not hold refcnt of the netns that the socket belongs to. That means CIFS must ensure the socket is always freed before its netns; otherwise, use-after-free happens. The repro steps are roughly: 1. mount CIFS in a non-root netns 2. drop packets from the netns 3. destroy the netns 4. unmount CIFS We can reproduce the issue quickly with the script [1] below and see the splat [2] if CONFIG_NET_NS_REFCNT_TRACKER is enabled. When the socket is TCP, it is hard to guarantee the netns lifetime without holding refcnt due to async timers. Let's hold netns refcnt for each socket as done for SMC in commit 9744d2bf1976 ("smc: Fix use-after-free in tcp_write_timer_handler()."). Note that we need to move put_net() from cifs_put_tcp_session() to clean_demultiplex_info(); otherwise, __sock_create() still could touch a freed netns while cifsd tries to reconnect from cifs_demultiplex_thread(). Also, maybe_get_net() cannot be put just before __sock_create() because the code is not under RCU and there is a small chance that the same address happened to be reallocated to another netns. [0]: CIFS: VFS: \\XXXXXXXXXXX has not responded in 15 seconds. Reconnecting... CIFS: Serverclose failed 4 times, giving up Unable to handle kernel paging request at virtual address 14de99e461f84a07 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [14de99e461f84a07] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: cls_bpf sch_ingress nls_utf8 cifs cifs_arc4 cifs_md4 dns_resolver tcp_diag inet_diag veth xt_state xt_connmark nf_conntrack_netlink xt_nat xt_statistic xt_MASQUERADE xt_mark xt_addrtype ipt_REJECT nf_reject_ipv4 nft_chain_nat nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_comment nft_compat nf_tables nfnetlink overlay nls_ascii nls_cp437 sunrpc vfat fat aes_ce_blk aes_ce_cipher ghash_ce sm4_ce_cipher sm4 sm3_ce sm3 sha3_ce sha512_ce sha512_arm64 sha1_ce ena button sch_fq_codel loop fuse configfs dmi_sysfs sha2_ce sha256_arm64 dm_mirror dm_region_hash dm_log dm_mod dax efivarfs CPU: 5 PID: 2690970 Comm: cifsd Not tainted 6.1.103-109.184.amzn2023.aarch64 #1 Hardware name: Amazon EC2 r7g.4xlarge/, BIOS 1.0 11/1/2018 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : fib_rules_lookup+0x44/0x238 lr : __fib_lookup+0x64/0xbc sp : ffff8000265db790 x29: ffff8000265db790 x28: 0000000000000000 x27: 000000000000bd01 x26: 0000000000000000 x25: ffff000b4baf8000 x24: ffff00047b5e4580 x23: ffff8000265db7e0 x22: 0000000000000000 x21: ffff00047b5e4500 x20: ffff0010e3f694f8 x19: 14de99e461f849f7 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 3f92800abd010002 x11: 0000000000000001 x10: ffff0010e3f69420 x9 : ffff800008a6f294 x8 : 0000000000000000 x7 : 0000000000000006 x6 : 0000000000000000 x5 : 0000000000000001 x4 : ffff001924354280 x3 : ffff8000265db7e0 x2 : 0000000000000000 x1 : ffff0010e3f694f8 x0 : ffff00047b5e4500 Call trace: fib_rules_lookup+0x44/0x238 __fib_lookup+0x64/0xbc ip_route_output_key_hash_rcu+0x2c4/0x398 ip_route_output_key_hash+0x60/0x8c tcp_v4_connect+0x290/0x488 __inet_stream_connect+0x108/0x3d0 inet_stream_connect+0x50/0x78 kernel_connect+0x6c/0xac generic_ip_conne ---truncated---

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53096

In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity arises from trying to handle errors late in the process of mapping a VMA, which forms the basis of recently observed issues with resource leaks and observable inconsistent state. Taking advantage of previous patches in this series we move a number of checks earlier in the code, simplifying things by moving the core of the logic into a static internal function __mmap_region(). Doing this allows us to perform a number of checks up front before we do any real work, and allows us to unwind the writable unmap check unconditionally as required and to perform a CONFIG_DEBUG_VM_MAPLE_TREE validation unconditionally also. We move a number of things here: 1. We preallocate memory for the iterator before we call the file-backed memory hook, allowing us to exit early and avoid having to perform complicated and error-prone close/free logic. We carefully free iterator state on both success and error paths. 2. The enclosing mmap_region() function handles the mapping_map_writable() logic early. Previously the logic had the mapping_map_writable() at the point of mapping a newly allocated file-backed VMA, and a matching mapping_unmap_writable() on success and error paths. We now do this unconditionally if this is a file-backed, shared writable mapping. If a driver changes the flags to eliminate VM_MAYWRITE, however doing so does not invalidate the seal check we just performed, and we in any case always decrement the counter in the wrapper. We perform a debug assert to ensure a driver does not attempt to do the opposite. 3. We also move arch_validate_flags() up into the mmap_region() function. This is only relevant on arm64 and sparc64, and the check is only meaningful for SPARC with ADI enabled. We explicitly add a warning for this arch if a driver invalidates this check, though the code ought eventually to be fixed to eliminate the need for this. With all of these measures in place, we no longer need to explicitly close the VMA on error paths, as we place all checks which might fail prior to a call to any driver mmap hook. This eliminates an entire class of errors, makes the code easier to reason about and more robust.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53097

In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in __do_krealloc This patch addresses an issue introduced by commit 1a83a716ec233 ("mm: krealloc: consider spare memory for __GFP_ZERO") which causes MTE (Memory Tagging Extension) to falsely report a slab-out-of-bounds error. The problem occurs when zeroing out spare memory in __do_krealloc. The original code only considered software-based KASAN and did not account for MTE. It does not reset the KASAN tag before calling memset, leading to a mismatch between the pointer tag and the memory tag, resulting in a false positive. Example of the error: ================================================================== swapper/0: BUG: KASAN: slab-out-of-bounds in __memset+0x84/0x188 swapper/0: Write at addr f4ffff8005f0fdf0 by task swapper/0/1 swapper/0: Pointer tag: [f4], memory tag: [fe] swapper/0: swapper/0: CPU: 4 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12. swapper/0: Hardware name: MT6991(ENG) (DT) swapper/0: Call trace: swapper/0: dump_backtrace+0xfc/0x17c swapper/0: show_stack+0x18/0x28 swapper/0: dump_stack_lvl+0x40/0xa0 swapper/0: print_report+0x1b8/0x71c swapper/0: kasan_report+0xec/0x14c swapper/0: __do_kernel_fault+0x60/0x29c swapper/0: do_bad_area+0x30/0xdc swapper/0: do_tag_check_fault+0x20/0x34 swapper/0: do_mem_abort+0x58/0x104 swapper/0: el1_abort+0x3c/0x5c swapper/0: el1h_64_sync_handler+0x80/0xcc swapper/0: el1h_64_sync+0x68/0x6c swapper/0: __memset+0x84/0x188 swapper/0: btf_populate_kfunc_set+0x280/0x3d8 swapper/0: __register_btf_kfunc_id_set+0x43c/0x468 swapper/0: register_btf_kfunc_id_set+0x48/0x60 swapper/0: register_nf_nat_bpf+0x1c/0x40 swapper/0: nf_nat_init+0xc0/0x128 swapper/0: do_one_initcall+0x184/0x464 swapper/0: do_initcall_level+0xdc/0x1b0 swapper/0: do_initcalls+0x70/0xc0 swapper/0: do_basic_setup+0x1c/0x28 swapper/0: kernel_init_freeable+0x144/0x1b8 swapper/0: kernel_init+0x20/0x1a8 swapper/0: ret_from_fork+0x10/0x20 ==================================================================

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53103

In the Linux kernel, the following vulnerability has been resolved: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer When hvs is released, there is a possibility that vsk->trans may not be initialized to NULL, which could lead to a dangling pointer. This issue is resolved by initializing vsk->trans to NULL.

6.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53105

In the Linux kernel, the following vulnerability has been resolved: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() Syzbot reported a bad page state problem caused by a page being freed using free_page() still having a mlocked flag at free_pages_prepare() stage: BUG: Bad page state in process syz.5.504 pfn:61f45 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61f45 flags: 0xfff00000080204(referenced|workingset|mlocked|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000080204 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 8443, tgid 8442 (syz.5.504), ts 201884660643, free_ts 201499827394 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0x303f/0x3190 mm/page_alloc.c:3457 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 kvm_coalesced_mmio_init+0x1f/0xf0 virt/kvm/coalesced_mmio.c:99 kvm_create_vm virt/kvm/kvm_main.c:1235 [inline] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5488 [inline] kvm_dev_ioctl+0x12dc/0x2240 virt/kvm/kvm_main.c:5530 __do_compat_sys_ioctl fs/ioctl.c:1007 [inline] __se_compat_sys_ioctl+0x510/0xc90 fs/ioctl.c:950 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb4/0x110 arch/x86/entry/common.c:386 do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411 entry_SYSENTER_compat_after_hwframe+0x84/0x8e page last free pid 8399 tgid 8399 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_folios+0xf12/0x18d0 mm/page_alloc.c:2686 folios_put_refs+0x76c/0x860 mm/swap.c:1007 free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:335 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465 exit_mmap+0x496/0xc40 mm/mmap.c:1926 __mmput+0x115/0x390 kernel/fork.c:1348 exit_mm+0x220/0x310 kernel/exit.c:571 do_exit+0x9b2/0x28e0 kernel/exit.c:926 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Modules linked in: CPU: 0 UID: 0 PID: 8442 Comm: syz.5.504 Not tainted 6.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 bad_page+0x176/0x1d0 mm/page_alloc.c:501 free_page_is_bad mm/page_alloc.c:918 [inline] free_pages_prepare mm/page_alloc.c:1100 [inline] free_unref_page+0xed0/0xf20 mm/page_alloc.c:2638 kvm_destroy_vm virt/kvm/kvm_main.c:1327 [inline] kvm_put_kvm+0xc75/0x1350 virt/kvm/kvm_main.c:1386 kvm_vcpu_release+0x54/0x60 virt/kvm/kvm_main.c:4143 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [in ---truncated---

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53110

In the Linux kernel, the following vulnerability has been resolved: vp_vdpa: fix id_table array not null terminated error Allocate one extra virtio_device_id as null terminator, otherwise vdpa_mgmtdev_get_classes() may iterate multiple times and visit undefined memory.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-170 - Improper Null Termination
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53117

In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Improve MSG_ZEROCOPY error handling Add a missing kfree_skb() to prevent memory leaks.

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53118

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix sk_error_queue memory leak Kernel queues MSG_ZEROCOPY completion notifications on the error queue. Where they remain, until explicitly recv()ed. To prevent memory leaks, clean up the queue when the socket is destroyed. unreferenced object 0xffff8881028beb00 (size 224): comm "vsock_test", pid 1218, jiffies 4294694897 hex dump (first 32 bytes): 90 b0 21 17 81 88 ff ff 90 b0 21 17 81 88 ff ff ..!.......!..... 00 00 00 00 00 00 00 00 00 b0 21 17 81 88 ff ff ..........!..... backtrace (crc 6c7031ca): [<ffffffff81418ef7>] kmem_cache_alloc_node_noprof+0x2f7/0x370 [<ffffffff81d35882>] __alloc_skb+0x132/0x180 [<ffffffff81d2d32b>] sock_omalloc+0x4b/0x80 [<ffffffff81d3a8ae>] msg_zerocopy_realloc+0x9e/0x240 [<ffffffff81fe5cb2>] virtio_transport_send_pkt_info+0x412/0x4c0 [<ffffffff81fe6183>] virtio_transport_stream_enqueue+0x43/0x50 [<ffffffff81fe0813>] vsock_connectible_sendmsg+0x373/0x450 [<ffffffff81d233d5>] ____sys_sendmsg+0x365/0x3a0 [<ffffffff81d246f4>] ___sys_sendmsg+0x84/0xd0 [<ffffffff81d26f47>] __sys_sendmsg+0x47/0x80 [<ffffffff820d3df3>] do_syscall_64+0x93/0x180 [<ffffffff8220012b>] entry_SYSCALL_64_after_hwframe+0x76/0x7e

6.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53120

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow In error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add() callback returns error, zone_rule->attr is used uninitiated. Fix it to use attr which has the needed pointer value. Kernel log: BUG: kernel NULL pointer dereference, address: 0000000000000110 RIP: 0010:mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core] … Call Trace: <TASK> ? __die+0x20/0x70 ? page_fault_oops+0x150/0x3e0 ? exc_page_fault+0x74/0x140 ? asm_exc_page_fault+0x22/0x30 ? mlx5_tc_ct_entry_add_rule+0x2b1/0x2f0 [mlx5_core] ? mlx5_tc_ct_entry_add_rule+0x1d5/0x2f0 [mlx5_core] mlx5_tc_ct_block_flow_offload+0xc6a/0xf90 [mlx5_core] ? nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table] nf_flow_offload_tuple+0xd8/0x190 [nf_flow_table] flow_offload_work_handler+0x142/0x320 [nf_flow_table] ? finish_task_switch.isra.0+0x15b/0x2b0 process_one_work+0x16c/0x320 worker_thread+0x28c/0x3a0 ? __pfx_worker_thread+0x10/0x10 kthread+0xb8/0xf0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53121

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, lock FTE when checking if active The referenced commits introduced a two-step process for deleting FTEs: - Lock the FTE, delete it from hardware, set the hardware deletion function to NULL and unlock the FTE. - Lock the parent flow group, delete the software copy of the FTE, and remove it from the xarray. However, this approach encounters a race condition if a rule with the same match value is added simultaneously. In this scenario, fs_core may set the hardware deletion function to NULL prematurely, causing a panic during subsequent rule deletions. To prevent this, ensure the active flag of the FTE is checked under a lock, which will prevent the fs_core layer from attaching a new steering rule to an FTE that is in the process of deletion. [ 438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func [ 438.968205] ------------[ cut here ]------------ [ 438.968654] refcount_t: decrement hit 0; leaking memory. [ 438.969249] WARNING: CPU: 0 PID: 8957 at lib/refcount.c:31 refcount_warn_saturate+0xfb/0x110 [ 438.970054] Modules linked in: act_mirred cls_flower act_gact sch_ingress openvswitch nsh mlx5_vdpa vringh vhost_iotlb vdpa mlx5_ib mlx5_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core zram zsmalloc fuse [last unloaded: cls_flower] [ 438.973288] CPU: 0 UID: 0 PID: 8957 Comm: tc Not tainted 6.12.0-rc1+ #8 [ 438.973888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 438.974874] RIP: 0010:refcount_warn_saturate+0xfb/0x110 [ 438.975363] Code: 40 66 3b 82 c6 05 16 e9 4d 01 01 e8 1f 7c a0 ff 0f 0b c3 cc cc cc cc 48 c7 c7 10 66 3b 82 c6 05 fd e8 4d 01 01 e8 05 7c a0 ff <0f> 0b c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 [ 438.976947] RSP: 0018:ffff888124a53610 EFLAGS: 00010286 [ 438.977446] RAX: 0000000000000000 RBX: ffff888119d56de0 RCX: 0000000000000000 [ 438.978090] RDX: ffff88852c828700 RSI: ffff88852c81b3c0 RDI: ffff88852c81b3c0 [ 438.978721] RBP: ffff888120fa0e88 R08: 0000000000000000 R09: ffff888124a534b0 [ 438.979353] R10: 0000000000000001 R11: 0000000000000001 R12: ffff888119d56de0 [ 438.979979] R13: ffff888120fa0ec0 R14: ffff888120fa0ee8 R15: ffff888119d56de0 [ 438.980607] FS: 00007fe6dcc0f800(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000 [ 438.983984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 438.984544] CR2: 00000000004275e0 CR3: 0000000186982001 CR4: 0000000000372eb0 [ 438.985205] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 438.985842] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 438.986507] Call Trace: [ 438.986799] <TASK> [ 438.987070] ? __warn+0x7d/0x110 [ 438.987426] ? refcount_warn_saturate+0xfb/0x110 [ 438.987877] ? report_bug+0x17d/0x190 [ 438.988261] ? prb_read_valid+0x17/0x20 [ 438.988659] ? handle_bug+0x53/0x90 [ 438.989054] ? exc_invalid_op+0x14/0x70 [ 438.989458] ? asm_exc_invalid_op+0x16/0x20 [ 438.989883] ? refcount_warn_saturate+0xfb/0x110 [ 438.990348] mlx5_del_flow_rules+0x2f7/0x340 [mlx5_core] [ 438.990932] __mlx5_eswitch_del_rule+0x49/0x170 [mlx5_core] [ 438.991519] ? mlx5_lag_is_sriov+0x3c/0x50 [mlx5_core] [ 438.992054] ? xas_load+0x9/0xb0 [ 438.992407] mlx5e_tc_rule_unoffload+0x45/0xe0 [mlx5_core] [ 438.993037] mlx5e_tc_del_fdb_flow+0x2a6/0x2e0 [mlx5_core] [ 438.993623] mlx5e_flow_put+0x29/0x60 [mlx5_core] [ 438.994161] mlx5e_delete_flower+0x261/0x390 [mlx5_core] [ 438.994728] tc_setup_cb_destroy+0xb9/0x190 [ 438.995150] fl_hw_destroy_filter+0x94/0xc0 [cls_flower] [ 438.995650] fl_change+0x11a4/0x13c0 [cls_flower] [ 438.996105] tc_new_tfilter+0x347/0xbc0 [ 438.996503] ? __ ---truncated---

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53123

In the Linux kernel, the following vulnerability has been resolved: mptcp: error out earlier on disconnect Eric reported a division by zero splat in the MPTCP protocol: Oops: divide error: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 6094 Comm: syz-executor317 Not tainted 6.12.0-rc5-syzkaller-00291-g05b92660cdfe #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__tcp_select_window+0x5b4/0x1310 net/ipv4/tcp_output.c:3163 Code: f6 44 01 e3 89 df e8 9b 75 09 f8 44 39 f3 0f 8d 11 ff ff ff e8 0d 74 09 f8 45 89 f4 e9 04 ff ff ff e8 00 74 09 f8 44 89 f0 99 <f7> 7c 24 14 41 29 d6 45 89 f4 e9 ec fe ff ff e8 e8 73 09 f8 48 89 RSP: 0018:ffffc900041f7930 EFLAGS: 00010293 RAX: 0000000000017e67 RBX: 0000000000017e67 RCX: ffffffff8983314b RDX: 0000000000000000 RSI: ffffffff898331b0 RDI: 0000000000000004 RBP: 00000000005d6000 R08: 0000000000000004 R09: 0000000000017e67 R10: 0000000000003e80 R11: 0000000000000000 R12: 0000000000003e80 R13: ffff888031d9b440 R14: 0000000000017e67 R15: 00000000002eb000 FS: 00007feb5d7f16c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feb5d8adbb8 CR3: 0000000074e4c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __tcp_cleanup_rbuf+0x3e7/0x4b0 net/ipv4/tcp.c:1493 mptcp_rcv_space_adjust net/mptcp/protocol.c:2085 [inline] mptcp_recvmsg+0x2156/0x2600 net/mptcp/protocol.c:2289 inet_recvmsg+0x469/0x6a0 net/ipv4/af_inet.c:885 sock_recvmsg_nosec net/socket.c:1051 [inline] sock_recvmsg+0x1b2/0x250 net/socket.c:1073 __sys_recvfrom+0x1a5/0x2e0 net/socket.c:2265 __do_sys_recvfrom net/socket.c:2283 [inline] __se_sys_recvfrom net/socket.c:2279 [inline] __x64_sys_recvfrom+0xe0/0x1c0 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7feb5d857559 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007feb5d7f1208 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007feb5d8e1318 RCX: 00007feb5d857559 RDX: 000000800000000e RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007feb5d8e1310 R08: 0000000000000000 R09: ffffffff81000000 R10: 0000000000000100 R11: 0000000000000246 R12: 00007feb5d8e131c R13: 00007feb5d8ae074 R14: 000000800000000e R15: 00000000fffffdef and provided a nice reproducer. The root cause is the current bad handling of racing disconnect. After the blamed commit below, sk_wait_data() can return (with error) with the underlying socket disconnected and a zero rcv_mss. Catch the error and return without performing any additional operations on the current socket.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53124

In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc5 #26 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x1c5/0x1e0 Code: 24 12 4c 89 e2 5b 48 c7 c7 98 ec bb 82 41 5c e9 d1 18 17 ff 4c 89 e6 5b 48 c7 c7 d0 ec bb 82 41 5c e9 bf 18 17 ff 0f 0b eb 83 <0f> 0b eb 97 0f 0b eb 87 0f 0b e9 68 ff ff ff 66 66 2e 0f 1f 84 00 RSP: 0018:ffffc9000008bd90 EFLAGS: 00010206 RAX: 0000000000000300 RBX: ffff88810b172a90 RCX: 0000000000000007 RDX: 0000000000000002 RSI: 0000000000000300 RDI: ffff88810b172a00 RBP: ffff88810b172a00 R08: ffff888104273c00 R09: 0000000000100007 R10: 0000000000020000 R11: 0000000000000006 R12: ffff88810b172a00 R13: 0000000000000004 R14: 0000000000000000 R15: ffff888237c31f78 FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc63fecac8 CR3: 000000000342e000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x88/0x130 ? inet_sock_destruct+0x1c5/0x1e0 ? report_bug+0x18e/0x1a0 ? handle_bug+0x53/0x90 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? inet_sock_destruct+0x1c5/0x1e0 __sk_destruct+0x2a/0x200 rcu_do_batch+0x1aa/0x530 ? rcu_do_batch+0x13b/0x530 rcu_core+0x159/0x2f0 handle_softirqs+0xd3/0x2b0 ? __pfx_smpboot_thread_fn+0x10/0x10 run_ksoftirqd+0x25/0x30 smpboot_thread_fn+0xdd/0x1d0 kthread+0xd3/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> ---[ end trace 0000000000000000 ]--- Its possible that two threads call tcp_v6_do_rcv()/sk_forward_alloc_add() concurrently when sk->sk_state == TCP_LISTEN with sk->sk_lock unlocked, which triggers a data-race around sk->sk_forward_alloc: tcp_v6_rcv tcp_v6_do_rcv skb_clone_and_charge_r sk_rmem_schedule __sk_mem_schedule sk_forward_alloc_add() skb_set_owner_r sk_mem_charge sk_forward_alloc_add() __kfree_skb skb_release_all skb_release_head_state sock_rfree sk_mem_uncharge sk_forward_alloc_add() sk_mem_reclaim // set local var reclaimable __sk_mem_reclaim sk_forward_alloc_add() In this syzkaller testcase, two threads call tcp_v6_do_rcv() with skb->truesize=768, the sk_forward_alloc changes like this: (cpu 1) | (cpu 2) | sk_forward_alloc ... | ... | 0 __sk_mem_schedule() | | +4096 = 4096 | __sk_mem_schedule() | +4096 = 8192 sk_mem_charge() | | -768 = 7424 | sk_mem_charge() | -768 = 6656 ... | ... | sk_mem_uncharge() | | +768 = 7424 reclaimable=7424 | | | sk_mem_uncharge() | +768 = 8192 | reclaimable=8192 | __sk_mem_reclaim() | | -4096 = 4096 | __sk_mem_reclaim() | -8192 = -4096 != 0 The skb_clone_and_charge_r() should not be called in tcp_v6_do_rcv() when sk->sk_state is TCP_LISTEN, it happens later in tcp_v6_syn_recv_sock(). Fix the same issue in dccp_v6_do_rcv().

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53134

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx93-blk-ctrl: correct remove path The check condition should be 'i < bc->onecell_data.num_domains', not 'bc->onecell_data.num_domains' which will make the look never finish and cause kernel panic. Also disable runtime to address "imx93-blk-ctrl 4ac10000.system-controller: Unbalanced pm_runtime_enable!"

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-670 - Always-Incorrect Control Flow Implementation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53136

In the Linux kernel, the following vulnerability has been resolved: mm: revert "mm: shmem: fix data-race in shmem_getattr()" Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS. As Hugh commented, "added just to silence a syzbot sanitizer splat: added where there has never been any practical problem".

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53141

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add missing range check in bitmap_ip_uadt When tb[IPSET_ATTR_IP_TO] is not present but tb[IPSET_ATTR_CIDR] exists, the values of ip and ip_to are slightly swapped. Therefore, the range check for ip should be done later, but this part is missing and it seems that the vulnerability occurs. So we should add missing range checks and remove unnecessary range checks.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Important
CVE-2024-53142

In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpio_file := ALGN(4) + cpio_header + filename + "\0" + ALGN(4) + data ... 55 ============= ================== ========================= 56 Field name Field size Meaning 57 ============= ================== ========================= ... 70 c_namesize 8 bytes Length of filename, including final \0 When extracting an initramfs cpio archive, the kernel's do_name() path handler assumes a zero-terminated path at @collected, passing it directly to filp_open() / init_mkdir() / init_mknod(). If a specially crafted cpio entry carries a non-zero-terminated filename and is followed by uninitialized memory, then a file may be created with trailing characters that represent the uninitialized memory. The ability to create an initramfs entry would imply already having full control of the system, so the buffer overrun shouldn't be considered a security vulnerability. Append the output of the following bash script to an existing initramfs and observe any created /initramfs_test_fname_overrunAA* path. E.g. ./reproducer.sh | gzip >> /myinitramfs It's easiest to observe non-zero uninitialized memory when the output is gzipped, as it'll overflow the heap allocated @out_buf in __gunzip(), rather than the initrd_start+initrd_size block. ---- reproducer.sh ---- nilchar="A" # change to "\0" to properly zero terminate / pad magic="070701" ino=1 mode=$(( 0100777 )) uid=0 gid=0 nlink=1 mtime=1 filesize=0 devmajor=0 devminor=1 rdevmajor=0 rdevminor=0 csum=0 fname="initramfs_test_fname_overrun" namelen=$(( ${#fname} + 1 )) # plus one to account for terminator printf "%s%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%s" \ $magic $ino $mode $uid $gid $nlink $mtime $filesize \ $devmajor $devminor $rdevmajor $rdevminor $namelen $csum $fname termpadlen=$(( 1 + ((4 - ((110 + $namelen) & 3)) % 4) )) printf "%.s${nilchar}" $(seq 1 $termpadlen) ---- reproducer.sh ---- Symlink filename fields handled in do_symlink() won't overrun past the data segment, due to the explicit zero-termination of the symlink target. Fix filename buffer overrun by aborting the initramfs FSM if any cpio entry doesn't carry a zero-terminator at the expected (name_len - 1) offset.

6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53146

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into several steps so that decode_cb_compound4res() does not have to perform arithmetic on the unsafe length value.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53152

In the Linux kernel, the following vulnerability has been resolved: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() Currently, the endpoint cleanup function dw_pcie_ep_cleanup() and EPF deinit notify function pci_epc_deinit_notify() are called during the execution of pex_ep_event_pex_rst_assert() i.e., when the host has asserted PERST#. But quickly after this step, refclk will also be disabled by the host. All of the tegra194 endpoint SoCs supported as of now depend on the refclk from the host for keeping the controller operational. Due to this limitation, any access to the hardware registers in the absence of refclk will result in a whole endpoint crash. Unfortunately, most of the controller cleanups require accessing the hardware registers (like eDMA cleanup performed in dw_pcie_ep_cleanup(), etc...). So these cleanup functions can cause the crash in the endpoint SoC once host asserts PERST#. One way to address this issue is by generating the refclk in the endpoint itself and not depending on the host. But that is not always possible as some of the endpoint designs do require the endpoint to consume refclk from the host. Thus, fix this crash by moving the controller cleanups to the start of the pex_ep_event_pex_rst_deassert() function. This function is called whenever the host has deasserted PERST# and it is guaranteed that the refclk would be active at this point. So at the start of this function (after enabling resources) the controller cleanup can be performed. Once finished, rest of the code execution for PERST# deassert can continue as usual.

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53156

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51 index 255 is out of range for type 'htc_endpoint [22]' CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <TASK> dump_stack_lvl+0x180/0x1b0 __ubsan_handle_out_of_bounds+0xd4/0x130 htc_issue_send.constprop.0+0x20c/0x230 ? _raw_spin_unlock_irqrestore+0x3c/0x70 ath9k_wmi_cmd+0x41d/0x610 ? mark_held_locks+0x9f/0xe0 ... Since this bug has been confirmed to be caused by insufficient verification of conn_rsp_epid, I think it would be appropriate to add a range check for conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-129 - Improper Validation of Array Index
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53160

In the Linux kernel, the following vulnerability has been resolved: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu KCSAN reports a data race when access the krcp->monitor_work.timer.expires variable in the schedule_delayed_monitor_work() function: <snip> BUG: KCSAN: data-race in __mod_timer / kvfree_call_rcu read to 0xffff888237d1cce8 of 8 bytes by task 10149 on cpu 1: schedule_delayed_monitor_work kernel/rcu/tree.c:3520 [inline] kvfree_call_rcu+0x3b8/0x510 kernel/rcu/tree.c:3839 trie_update_elem+0x47c/0x620 kernel/bpf/lpm_trie.c:441 bpf_map_update_value+0x324/0x350 kernel/bpf/syscall.c:203 generic_map_update_batch+0x401/0x520 kernel/bpf/syscall.c:1849 bpf_map_do_batch+0x28c/0x3f0 kernel/bpf/syscall.c:5143 __sys_bpf+0x2e5/0x7a0 __do_sys_bpf kernel/bpf/syscall.c:5741 [inline] __se_sys_bpf kernel/bpf/syscall.c:5739 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5739 x64_sys_call+0x2625/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:322 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f write to 0xffff888237d1cce8 of 8 bytes by task 56 on cpu 0: __mod_timer+0x578/0x7f0 kernel/time/timer.c:1173 add_timer_global+0x51/0x70 kernel/time/timer.c:1330 __queue_delayed_work+0x127/0x1a0 kernel/workqueue.c:2523 queue_delayed_work_on+0xdf/0x190 kernel/workqueue.c:2552 queue_delayed_work include/linux/workqueue.h:677 [inline] schedule_delayed_monitor_work kernel/rcu/tree.c:3525 [inline] kfree_rcu_monitor+0x5e8/0x660 kernel/rcu/tree.c:3643 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391 kthread+0x1d1/0x210 kernel/kthread.c:389 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Reported by Kernel Concurrency Sanitizer on: CPU: 0 UID: 0 PID: 56 Comm: kworker/u8:4 Not tainted 6.12.0-rc2-syzkaller-00050-g5b7c893ed5ed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_unbound kfree_rcu_monitor <snip> kfree_rcu_monitor() rearms the work if a "krcp" has to be still offloaded and this is done without holding krcp->lock, whereas the kvfree_call_rcu() holds it. Fix it by acquiring the "krcp->lock" for kfree_rcu_monitor() so both functions do not race anymore.

6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53161

In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx defined as 32-bits wide the left-shift operation truncates the upper 16 bits of information during the calculation of the SMC argument. The mem_ctrl_idx stack variable must be defined as 64-bits wide to prevent any potential integer overflow, i.e. loss of data from upper 16 bits.

3.8 (Low)
CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53164

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ordering of qlen adjustment Changes to sch->q.qlen around qdisc_tree_reduce_backlog() need to happen _before_ a call to said function because otherwise it may fail to notify parent qdiscs when the child is about to become empty.

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-459 - Incomplete Cleanup
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-53166

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix bfqq uaf in bfq_limit_depth() Set new allocated bfqq to bic or remove freed bfqq from bic are both protected by bfqd->lock, however bfq_limit_depth() is deferencing bfqq from bic without the lock, this can lead to UAF if the io_context is shared by multiple tasks. For example, test bfq with io_uring can trigger following UAF in v6.6: ================================================================== BUG: KASAN: slab-use-after-free in bfqq_group+0x15/0x50 Call Trace: <TASK> dump_stack_lvl+0x47/0x80 print_address_description.constprop.0+0x66/0x300 print_report+0x3e/0x70 kasan_report+0xb4/0xf0 bfqq_group+0x15/0x50 bfqq_request_over_limit+0x130/0x9a0 bfq_limit_depth+0x1b5/0x480 __blk_mq_alloc_requests+0x2b5/0xa00 blk_mq_get_new_requests+0x11d/0x1d0 blk_mq_submit_bio+0x286/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __block_write_full_folio+0x3d0/0x640 writepage_cb+0x3b/0xc0 write_cache_pages+0x254/0x6c0 write_cache_pages+0x254/0x6c0 do_writepages+0x192/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 808602: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x83/0x90 kmem_cache_alloc_node+0x1b1/0x6d0 bfq_get_queue+0x138/0xfa0 bfq_get_bfqq_handle_split+0xe3/0x2c0 bfq_init_rq+0x196/0xbb0 bfq_insert_request.isra.0+0xb5/0x480 bfq_insert_requests+0x156/0x180 blk_mq_insert_request+0x15d/0x440 blk_mq_submit_bio+0x8a4/0xb00 submit_bio_noacct_nocheck+0x331/0x400 __blkdev_direct_IO_async+0x2dd/0x330 blkdev_write_iter+0x39a/0x450 io_write+0x22a/0x840 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Freed by task 808589: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 __kasan_slab_free+0x126/0x1b0 kmem_cache_free+0x10c/0x750 bfq_put_queue+0x2dd/0x770 __bfq_insert_request.isra.0+0x155/0x7a0 bfq_insert_request.isra.0+0x122/0x480 bfq_insert_requests+0x156/0x180 blk_mq_dispatch_plug_list+0x528/0x7e0 blk_mq_flush_plug_list.part.0+0xe5/0x590 __blk_flush_plug+0x3b/0x90 blk_finish_plug+0x40/0x60 do_writepages+0x19d/0x310 filemap_fdatawrite_wbc+0x95/0xc0 __filemap_fdatawrite_range+0x99/0xd0 filemap_write_and_wait_range.part.0+0x4d/0xa0 blkdev_read_iter+0xef/0x1e0 io_read+0x1b6/0x8a0 io_issue_sqe+0x87/0x300 io_wq_submit_work+0xeb/0x390 io_worker_handle_work+0x24d/0x550 io_wq_worker+0x27f/0x6c0 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x1b/0x30 Fix the problem by protecting bic_to_bfqq() with bfqd->lock.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53173

In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open() Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, then the call to nfs_release_seqid() in nfs4_opendata_free() can result in a use-after-free of the pointer to the defunct rpc task of the other thread. The fix is to ensure that if the RPC call is aborted before the call to nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() in nfs4_open_release() before the rpc_task is freed.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53174

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp` will not be freed. Therefore, the reference count for `cp` can drop to zero, which will trigger a refcount use-after-free warning when `cache_get` is called. To resolve this issue, use `cache_get_rcu` to ensure that `cp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 822 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 Call Trace: <TASK> c_show+0x2fc/0x380 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53176

In the Linux kernel, the following vulnerability has been resolved: smb: During unmount, ensure all cached dir instances drop their dentry The unmount process (cifs_kill_sb() calling close_all_cached_dirs()) can race with various cached directory operations, which ultimately results in dentries not being dropped and these kernel BUGs: BUG: Dentry ffff88814f37e358{i=1000000000080,n=/} still in use (2) [unmount of cifs cifs] VFS: Busy inodes after unmount of cifs (cifs) ------------[ cut here ]------------ kernel BUG at fs/super.c:661! This happens when a cfid is in the process of being cleaned up when, and has been removed from the cfids->entries list, including: - Receiving a lease break from the server - Server reconnection triggers invalidate_all_cached_dirs(), which removes all the cfids from the list - The laundromat thread decides to expire an old cfid. To solve these problems, dropping the dentry is done in queued work done in a newly-added cfid_put_wq workqueue, and close_all_cached_dirs() flushes that workqueue after it drops all the dentries of which it's aware. This is a global workqueue (rather than scoped to a mount), but the queued work is minimal. The final cleanup work for cleaning up a cfid is performed via work queued in the serverclose_wq workqueue; this is done separate from dropping the dentries so that close_all_cached_dirs() doesn't block on any server operations. Both of these queued works expect to invoked with a cfid reference and a tcon reference to avoid those objects from being freed while the work is ongoing. While we're here, add proper locking to close_all_cached_dirs(), and locking around the freeing of cfid->dentry.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53190

A deadlock condition exists in the Linux kernel. During the probe of rtl8192cu, the driver ends-up performing an refuse read procedure and the read_efuse() function calls read_efuse_byte() based on the efuse size.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53194

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") and commit 59a54c5f3dbd ("thunderbolt: Reset topology created by the boot firmware"), USB4 v2 and v1 Host Routers are reset on probe of the thunderbolt driver. The reset clears the Presence Detect State and Data Link Layer Link Active bits at the USB4 Host Router's Root Port and thus causes hot removal of the dock. The crash occurs when pciehp is unbound from one of the dock's Downstream Ports: pciehp creates a pci_slot on bind and destroys it on unbind. The pci_slot contains a pointer to the pci_bus below the Downstream Port, but a reference on that pci_bus is never acquired. The pci_bus is destroyed before the pci_slot, so a use-after-free ensues when pci_slot_release() accesses slot->bus. In principle this should not happen because pci_stop_bus_device() unbinds pciehp (and therefore destroys the pci_slot) before the pci_bus is destroyed by pci_remove_bus_device(). However the stacktrace provided by Dennis shows that pciehp is unbound from pci_remove_bus_device() instead of pci_stop_bus_device(). To understand the significance of this, one needs to know that the PCI core uses a two step process to remove a portion of the hierarchy: It first unbinds all drivers in the sub-hierarchy in pci_stop_bus_device() and then actually removes the devices in pci_remove_bus_device(). There is no precaution to prevent driver binding in-between pci_stop_bus_device() and pci_remove_bus_device(). In Dennis' case, it seems removal of the hierarchy by pciehp races with driver binding by pci_bus_add_devices(). pciehp is bound to the Downstream Port after pci_stop_bus_device() has run, so it is unbound by pci_remove_bus_device() instead of pci_stop_bus_device(). Because the pci_bus has already been destroyed at that point, accesses to it result in a use-after-free. One might conclude that driver binding needs to be prevented after pci_stop_bus_device() has run. However it seems risky that pci_slot points to pci_bus without holding a reference. Solely relying on correct ordering of driver unbind versus pci_bus destruction is certainly not defensive programming. If pci_slot has a need to access data in pci_bus, it ought to acquire a reference. Amend pci_create_slot() accordingly. Dennis reports that the crash is not reproducible with this change. Abridged stacktrace: pcieport 0000:00:07.0: PME: Signaling with IRQ 156 pcieport 0000:00:07.0: pciehp: Slot #12 AttnBtn- PwrCtrl- MRL- AttnInd- PwrInd- HotPlug+ Surprise+ Interlock- NoCompl+ IbPresDis- LLActRep+ pci_bus 0000:20: dev 00, created physical slot 12 pcieport 0000:00:07.0: pciehp: Slot(12): Card not present ... pcieport 0000:21:02.0: pciehp: pcie_disable_notification: SLOTCTRL d8 write cmd 0 Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 13 UID: 0 PID: 134 Comm: irq/156-pciehp Not tainted 6.11.0-devel+ #1 RIP: 0010:dev_driver_string+0x12/0x40 pci_destroy_slot pciehp_remove pcie_port_remove_service device_release_driver_internal bus_remove_device device_del device_unregister remove_iter device_for_each_child pcie_portdrv_remove pci_device_remove device_release_driver_internal bus_remove_device device_del pci_remove_bus_device (recursive invocation) pci_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53203

In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() The "command" variable can be controlled by the user via debugfs. The worry is that if con_index is zero then "&uc->ucsi->connector[con_index - 1]" would be an array underflow.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-129 - Improper Validation of Array Index
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53208

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353 Read of size 8 at addr ffff888029b4dd18 by task kworker/u9:0/54 CPU: 1 UID: 0 PID: 54 Comm: kworker/u9:0 Not tainted 6.11.0-rc6-syzkaller-01155-gf723224742fc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 q kasan_report+0x143/0x180 mm/kasan/report.c:601 set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1353 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:328 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd10 kernel/workqueue.c:3389 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5247: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4193 kmalloc_noprof include/linux/slab.h:681 [inline] kzalloc_noprof include/linux/slab.h:807 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1394 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 new_sync_write fs/read_write.c:497 [inline] vfs_write+0xa72/0xc90 fs/read_write.c:590 ksys_write+0x1a0/0x2c0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5246: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2256 [inline] slab_free mm/slub.c:4477 [inline] kfree+0x149/0x360 mm/slub.c:4598 settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1443 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x112/0x420 net/bluetooth/mgmt.c:9455 hci_dev_close_sync+0x665/0x11a0 net/bluetooth/hci_sync.c:5191 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1222 sock_ioctl+0x629/0x8e0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83gv entry_SYSCALL_64_after_hwframe+0x77/0x7f

6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53213

A double free vulnerability was found in the Linux kernel. In lan78xx_probe(), the `buf` buffer is freed twice: once implicitly through `usb_free_urb(dev->urb_intr)` with the `URB_FREE_BUFFER` flag and again explicitly by `kfree(buf)`, resulting in loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53216

In the Linux kernel, the following vulnerability has been resolved: nfsd: release svc_expkey/svc_export with rcu_work The last reference for `cache_head` can be reduced to zero in `c_show` and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequently, `svc_export_put` and `expkey_put` will be invoked, leading to two issues: 1. The `svc_export_put` will directly free ex_uuid. However, `e_show`/`c_show` will access `ex_uuid` after `cache_put`, which can trigger a use-after-free issue, shown below. ================================================================== BUG: KASAN: slab-use-after-free in svc_export_show+0x362/0x430 [nfsd] Read of size 1 at addr ff11000010fdc120 by task cat/870 CPU: 1 UID: 0 PID: 870 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_address_description.constprop.0+0x2c/0x3a0 print_report+0xb9/0x280 kasan_report+0xae/0xe0 svc_export_show+0x362/0x430 [nfsd] c_show+0x161/0x390 [sunrpc] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 proc_reg_read+0xe1/0x140 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Allocated by task 830: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_node_track_caller_noprof+0x1bc/0x400 kmemdup_noprof+0x22/0x50 svc_export_parse+0x8a9/0xb80 [nfsd] cache_do_downcall+0x71/0xa0 [sunrpc] cache_write_procfs+0x8e/0xd0 [sunrpc] proc_reg_write+0xe1/0x140 vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 868: kasan_save_stack+0x20/0x40 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x37/0x50 kfree+0xf3/0x3e0 svc_export_put+0x87/0xb0 [nfsd] cache_purge+0x17f/0x1f0 [sunrpc] nfsd_destroy_serv+0x226/0x2d0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e 2. We cannot sleep while using `rcu_read_lock`/`rcu_read_unlock`. However, `svc_export_put`/`expkey_put` will call path_put, which subsequently triggers a sleeping operation due to the following `dput`. ============================= WARNING: suspicious RCU usage 5.10.0-dirty #141 Not tainted ----------------------------- ... Call Trace: dump_stack+0x9a/0xd0 ___might_sleep+0x231/0x240 dput+0x39/0x600 path_put+0x1b/0x30 svc_export_put+0x17/0x80 e_show+0x1c9/0x200 seq_read_iter+0x63f/0x7c0 seq_read+0x226/0x2d0 vfs_read+0x113/0x2c0 ksys_read+0xc9/0x170 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Fix these issues by using `rcu_work` to help release `svc_expkey`/`svc_export`. This approach allows for an asynchronous context to invoke `path_put` and also facilitates the freeing of `uuid/exp/key` after an RCU grace period.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53222

In the Linux kernel, the following vulnerability has been resolved: zram: fix NULL pointer in comp_algorithm_show() LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __pi_strcmp+0x24/0x140 lr : zcomp_available_show+0x60/0x100 [zram] sp : ffff800088b93b90 x29: ffff800088b93b90 x28: 0000000000000001 x27: 0000000000400cc0 x26: 0000000000000ffe x25: ffff80007b3e2388 x24: 0000000000000000 x23: ffff80007b3e2390 x22: ffff0004041a9000 x21: ffff80007b3e2900 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff80007b3e2900 x9 : ffff80007b3cb280 x8 : 0101010101010101 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000040 x4 : 0000000000000000 x3 : 00656c722d6f7a6c x2 : 0000000000000000 x1 : ffff80007b3e2900 x0 : 0000000000000000 Call trace: __pi_strcmp+0x24/0x140 comp_algorithm_show+0x40/0x70 [zram] dev_attr_show+0x28/0x80 sysfs_kf_seq_show+0x90/0x140 kernfs_seq_show+0x34/0x48 seq_read_iter+0x1d4/0x4e8 kernfs_fop_read_iter+0x40/0x58 new_sync_read+0x9c/0x168 vfs_read+0x1a8/0x1f8 ksys_read+0x74/0x108 __arm64_sys_read+0x24/0x38 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0x138 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x188/0x190 The zram->comp_algs[ZRAM_PRIMARY_COMP] can be NULL in zram_add() if comp_algorithm_set() has not been called. User can access the zram device by sysfs after device_add_disk(), so there is a time window to trigger the NULL pointer dereference. Move it ahead device_add_disk() to make sure when user can access the zram device, it is ready. comp_algorithm_set() is protected by zram->init_lock in other places and no such problem.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53224

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Move events notifier registration to be after device registration Move pkey change work initialization and cleanup from device resources stage to notifier stage, since this is the stage which handles this work events. Fix a race between the device deregistration and pkey change work by moving MLX5_IB_STAGE_DEVICE_NOTIFIER to be after MLX5_IB_STAGE_IB_REG in order to ensure that the notifier is deregistered before the device during cleanup. Which ensures there are no works that are being executed after the device has already unregistered which can cause the panic below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 630071 Comm: kworker/1:2 Kdump: loaded Tainted: G W OE --------- --- 5.14.0-162.6.1.el9_1.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090008 02/27/2023 Workqueue: events pkey_change_handler [mlx5_ib] RIP: 0010:setup_qp+0x38/0x1f0 [mlx5_ib] Code: ee 41 54 45 31 e4 55 89 f5 53 48 89 fb 48 83 ec 20 8b 77 08 65 48 8b 04 25 28 00 00 00 48 89 44 24 18 48 8b 07 48 8d 4c 24 16 <4c> 8b 38 49 8b 87 80 0b 00 00 4c 89 ff 48 8b 80 08 05 00 00 8b 40 RSP: 0018:ffffbcc54068be20 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff954054494128 RCX: ffffbcc54068be36 RDX: ffff954004934000 RSI: 0000000000000001 RDI: ffff954054494128 RBP: 0000000000000023 R08: ffff954001be2c20 R09: 0000000000000001 R10: ffff954001be2c20 R11: ffff9540260133c0 R12: 0000000000000000 R13: 0000000000000023 R14: 0000000000000000 R15: ffff9540ffcb0905 FS: 0000000000000000(0000) GS:ffff9540ffc80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010625c001 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mlx5_ib_gsi_pkey_change+0x20/0x40 [mlx5_ib] process_one_work+0x1e8/0x3c0 worker_thread+0x50/0x3b0 ? rescuer_thread+0x380/0x380 kthread+0x149/0x170 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) mlx5_fwctl(OE) fwctl(OE) ib_uverbs(OE) mlx5_core(OE) mlxdevm(OE) ib_core(OE) mlx_compat(OE) psample mlxfw(OE) tls knem(OE) netconsole nfsv3 nfs_acl nfs lockd grace fscache netfs qrtr rfkill sunrpc intel_rapl_msr intel_rapl_common rapl hv_balloon hv_utils i2c_piix4 pcspkr joydev fuse ext4 mbcache jbd2 sr_mod sd_mod cdrom t10_pi sg ata_generic pci_hyperv pci_hyperv_intf hyperv_drm drm_shmem_helper drm_kms_helper hv_storvsc syscopyarea hv_netvsc sysfillrect sysimgblt hid_hyperv fb_sys_fops scsi_transport_fc hyperv_keyboard drm ata_piix crct10dif_pclmul crc32_pclmul crc32c_intel libata ghash_clmulni_intel hv_vmbus serio_raw [last unloaded: ib_core] CR2: 0000000000000000 ---[ end trace f6f8be4eae12f7bc ]---

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53232

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Implement blocking domain This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53237

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix use-after-free in device_for_each_child() Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at addr ffff88801f605308 by task kbnepd bnep0/4980 CPU: 0 UID: 0 PID: 4980 Comm: kbnepd bnep0 Not tainted 6.12.0-rc4-00161-gae90f6a6170d #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x190 ? device_for_each_child+0x18f/0x1a0 print_report+0x13a/0x4cb ? __virt_addr_valid+0x5e/0x590 ? __phys_addr+0xc6/0x150 ? device_for_each_child+0x18f/0x1a0 kasan_report+0xda/0x110 ? device_for_each_child+0x18f/0x1a0 ? __pfx_dev_memalloc_noio+0x10/0x10 device_for_each_child+0x18f/0x1a0 ? __pfx_device_for_each_child+0x10/0x10 pm_runtime_set_memalloc_noio+0xf2/0x180 netdev_unregister_kobject+0x1ed/0x270 unregister_netdevice_many_notify+0x123c/0x1d80 ? __mutex_trylock_common+0xde/0x250 ? __pfx_unregister_netdevice_many_notify+0x10/0x10 ? trace_contention_end+0xe6/0x140 ? __mutex_lock+0x4e7/0x8f0 ? __pfx_lock_acquire.part.0+0x10/0x10 ? rcu_is_watching+0x12/0xc0 ? unregister_netdev+0x12/0x30 unregister_netdevice_queue+0x30d/0x3f0 ? __pfx_unregister_netdevice_queue+0x10/0x10 ? __pfx_down_write+0x10/0x10 unregister_netdev+0x1c/0x30 bnep_session+0x1fb3/0x2ab0 ? __pfx_bnep_session+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? __pfx_woken_wake_function+0x10/0x10 ? __kthread_parkme+0x132/0x200 ? __pfx_bnep_session+0x10/0x10 ? kthread+0x13a/0x370 ? __pfx_bnep_session+0x10/0x10 kthread+0x2b7/0x370 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x48/0x80 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 4974: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 __kmalloc_noprof+0x1d1/0x440 hci_alloc_dev_priv+0x1d/0x2820 __vhci_create_device+0xef/0x7d0 vhci_write+0x2c7/0x480 vfs_write+0x6a0/0xfc0 ksys_write+0x12f/0x260 do_syscall_64+0xc7/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 4979: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x4f/0x70 kfree+0x141/0x490 hci_release_dev+0x4d9/0x600 bt_host_release+0x6a/0xb0 device_release+0xa4/0x240 kobject_put+0x1ec/0x5a0 put_device+0x1f/0x30 vhci_release+0x81/0xf0 __fput+0x3f6/0xb30 task_work_run+0x151/0x250 do_exit+0xa79/0x2c30 do_group_exit+0xd5/0x2a0 get_signal+0x1fcd/0x2210 arch_do_signal_or_restart+0x93/0x780 syscall_exit_to_user_mode+0x140/0x290 do_syscall_64+0xd4/0x250 entry_SYSCALL_64_after_hwframe+0x77/0x7f In 'hci_conn_del_sysfs()', 'device_unregister()' may be called when an underlying (kobject) reference counter is greater than 1. This means that reparenting (happened when the device is actually freed) is delayed and, during that delay, parent controller device (hciX) may be deleted. Since the latter may create a dangling pointer to freed parent, avoid that scenario by reparenting to NULL explicitly.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-53681

In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string. Create a new string with kstrndup instead of using the old buffer.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-122 - Heap-based Buffer Overflow
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-54460

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Fix circular lock in iso_listen_bis This fixes the circular locking dependency warning below, by releasing the socket lock before enterning iso_listen_bis, to avoid any potential deadlock with hdev lock. [ 75.307983] ====================================================== [ 75.307984] WARNING: possible circular locking dependency detected [ 75.307985] 6.12.0-rc6+ #22 Not tainted [ 75.307987] ------------------------------------------------------ [ 75.307987] kworker/u81:2/2623 is trying to acquire lock: [ 75.307988] ffff8fde1769da58 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO) at: iso_connect_cfm+0x253/0x840 [bluetooth] [ 75.308021] but task is already holding lock: [ 75.308022] ffff8fdd61a10078 (&hdev->lock) at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth] [ 75.308053] which lock already depends on the new lock. [ 75.308054] the existing dependency chain (in reverse order) is: [ 75.308055] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 75.308057] __mutex_lock+0xad/0xc50 [ 75.308061] mutex_lock_nested+0x1b/0x30 [ 75.308063] iso_sock_listen+0x143/0x5c0 [bluetooth] [ 75.308085] __sys_listen_socket+0x49/0x60 [ 75.308088] __x64_sys_listen+0x4c/0x90 [ 75.308090] x64_sys_call+0x2517/0x25f0 [ 75.308092] do_syscall_64+0x87/0x150 [ 75.308095] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 75.308098] -> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_ISO){+.+.}-{0:0}: [ 75.308100] __lock_acquire+0x155e/0x25f0 [ 75.308103] lock_acquire+0xc9/0x300 [ 75.308105] lock_sock_nested+0x32/0x90 [ 75.308107] iso_connect_cfm+0x253/0x840 [bluetooth] [ 75.308128] hci_connect_cfm+0x6c/0x190 [bluetooth] [ 75.308155] hci_le_per_adv_report_evt+0x27b/0x2f0 [bluetooth] [ 75.308180] hci_le_meta_evt+0xe7/0x200 [bluetooth] [ 75.308206] hci_event_packet+0x21f/0x5c0 [bluetooth] [ 75.308230] hci_rx_work+0x3ae/0xb10 [bluetooth] [ 75.308254] process_one_work+0x212/0x740 [ 75.308256] worker_thread+0x1bd/0x3a0 [ 75.308258] kthread+0xe4/0x120 [ 75.308259] ret_from_fork+0x44/0x70 [ 75.308261] ret_from_fork_asm+0x1a/0x30 [ 75.308263] other info that might help us debug this: [ 75.308264] Possible unsafe locking scenario: [ 75.308264] CPU0 CPU1 [ 75.308265] ---- ---- [ 75.308265] lock(&hdev->lock); [ 75.308267] lock(sk_lock- AF_BLUETOOTH-BTPROTO_ISO); [ 75.308268] lock(&hdev->lock); [ 75.308269] lock(sk_lock-AF_BLUETOOTH-BTPROTO_ISO); [ 75.308270] *** DEADLOCK *** [ 75.308271] 4 locks held by kworker/u81:2/2623: [ 75.308272] #0: ffff8fdd66e52148 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x443/0x740 [ 75.308276] #1: ffffafb488b7fe48 ((work_completion)(&hdev->rx_work)), at: process_one_work+0x1ce/0x740 [ 75.308280] #2: ffff8fdd61a10078 (&hdev->lock){+.+.}-{3:3} at: hci_le_per_adv_report_evt+0x47/0x2f0 [bluetooth] [ 75.308304] #3: ffffffffb6ba4900 (rcu_read_lock){....}-{1:2}, at: hci_connect_cfm+0x29/0x190 [bluetooth]

5.7 (Medium)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-54680

[REJECTED CVE] A vulnerability was suspected in the Linux kernel's SMB client module related to TCP timers and potential deadlocks after module removal (rmmod cifs). The issue stemmed from incorrect manual manipulation of sk->sk_net_refcnt, which led to TCP timers not being properly cleared, causing lockdep warnings and deadlocks. However, this was an internal kernel misconfiguration affecting cleanup behavior rather than a security flaw exploitable by an attacker. Since no privilege escalation or data exposure was possible, this does not qualify as a security vulnerability.

CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-56535

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() kmalloc may fail, return value might be NULL and will cause NULL pointer dereference. Add check NULL return of kmalloc in btc_fw_set_monreg().

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56544

In the Linux kernel, the following vulnerability has been resolved: udmabuf: change folios array from kmalloc to kvmalloc When PAGE_SIZE 4096, MAX_PAGE_ORDER 10, 64bit machine, page_alloc only support 4MB. If above this, trigger this warn and return NULL. udmabuf can change size limit, if change it to 3072(3GB), and then alloc 3GB udmabuf, will fail create. [ 4080.876581] ------------[ cut here ]------------ [ 4080.876843] WARNING: CPU: 3 PID: 2015 at mm/page_alloc.c:4556 __alloc_pages+0x2c8/0x350 [ 4080.878839] RIP: 0010:__alloc_pages+0x2c8/0x350 [ 4080.879470] Call Trace: [ 4080.879473] <TASK> [ 4080.879473] ? __alloc_pages+0x2c8/0x350 [ 4080.879475] ? __warn.cold+0x8e/0xe8 [ 4080.880647] ? __alloc_pages+0x2c8/0x350 [ 4080.880909] ? report_bug+0xff/0x140 [ 4080.881175] ? handle_bug+0x3c/0x80 [ 4080.881556] ? exc_invalid_op+0x17/0x70 [ 4080.881559] ? asm_exc_invalid_op+0x1a/0x20 [ 4080.882077] ? udmabuf_create+0x131/0x400 Because MAX_PAGE_ORDER, kmalloc can max alloc 4096 * (1 << 10), 4MB memory, each array entry is pointer(8byte), so can save 524288 pages(2GB). Further more, costly order(order 3) may not be guaranteed that it can be applied for, due to fragmentation. This patch change udmabuf array use kvmalloc_array, this can fallback alloc into vmalloc, which can guarantee allocation for any size and does not affect the performance of kmalloc allocations.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56551

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147 [ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1 [ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000016] Call Trace: [ +0.000008] <TASK> [ +0.000009] dump_stack_lvl+0x76/0xa0 [ +0.000017] print_report+0xce/0x5f0 [ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] ? srso_return_thunk+0x5/0x5f [ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200 [ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000019] kasan_report+0xbe/0x110 [ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000023] __asan_report_load8_noabort+0x14/0x30 [ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched] [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? enable_work+0x124/0x220 [ +0.000015] ? __pfx_enable_work+0x10/0x10 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? free_large_kmalloc+0x85/0xf0 [ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched] [ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu] [ +0.000735] ? __kasan_check_read+0x11/0x20 [ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu] [ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu] [ +0.000679] ? mutex_unlock+0x80/0xe0 [ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu] [ +0.000662] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_check_write+0x14/0x30 [ +0.000013] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? mutex_unlock+0x80/0xe0 [ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] [ +0.000663] drm_minor_release+0xc9/0x140 [drm] [ +0.000081] drm_release+0x1fd/0x390 [drm] [ +0.000082] __fput+0x36c/0xad0 [ +0.000018] __fput_sync+0x3c/0x50 [ +0.000014] __x64_sys_close+0x7d/0xe0 [ +0.000014] x64_sys_call+0x1bc6/0x2680 [ +0.000014] do_syscall_64+0x70/0x130 [ +0.000014] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? irqentry_exit+0x43/0x50 [ +0.000012] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? exc_page_fault+0x7c/0x110 [ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000014] RIP: 0033:0x7ffff7b14f67 [ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff [ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 [ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003 [ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000 [ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 [ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 [ +0.000020] </TASK> [ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s: [ +0.000014] kasan_save_stack+0x28/0x60 [ +0.000008] kasan_save_track+0x18/0x70 [ +0.000007] kasan_save_alloc_info+0x38/0x60 [ +0.000007] __kasan_kmalloc+0xc1/0xd0 [ +0.000007] kmalloc_trace_noprof+0x180/0x380 [ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched] [ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu] [ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu] [ +0.000662] amdgpu_pci_p ---truncated---

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56558

In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svc_export_show The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for `exp` can drop to zero, which will trigger a refcount use-after-free warning when `exp_get` is called. To resolve this issue, use `cache_get_rcu` to ensure that `exp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 ... Call Trace: <TASK> e_show+0x20b/0x230 [nfsd] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56562

A vulnerability was found in the i3c_master_put_i3c_addrs() function in the Linux kernel's i3c driver. A memory management issue can occur due to a copy-paste error between "dyn_addr" and "init_dyn_addr", which leads to incorrect handling of memory, potentially causing resource mismanagement and instability within the system.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56566

A use-after-free list corruption vulnerability was found in the Linux kernel. If an allocated object fails in alloc_consistency_checks, all objects of the slab will be marked as used and the slab will be removed from the partial list. When an object belonging to the slab gets freed later, the remove_full() function is called. Since the slab is neither on the partial list nor on the full list, it eventually leads to a list corruption.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56570

In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is important because such inodes can cause errors in overlayfs when passed to the lowerstack.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56590

A use-after-free vulnerability was found in the Linux kernel. The Bluetooth firmware isn't checked if skb contains an ACL header, otherwise the code may attempt to access some uninitialized or invalid memory past the valid skb->data.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56591

A flaw was found in the Bluetooth subsystem of the Linux kernel, in the handling of delayed work within the hci_conn (Host Controller Interface connection) structure. The kernel used cancel_delayed_work_sync() when shutting down a connection, which cancels ongoing work but allows rescheduling. This could result in use-after-free conditions if the work is resubmitted after the associated object has been freed. Replacing it with disable_delayed_work_sync() prevents further scheduling, ensuring proper cleanup. A local attacker could potentially exploit this to trigger a use-after-free, leading to a denial of service or possible code execution.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56600

In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later. Clear the sock sk pointer on error.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56601

In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later. Clear the sk pointer in the sock object on error.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56602

A user-after-free vulnerability was found in the linux kernel. sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, leading to a crash and loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56604

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free. Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().

6.8 (Medium)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56605

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56611

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having find_vma() return NULL, to then de-reference NULL. So properly handle find_vma() returning NULL. This fixes the report: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 6021 Comm: syz-executor284 Not tainted 6.12.0-rc7-syzkaller-00187-gf868cd251776 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 RIP: 0010:migrate_to_node mm/mempolicy.c:1090 [inline] RIP: 0010:do_migrate_pages+0x403/0x6f0 mm/mempolicy.c:1194 Code: ... RSP: 0018:ffffc9000375fd08 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffc9000375fd78 RCX: 0000000000000000 RDX: ffff88807e171300 RSI: dffffc0000000000 RDI: ffff88803390c044 RBP: ffff88807e171428 R08: 0000000000000014 R09: fffffbfff2039ef1 R10: ffffffff901cf78f R11: 0000000000000000 R12: 0000000000000003 R13: ffffc9000375fe90 R14: ffffc9000375fe98 R15: ffffc9000375fdf8 FS: 00005555919e1380(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555919e1ca8 CR3: 000000007f12a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> kernel_migrate_pages+0x5b2/0x750 mm/mempolicy.c:1709 __do_sys_migrate_pages mm/mempolicy.c:1727 [inline] __se_sys_migrate_pages mm/mempolicy.c:1723 [inline] __x64_sys_migrate_pages+0x96/0x100 mm/mempolicy.c:1723 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [akpm@linux-foundation.org: add unlikely()]

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56614

In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL; This allows k to hold a negative value (between -2147483648 and -2), which is then used as an array index in m->xsk_map[k], which results in an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock); The xchg operation can then be used to cause an out-of-bounds write. Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead to further memory corruption. " It indeed results in following splat: [76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108 [76612.904330] #PF: supervisor write access in kernel mode [76612.909639] #PF: error_code(0x0002) - not-present page [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470 [76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000 [76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000 [76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007 [76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0 [76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [76613.041086] PKRU: 55555554 [76613.043842] Call Trace: [76613.046331] <TASK> [76613.048468] ? __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] ? xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555] __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP: 0033:0x7f80b6d1e88d [76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8 [76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00 ---truncated---

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56616

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC) at the end of the message. This fixes a case where an MST branch device returns a header with a correct header CRC (indicating a correctly received body length), with the body length being incorrectly set to 0. This will later lead to a memory corruption in drm_dp_sideband_append_payload() and the following errors in dmesg: UBSAN: array-index-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:786:25 index -1 is out of range for type 'u8 [48]' Call Trace: drm_dp_sideband_append_payload+0x33d/0x350 [drm_display_helper] drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper] drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper] memcpy: detected field-spanning write (size 18446744073709551615) of single field "&msg->msg[msg->curlen]" at drivers/gpu/drm/display/drm_dp_mst_topology.c:791 (size 256) Call Trace: drm_dp_sideband_append_payload+0x324/0x350 [drm_display_helper] drm_dp_get_one_sb_msg+0x3ce/0x5f0 [drm_display_helper] drm_dp_mst_hpd_irq_handle_event+0xc8/0x1580 [drm_display_helper]

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56623

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use after free on unload System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpc_thread to terminate (UNLOADING flag and kthread_stop). On setting the UNLOADING flag when dpc_thread happens to run at the time and sees the flag, this causes dpc_thread to exit and clean up itself. When kthread_stop is called for final cleanup, this causes use after free. Remove UNLOADING signal to terminate dpc_thread. Use the kthread_stop as the main signal to exit dpc_thread. [596663.812935] kernel BUG at mm/slub.c:294! [596663.812950] invalid opcode: 0000 [#1] SMP PTI [596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G IOE --------- - - 4.18.0-240.el8.x86_64 #1 [596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 [596663.812974] RIP: 0010:__slab_free+0x17d/0x360 ... [596663.813008] Call Trace: [596663.813022] ? __dentry_kill+0x121/0x170 [596663.813030] ? _cond_resched+0x15/0x30 [596663.813034] ? _cond_resched+0x15/0x30 [596663.813039] ? wait_for_completion+0x35/0x190 [596663.813048] ? try_to_wake_up+0x63/0x540 [596663.813055] free_task+0x5a/0x60 [596663.813061] kthread_stop+0xf3/0x100 [596663.813103] qla2x00_remove_one+0x284/0x440 [qla2xxx]

6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56631

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5838 __mutex_unlock_slowpath+0xe2/0x750 kernel/locking/mutex.c:912 sg_release+0x1f4/0x2e0 drivers/scsi/sg.c:407 In sg_release(), the function kref_put(&sfp->f_ref, sg_remove_sfp) is called before releasing the open_rel_lock mutex. The kref_put() call may decrement the reference count of sfp to zero, triggering its cleanup through sg_remove_sfp(). This cleanup includes scheduling deferred work via sg_remove_sfp_usercontext(), which ultimately frees sfp. After kref_put(), sg_release() continues to unlock open_rel_lock and may reference sfp or sdp. If sfp has already been freed, this results in a slab-use-after-free error. Move the kref_put(&sfp->f_ref, sg_remove_sfp) call after unlocking the open_rel_lock mutex. This ensures: - No references to sfp or sdp occur after the reference count is decremented. - Cleanup functions such as sg_remove_sfp() and sg_remove_sfp_usercontext() can safely execute without impacting the mutex handling in sg_release(). The fix has been tested and validated by syzbot. This patch closes the bug reported at the following syzkaller link and ensures proper sequencing of resource cleanup and mutex operations, eliminating the risk of use-after-free errors in sg_release().

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56642

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. [0][1] When bearer_disable() calls tipc_udp_disable(), cleanup of the UDP kernel socket is deferred by work calling cleanup_bearer(). tipc_exit_net() waits for such works to finish by checking tipc_net(net)->wq_count. However, the work decrements the count too early before releasing the kernel socket, unblocking cleanup_net() and resulting in use-after-free. Let's move the decrement after releasing the socket in cleanup_bearer(). [0]: ref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at sk_alloc+0x438/0x608 inet_create+0x4c8/0xcb0 __sock_create+0x350/0x6b8 sock_create_kern+0x58/0x78 udp_sock_create4+0x68/0x398 udp_sock_create+0x88/0xc8 tipc_udp_enable+0x5e8/0x848 __tipc_nl_bearer_enable+0x84c/0xed8 tipc_nl_bearer_enable+0x38/0x60 genl_family_rcv_msg_doit+0x170/0x248 genl_rcv_msg+0x400/0x5b0 netlink_rcv_skb+0x1dc/0x398 genl_rcv+0x44/0x68 netlink_unicast+0x678/0x8b0 netlink_sendmsg+0x5e4/0x898 ____sys_sendmsg+0x500/0x830 [1]: BUG: KMSAN: use-after-free in udp_hashslot include/net/udp.h:85 [inline] BUG: KMSAN: use-after-free in udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979 udp_hashslot include/net/udp.h:85 [inline] udp_lib_unhash+0x3b8/0x930 net/ipv4/udp.c:1979 sk_common_release+0xaf/0x3f0 net/core/sock.c:3820 inet_release+0x1e0/0x260 net/ipv4/af_inet.c:437 inet6_release+0x6f/0xd0 net/ipv6/af_inet6.c:489 __sock_release net/socket.c:658 [inline] sock_release+0xa0/0x210 net/socket.c:686 cleanup_bearer+0x42d/0x4c0 net/tipc/udp_media.c:819 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244 Uninit was created at: slab_free_hook mm/slub.c:2269 [inline] slab_free mm/slub.c:4580 [inline] kmem_cache_free+0x207/0xc40 mm/slub.c:4682 net_free net/core/net_namespace.c:454 [inline] cleanup_net+0x16f2/0x19d0 net/core/net_namespace.c:647 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xcaf/0x1c90 kernel/workqueue.c:3310 worker_thread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 ret_from_fork+0x60/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244 CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: events cleanup_bearer

7.1 (High)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56644

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must be fulfilled for the leak to occur: * an ICMPv6 packet indicating a change of the MTU for the path is received, resulting in an exception dst being created * a TCP connection that uses the exception dst for routing packets must start timing out so that TCP begins retransmissions * after the exception dst expires, the FIB6 garbage collector must not run before TCP executes ip6_negative_advice() for the expired exception dst When TCP executes ip6_negative_advice() for an exception dst that has expired and if no other socket holds a reference to the exception dst, the refcount of the exception dst is 2, which corresponds to the increment made by dst_init() and the increment made by the TCP socket for which the connection is timing out. The refcount made by the socket is never released. The refcount of the dst is decremented in sk_dst_reset() but that decrement is counteracted by a dst_hold() intentionally placed just before the sk_dst_reset() in ip6_negative_advice(). After ip6_negative_advice() has finished, there is no other object tied to the dst. The socket lost its reference stored in sk_dst_cache and the dst is no longer in the exception table. The exception dst becomes a leaked object. As a result of this dst leak, an unbalanced refcount is reported for the loopback device of a net namespace being destroyed under kernels that do not contain e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"): unregister_netdevice: waiting for lo to become free. Usage count = 2 Fix the dst leak by removing the dst_hold() in ip6_negative_advice(). The patch that introduced the dst_hold() in ip6_negative_advice() was 92f1655aa2b22 ("net: fix __dst_negative_advice() race"). But 92f1655aa2b22 merely refactored the code with regards to the dst refcount so the issue was present even before 92f1655aa2b22. The bug was introduced in 54c1a859efd9f ("ipv6: Don't drop cache route entry unless timer actually expired.") where the expired cached route is deleted and the sk_dst_cache member of the socket is set to NULL by calling dst_negative_advice() but the refcount belonging to the socket is left unbalanced. The IPv4 version - ipv4_negative_advice() - is not affected by this bug. When the TCP connection times out ipv4_negative_advice() merely resets the sk_dst_cache of the socket while decrementing the refcount of the exception dst.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56647

A denial of service vulnerability was found in the Linux kernel. icmp_route_lookup() creates input routes for locally generated packets during xfrm relookup ICMP traffic. Then it will set the input route (dst->out = ip_rt_bug) to skb for DESTUNREACH, leading to loss of availability of the system.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56653

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ================================================================== BUG: KASAN: slab-use-after-free in btmtk_process_coredump+0x2a7/0x2d0 [btmtk] Read of size 4 at addr ffff888033cfabb0 by task kworker/0:3/82 CPU: 0 PID: 82 Comm: kworker/0:3 Tainted: G U 6.6.40-lockdep-03464-g1d8b4eb3060e #1 b0b3c1cc0c842735643fb411799d97921d1f688c Hardware name: Google Yaviks_Ufs/Yaviks_Ufs, BIOS Google_Yaviks_Ufs.15217.552.0 05/07/2024 Workqueue: events btusb_rx_work [btusb] Call Trace: <TASK> dump_stack_lvl+0xfd/0x150 print_report+0x131/0x780 kasan_report+0x177/0x1c0 btmtk_process_coredump+0x2a7/0x2d0 [btmtk 03edd567dd71a65958807c95a65db31d433e1d01] btusb_recv_acl_mtk+0x11c/0x1a0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] btusb_rx_work+0x9e/0xe0 [btusb 675430d1e87c4f24d0c1f80efe600757a0f32bec] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 </TASK> Allocated by task 82: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 __kasan_slab_alloc+0x4e/0x60 kmem_cache_alloc+0x19f/0x360 skb_clone+0x132/0xf70 btusb_recv_acl_mtk+0x104/0x1a0 [btusb] btusb_rx_work+0x9e/0xe0 [btusb] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 Freed by task 1733: stack_trace_save+0xdc/0x190 kasan_set_track+0x4e/0x80 kasan_save_free_info+0x28/0xb0 ____kasan_slab_free+0xfd/0x170 kmem_cache_free+0x183/0x3f0 hci_devcd_rx+0x91a/0x2060 [bluetooth] worker_thread+0xe44/0x2cc0 kthread+0x2ff/0x3a0 ret_from_fork+0x51/0x80 ret_from_fork_asm+0x1b/0x30 The buggy address belongs to the object at ffff888033cfab40 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 112 bytes inside of freed 232-byte region [ffff888033cfab40, ffff888033cfac28) The buggy address belongs to the physical page: page:00000000a174ba93 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33cfa head:00000000a174ba93 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 anon flags: 0x4000000000000840(slab|head|zone=1) page_type: 0xffffffff() raw: 4000000000000840 ffff888100848a00 0000000000000000 0000000000000001 raw: 0000000000000000 0000000080190019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888033cfaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888033cfab00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff888033cfab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888033cfac00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc ffff888033cfac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Check if we need to call hci_devcd_complete before calling hci_devcd_append. That requires that we check data->cd_info.cnt >= MTK_COREDUMP_NUM instead of data->cd_info.cnt > MTK_COREDUMP_NUM, as we increment data->cd_info.cnt only once the call to hci_devcd_append succeeds.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56654

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is not safe since for the most part entries fetched this way shall be treated as rcu_dereference: Note that the value returned by rcu_dereference() is valid only within the enclosing RCU read-side critical section [1]_. For example, the following is **not** legal:: rcu_read_lock(); p = rcu_dereference(head.next); rcu_read_unlock(); x = p->address; /* BUG!!! */ rcu_read_lock(); y = p->data; /* BUG!!! */ rcu_read_unlock();

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56663

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE80211_MLD_MAX_NUM_LINKS - 1 otherwise causing an off-by-one. One crash stack for demonstration: ================================================================== BUG: KASAN: wild-memory-access in ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 Read of size 6 at addr 001102080000000c by task fuzzer.386/9508 CPU: 1 PID: 9508 Comm: syz.1.386 Not tainted 6.1.70 #2 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x177/0x231 lib/dump_stack.c:106 print_report+0xe0/0x750 mm/kasan/report.c:398 kasan_report+0x139/0x170 mm/kasan/report.c:495 kasan_check_range+0x287/0x290 mm/kasan/generic.c:189 memcpy+0x25/0x60 mm/kasan/shadow.c:65 ieee80211_tx_control_port+0x3b6/0xca0 net/mac80211/tx.c:5939 rdev_tx_control_port net/wireless/rdev-ops.h:761 [inline] nl80211_tx_control_port+0x7b3/0xc40 net/wireless/nl80211.c:15453 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x539/0x740 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2508 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x74b/0x8c0 net/netlink/af_netlink.c:1352 netlink_sendmsg+0x882/0xb90 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] ____sys_sendmsg+0x5cc/0x8f0 net/socket.c:2499 ___sys_sendmsg+0x21c/0x290 net/socket.c:2553 __sys_sendmsg net/socket.c:2582 [inline] __do_sys_sendmsg net/socket.c:2591 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2589 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x45/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd Update the policy to ensure correct validation.

7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-193 - Off-by-one Error
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56664

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_delete() unconditionally unrefs the (wrong) element: // set map[0] = s0 map_update_elem(map, 0, s0) // drop fd of s0 close(s0) sock_map_close() lock_sock(sk) (s0!) sock_map_remove_links(sk) link = sk_psock_link_pop() sock_map_unlink(sk, link) sock_map_delete_from_link // replace map[0] with s1 map_update_elem(map, 0, s1) sock_map_update_elem (s1!) lock_sock(sk) sock_map_update_common psock = sk_psock(sk) spin_lock(&stab->lock) osk = stab->sks[idx] sock_map_add_link(..., &stab->sks[idx]) sock_map_unref(osk, &stab->sks[idx]) psock = sk_psock(osk) sk_psock_put(sk, psock) if (refcount_dec_and_test(&psock)) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) unlock_sock(sk) __sock_map_delete spin_lock(&stab->lock) sk = *psk // s1 replaced s0; sk == s1 if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch sk = xchg(psk, NULL) if (sk) sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle psock = sk_psock(sk) sk_psock_put(sk, psock) if (refcount_dec_and_test()) sk_psock_drop(sk, psock) spin_unlock(&stab->lock) release_sock(sk) Then close(map) enqueues bpf_map_free_deferred, which finally calls sock_map_free(). This results in some refcount_t warnings along with a KASAN splat [1]. Fix __sock_map_delete(), do not allow sock_map_unref() on elements that may have been replaced. [1]: BUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330 Write of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063 CPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Workqueue: events_unbound bpf_map_free_deferred Call Trace: <TASK> dump_stack_lvl+0x68/0x90 print_report+0x174/0x4f6 kasan_report+0xb9/0x190 kasan_check_range+0x10f/0x1e0 sock_map_free+0x10e/0x330 bpf_map_free_deferred+0x173/0x320 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 1202: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 __kasan_slab_alloc+0x85/0x90 kmem_cache_alloc_noprof+0x131/0x450 sk_prot_alloc+0x5b/0x220 sk_alloc+0x2c/0x870 unix_create1+0x88/0x8a0 unix_create+0xc5/0x180 __sock_create+0x241/0x650 __sys_socketpair+0x1ce/0x420 __x64_sys_socketpair+0x92/0x100 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 46: kasan_save_stack+0x1e/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x37/0x60 __kasan_slab_free+0x4b/0x70 kmem_cache_free+0x1a1/0x590 __sk_destruct+0x388/0x5a0 sk_psock_destroy+0x73e/0xa50 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x29e/0x360 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 The bu ---truncated---

6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56667

In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL pointer dereference in capture_engine When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info(). (cherry picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d)

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56688

In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request() to dereference the transport->sock that has been set to NULL.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56693

In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:__asan_load8+0x4c/0xa0 ... Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e loop_init() is calling loop_add() after __register_blkdev() succeeds and is ignoring disk_add() failure from loop_add(), for loop_add() failure is not fatal and successfully created disks are already visible to bdev_open(). brd_init() is currently calling brd_alloc() before __register_blkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case: case 1: T1: modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF! case 2: T1: T2: modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->release Fix this problem by following what loop_init() does. Besides, reintroduce brd_devices_mutex to help serialize modifications to brd_list.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56729

In the Linux kernel, the following vulnerability has been resolved: smb: Initialize cfid->tcon before performing network ops Avoid leaking a tcon ref when a lease break races with opening the cached directory. Processing the leak break might take a reference to the tcon in cached_dir_lease_break() and then fail to release the ref in cached_dir_offload_close, since cfid->tcon is still NULL.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56757

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregistering hci device when usb disconnect. Removing BT usb dongle without properly releasing the interface may cause Kernel panic while unregister hci device.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-404 - Improper Resource Shutdown or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56760

In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support: WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32 __pci_enable_msix_range+0x30c/0x596 pci_msi_setup_msi_irqs+0x2c/0x32 pci_alloc_irq_vectors_affinity+0xb8/0xe2 RISCV uses hierarchical interrupt domains and correctly does not implement the legacy fallback. The warning triggers from the legacy fallback stub. That warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent domain is associated with the device or not. There is a check for MSI-X, which has a legacy assumption. But that legacy fallback assumption is only valid when legacy support is enabled, but otherwise the check should simply return -ENOTSUPP. Loongarch tripped over the same problem and blindly enabled legacy support without implementing the legacy fallbacks. There are weak implementations which return an error, so the problem was papered over. Correct pci_msi_domain_supports() to evaluate the legacy mode and add the missing supported check into the MSI enable path to complete it.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-754 - Improper Check for Unusual or Exceptional Conditions
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56779

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files remain open. Consequently, if an action attempts to open a file, it can potentially send two rpc_task to nfs server. NFS CLIENT thread1 thread2 open("file") ... nfs4_do_open _nfs4_do_open _nfs4_open_and_get_state _nfs4_proc_open nfs4_run_open_task /* rpc_task1 */ rpc_run_task rpc_wait_for_completion_task umount -f nfs_umount_begin rpc_killall_tasks rpc_signal_task rpc_task1 been wakeup and return -512 _nfs4_do_open // while loop ... nfs4_run_open_task /* rpc_task2 */ rpc_run_task rpc_wait_for_completion_task While processing an open request, nfsd will first attempt to find or allocate an nfs4_openowner. If it finds an nfs4_openowner that is not marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since two rpc_task can attempt to open the same file simultaneously from the client to server, and because two instances of nfsd can run concurrently, this situation can lead to lots of memory leak. Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be triggered. NFS SERVER nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // alloc oo1, stateid1 nfsd4_open nfsd4_process_open1 find_or_alloc_open_stateowner // find oo1, without NFS4_OO_CONFIRMED release_openowner unhash_openowner_locked list_del_init(&oo->oo_perclient) // cannot find this oo // from client, LEAK!!! alloc_stateowner // alloc oo2 nfsd4_process_open2 init_open_stateid // associate oo1 // with stateid1, stateid1 LEAK!!! nfs4_get_vfs_file // alloc nfsd_file1 and nfsd_file_mark1 // all LEAK!!! nfsd4_process_open2 ... write_threads ... nfsd_destroy_serv nfsd_shutdown_net nfs4_state_shutdown_net nfs4_state_destroy_net destroy_client __destroy_client // won't find oo1!!! nfsd_shutdown_generic nfsd_file_cache_shutdown kmem_cache_destroy for nfsd_file_slab and nfsd_file_mark_slab // bark since nfsd_file1 // and nfsd_file_mark1 // still alive ======================================================================= BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() ----------------------------------------------------------------------- Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28 flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dum ---truncated---

6.3 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-401 - Missing Release of Memory after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-56783

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable value not to harm performance. Remove unnecessary WARN_ON_ONCE which is reachable from userspace.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57798

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could be removed from another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. This could lead to a NULL deref/use-after-free of mst_primary in drm_dp_mst_handle_up_req(). Avoid the above by holding a reference for mst_primary in drm_dp_mst_handle_up_req() while it's used. v2: Fix kfreeing the request if getting an mst_primary reference fails.

6.7 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-416 - Use After Free
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57809

A flaw was found in the PCI-imx6 module in the Linux kernel. The suspend/resume support is missing in the i.MX6QDL platforms, allowing certain drivers, such as ath10k and iwlwifi, to crash after resuming, causing a kernel hang and a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-248 - Uncaught Exception
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57843

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix overflow inside virtnet_rq_alloc When the frag just got a page, then may lead to regression on VM. Specially if the sysctl net.core.high_order_alloc_disable value is 1, then the frag always get a page when do refill. Which could see reliable crashes or scp failure (scp a file 100M in size to VM). The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning of a new frag. When the frag size is larger than PAGE_SIZE, everything is fine. However, if the frag is only one page and the total size of the buffer and virtnet_rq_dma is larger than one page, an overflow may occur. The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever use_dma_api") introduced this problem. And we reverted some commits to fix this in last linux version. Now we try to enable it and fix this bug directly. Here, when the frag size is not enough, we reduce the buffer len to fix this problem.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57852

In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: smc: Handle missing SCM device Commit ca61d6836e6f ("firmware: qcom: scm: fix a NULL-pointer dereference") makes it explicit that qcom_scm_get_tzmem_pool() can return NULL, therefore its users should handle this.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57879

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Always release hdev at the end of iso_listen_bis Since hci_get_route holds the device before returning, the hdev should be released with hci_dev_put at the end of iso_listen_bis even if the function returns with an error.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-404 - Improper Resource Shutdown or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57884

In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() The task sometimes continues looping in throttle_direct_reclaim() because allow_direct_reclaim(pgdat) keeps returning false. #0 [ffff80002cb6f8d0] __switch_to at ffff8000080095ac #1 [ffff80002cb6f900] __schedule at ffff800008abbd1c #2 [ffff80002cb6f990] schedule at ffff800008abc50c #3 [ffff80002cb6f9b0] throttle_direct_reclaim at ffff800008273550 #4 [ffff80002cb6fa20] try_to_free_pages at ffff800008277b68 #5 [ffff80002cb6fae0] __alloc_pages_nodemask at ffff8000082c4660 #6 [ffff80002cb6fc50] alloc_pages_vma at ffff8000082e4a98 #7 [ffff80002cb6fca0] do_anonymous_page at ffff80000829f5a8 #8 [ffff80002cb6fce0] __handle_mm_fault at ffff8000082a5974 #9 [ffff80002cb6fd90] handle_mm_fault at ffff8000082a5bd4 At this point, the pgdat contains the following two zones: NODE: 4 ZONE: 0 ADDR: ffff00817fffe540 NAME: "DMA32" SIZE: 20480 MIN/LOW/HIGH: 11/28/45 VM_STAT: NR_FREE_PAGES: 359 NR_ZONE_INACTIVE_ANON: 18813 NR_ZONE_ACTIVE_ANON: 0 NR_ZONE_INACTIVE_FILE: 50 NR_ZONE_ACTIVE_FILE: 0 NR_ZONE_UNEVICTABLE: 0 NR_ZONE_WRITE_PENDING: 0 NR_MLOCK: 0 NR_BOUNCE: 0 NR_ZSPAGES: 0 NR_FREE_CMA_PAGES: 0 NODE: 4 ZONE: 1 ADDR: ffff00817fffec00 NAME: "Normal" SIZE: 8454144 PRESENT: 98304 MIN/LOW/HIGH: 68/166/264 VM_STAT: NR_FREE_PAGES: 146 NR_ZONE_INACTIVE_ANON: 94668 NR_ZONE_ACTIVE_ANON: 3 NR_ZONE_INACTIVE_FILE: 735 NR_ZONE_ACTIVE_FILE: 78 NR_ZONE_UNEVICTABLE: 0 NR_ZONE_WRITE_PENDING: 0 NR_MLOCK: 0 NR_BOUNCE: 0 NR_ZSPAGES: 0 NR_FREE_CMA_PAGES: 0 In allow_direct_reclaim(), while processing ZONE_DMA32, the sum of inactive/active file-backed pages calculated in zone_reclaimable_pages() based on the result of zone_page_state_snapshot() is zero. Additionally, since this system lacks swap, the calculation of inactive/ active anonymous pages is skipped. crash> p nr_swap_pages nr_swap_pages = $1937 = { counter = 0 } As a result, ZONE_DMA32 is deemed unreclaimable and skipped, moving on to the processing of the next zone, ZONE_NORMAL, despite ZONE_DMA32 having free pages significantly exceeding the high watermark. The problem is that the pgdat->kswapd_failures hasn't been incremented. crash> px ((struct pglist_data *) 0xffff00817fffe540)->kswapd_failures $1935 = 0x0 This is because the node deemed balanced. The node balancing logic in balance_pgdat() evaluates all zones collectively. If one or more zones (e.g., ZONE_DMA32) have enough free pages to meet their watermarks, the entire node is deemed balanced. This causes balance_pgdat() to exit early before incrementing the kswapd_failures, as it considers the overall memory state acceptable, even though some zones (like ZONE_NORMAL) remain under significant pressure. The patch ensures that zone_reclaimable_pages() includes free pages (NR_FREE_PAGES) in its calculation when no other reclaimable pages are available (e.g., file-backed or anonymous pages). This change prevents zones like ZONE_DMA32, which have sufficient free pages, from being mistakenly deemed unreclaimable. By doing so, the patch ensures proper node balancing, avoids masking pressure on other zones like ZONE_NORMAL, and prevents infinite loops in throttle_direct_reclaim() caused by allow_direct_reclaim(pgdat) repeatedly returning false. The kernel hangs due to a task stuck in throttle_direct_reclaim(), caused by a node being incorrectly deemed balanced despite pressure in certain zones, such as ZONE_NORMAL. This issue arises from zone_reclaimable_pages ---truncated---

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57885

In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: fix sleeping function called from invalid context at print message Address a bug in the kernel that triggers a "sleeping function called from invalid context" warning when /sys/kernel/debug/kmemleak is printed under specific conditions: - CONFIG_PREEMPT_RT=y - Set SELinux as the LSM for the system - Set kptr_restrict to 1 - kmemleak buffer contains at least one item BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 136, name: cat preempt_count: 1, expected: 0 RCU nest depth: 2, expected: 2 6 locks held by cat/136: #0: ffff32e64bcbf950 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb8/0xe30 #1: ffffafe6aaa9dea0 (scan_mutex){+.+.}-{3:3}, at: kmemleak_seq_start+0x34/0x128 #3: ffff32e6546b1cd0 (&object->lock){....}-{2:2}, at: kmemleak_seq_show+0x3c/0x1e0 #4: ffffafe6aa8d8560 (rcu_read_lock){....}-{1:2}, at: has_ns_capability_noaudit+0x8/0x1b0 #5: ffffafe6aabbc0f8 (notif_lock){+.+.}-{2:2}, at: avc_compute_av+0xc4/0x3d0 irq event stamp: 136660 hardirqs last enabled at (136659): [<ffffafe6a80fd7a0>] _raw_spin_unlock_irqrestore+0xa8/0xd8 hardirqs last disabled at (136660): [<ffffafe6a80fd85c>] _raw_spin_lock_irqsave+0x8c/0xb0 softirqs last enabled at (0): [<ffffafe6a5d50b28>] copy_process+0x11d8/0x3df8 softirqs last disabled at (0): [<0000000000000000>] 0x0 Preemption disabled at: [<ffffafe6a6598a4c>] kmemleak_seq_show+0x3c/0x1e0 CPU: 1 UID: 0 PID: 136 Comm: cat Tainted: G E 6.11.0-rt7+ #34 Tainted: [E]=UNSIGNED_MODULE Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xa0/0x128 show_stack+0x1c/0x30 dump_stack_lvl+0xe8/0x198 dump_stack+0x18/0x20 rt_spin_lock+0x8c/0x1a8 avc_perm_nonode+0xa0/0x150 cred_has_capability.isra.0+0x118/0x218 selinux_capable+0x50/0x80 security_capable+0x7c/0xd0 has_ns_capability_noaudit+0x94/0x1b0 has_capability_noaudit+0x20/0x30 restricted_pointer+0x21c/0x4b0 pointer+0x298/0x760 vsnprintf+0x330/0xf70 seq_printf+0x178/0x218 print_unreferenced+0x1a4/0x2d0 kmemleak_seq_show+0xd0/0x1e0 seq_read_iter+0x354/0xe30 seq_read+0x250/0x378 full_proxy_read+0xd8/0x148 vfs_read+0x190/0x918 ksys_read+0xf0/0x1e0 __arm64_sys_read+0x70/0xa8 invoke_syscall.constprop.0+0xd4/0x1d8 el0_svc+0x50/0x158 el0t_64_sync+0x17c/0x180 %pS and %pK, in the same back trace line, are redundant, and %pS can void %pK service in certain contexts. %pS alone already provides the necessary information, and if it cannot resolve the symbol, it falls back to printing the raw address voiding the original intent behind the %pK. Additionally, %pK requires a privilege check CAP_SYSLOG enforced through the LSM, which can trigger a "sleeping function called from invalid context" warning under RT_PREEMPT kernels when the check occurs in an atomic context. This issue may also affect other LSMs. This change avoids the unnecessary privilege check and resolves the sleeping function warning without any loss of information.

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-57888

In the Linux kernel, the following vulnerability has been resolved: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker After commit 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM") amdgpu started seeing the following warning: [ ] workqueue: WQ_MEM_RECLAIM sdma0:drm_sched_run_job_work [gpu_sched] is flushing !WQ_MEM_RECLAIM events:amdgpu_device_delay_enable_gfx_off [amdgpu] ... [ ] Workqueue: sdma0 drm_sched_run_job_work [gpu_sched] ... [ ] Call Trace: [ ] <TASK> ... [ ] ? check_flush_dependency+0xf5/0x110 ... [ ] cancel_delayed_work_sync+0x6e/0x80 [ ] amdgpu_gfx_off_ctrl+0xab/0x140 [amdgpu] [ ] amdgpu_ring_alloc+0x40/0x50 [amdgpu] [ ] amdgpu_ib_schedule+0xf4/0x810 [amdgpu] [ ] ? drm_sched_run_job_work+0x22c/0x430 [gpu_sched] [ ] amdgpu_job_run+0xaa/0x1f0 [amdgpu] [ ] drm_sched_run_job_work+0x257/0x430 [gpu_sched] [ ] process_one_work+0x217/0x720 ... [ ] </TASK> The intent of the verifcation done in check_flush_depedency is to ensure forward progress during memory reclaim, by flagging cases when either a memory reclaim process, or a memory reclaim work item is flushed from a context not marked as memory reclaim safe. This is correct when flushing, but when called from the cancel(_delayed)_work_sync() paths it is a false positive because work is either already running, or will not be running at all. Therefore cancelling it is safe and we can relax the warning criteria by letting the helper know of the calling context. References: 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM")

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-833 - Deadlock
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57890

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57894

[REJECTED CVE] A vulnerability was identified in the Linux kernel's Bluetooth: hci_core package, where a sleeping function (mutex_lock) was improperly invoked from an invalid context within the HCI event handling workqueue, potentially leading to kernel warnings or deadlocks. An attacker exploiting this flaw could trigger crafted Bluetooth events or malformed packets to indirectly cause system instability or denial of service through workqueue execution paths.

CWE-662 - Improper Synchronization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
CVE-2024-57898

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any clean-up operations. However, some functions require the link ID to remain in the valid_links bitmap. One such example is cfg80211_cac_event(). The flow is - nl80211_remove_link() cfg80211_remove_link() ieee80211_del_intf_link() ieee80211_vif_set_links() ieee80211_vif_update_links() ieee80211_link_stop() cfg80211_cac_event() cfg80211_cac_event() requires link ID to be present but it is cleared already in cfg80211_remove_link(). Ultimately, WARN_ON() is hit. Therefore, clear the link ID from the bitmap only after completing the link clean-up.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-672 - Operation on a Resource after Expiration or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57903

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1]. Trying to acquire a mutex in RCU callback is not allowed. Restrict SO_REUSEPORT socket option to inet sockets. v1 of this patch supported TCP, UDP and SCTP sockets, but fcnal-test.sh test needed RAW and ICMP support. [1] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 24, name: ksoftirqd/1 preempt_count: 100, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by ksoftirqd/1/24: #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2561 [inline] #0: ffffffff8e937ba0 (rcu_callback){....}-{0:0}, at: rcu_core+0xa37/0x17a0 kernel/rcu/tree.c:2823 Preemption disabled at: [<ffffffff8161c8c8>] softirq_handle_begin kernel/softirq.c:402 [inline] [<ffffffff8161c8c8>] handle_softirqs+0x128/0x9b0 kernel/softirq.c:537 CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 __might_resched+0x5d4/0x780 kernel/sched/core.c:8758 __mutex_lock_common kernel/locking/mutex.c:562 [inline] __mutex_lock+0x131/0xee0 kernel/locking/mutex.c:735 crypto_put_default_null_skcipher+0x18/0x70 crypto/crypto_null.c:179 aead_release+0x3d/0x50 crypto/algif_aead.c:489 alg_do_release crypto/af_alg.c:118 [inline] alg_sock_destruct+0x86/0xc0 crypto/af_alg.c:502 __sk_destruct+0x58/0x5f0 net/core/sock.c:2260 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 run_ksoftirqd+0xca/0x130 kernel/softirq.c:950 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-667 - Improper Locking
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57929

In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638! Fix by setting the cached block pointer to NULL on errors. In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR>

6.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CWE-672 - Operation on a Resource after Expiration or Release
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-57931

In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-693 - Protection Mechanism Failure
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-57940

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-58009

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2024-58064

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap() kunit_kzalloc() may return NULL, dereferencing it without NULL check may lead to NULL dereference. Add a NULL check for ies.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2024-58099

A vulnerability was found in the Linux kernel's vmxnet3 network driver in the `vmxnet3_xdp_xmit_frame()` function. An incorrect DMA address calculation caused by the use of a fixed (rather than dynamic) offset leads to a corrupt packet being sent out and subsequently dropped on the path. This can lead to system instability and a denial of service caused by persistent packet loss.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-131 - Incorrect Calculation of Buffer Size
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-1272

The Linux Kernel lockdown mode for kernel versions starting on 6.12 and above for Fedora Linux has the lockdown mode disabled without any warning. This may allow an attacker to gain access to sensitive information such kernel memory mappings, I/O ports, BPF and kprobes. Additionally unsigned modules can be loaded, leading to execution of untrusted code breaking breaking any Secure Boot protection. This vulnerability affects only Fedora Linux.

7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21646

In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a directory under /proc/net/afs/ with the name of the cell, but that fails with a warning: WARNING: CPU: 0 PID: 9 at fs/proc/generic.c:405 because procfs limits the maximum filename length to 255. However, the DNS limits the maximum lookup length and, by extension, the maximum cell name, to 255 less two (length count and trailing NUL). Fix this by limiting the maximum acceptable cellname length to 253. This also allows us to be sure we can create the "/afs/.<cell>/" mountpoint too. Further, split the YFS VL record cell name maximum to be the 256 allowed by the protocol and ignore the record retrieved by YFSVL.GetCellName if it exceeds 253.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 - Improper Input Validation
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21663

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The current driver is hard coded to use MGBE0's SID for all controllers. This causes softirq time outs and kernel panics when using controllers other than MGBE0. Example dmesg errors when an ethernet cable is connected to MGBE1: [ 116.133290] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 121.851283] tegra-mgbe 6910000.ethernet eth1: NETDEV WATCHDOG: CPU: 5: transmit queue 0 timed out 5690 ms [ 121.851782] tegra-mgbe 6910000.ethernet eth1: Reset adapter. [ 121.892464] tegra-mgbe 6910000.ethernet eth1: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 121.905920] tegra-mgbe 6910000.ethernet eth1: PHY [stmmac-1:00] driver [Aquantia AQR113] (irq=171) [ 121.907356] tegra-mgbe 6910000.ethernet eth1: Enabling Safety Features [ 121.907578] tegra-mgbe 6910000.ethernet eth1: IEEE 1588-2008 Advanced Timestamp supported [ 121.908399] tegra-mgbe 6910000.ethernet eth1: registered PTP clock [ 121.908582] tegra-mgbe 6910000.ethernet eth1: configuring for phy/10gbase-r link mode [ 125.961292] tegra-mgbe 6910000.ethernet eth1: Link is Up - 1Gbps/Full - flow control rx/tx [ 181.921198] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 181.921404] rcu: 7-....: (1 GPs behind) idle=540c/1/0x4000000000000002 softirq=1748/1749 fqs=2337 [ 181.921684] rcu: (detected by 4, t=6002 jiffies, g=1357, q=1254 ncpus=8) [ 181.921878] Sending NMI from CPU 4 to CPUs 7: [ 181.921886] NMI backtrace for cpu 7 [ 181.922131] CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Kdump: loaded Not tainted 6.13.0-rc3+ #6 [ 181.922390] Hardware name: NVIDIA CTI Forge + Orin AGX/Jetson, BIOS 202402.1-Unknown 10/28/2024 [ 181.922658] pstate: 40400009 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 181.922847] pc : handle_softirqs+0x98/0x368 [ 181.922978] lr : __do_softirq+0x18/0x20 [ 181.923095] sp : ffff80008003bf50 [ 181.923189] x29: ffff80008003bf50 x28: 0000000000000008 x27: 0000000000000000 [ 181.923379] x26: ffffce78ea277000 x25: 0000000000000000 x24: 0000001c61befda0 [ 181.924486] x23: 0000000060400009 x22: ffffce78e99918bc x21: ffff80008018bd70 [ 181.925568] x20: ffffce78e8bb00d8 x19: ffff80008018bc20 x18: 0000000000000000 [ 181.926655] x17: ffff318ebe7d3000 x16: ffff800080038000 x15: 0000000000000000 [ 181.931455] x14: ffff000080816680 x13: ffff318ebe7d3000 x12: 000000003464d91d [ 181.938628] x11: 0000000000000040 x10: ffff000080165a70 x9 : ffffce78e8bb0160 [ 181.945804] x8 : ffff8000827b3160 x7 : f9157b241586f343 x6 : eeb6502a01c81c74 [ 181.953068] x5 : a4acfcdd2e8096bb x4 : ffffce78ea277340 x3 : 00000000ffffd1e1 [ 181.960329] x2 : 0000000000000101 x1 : ffffce78ea277340 x0 : ffff318ebe7d3000 [ 181.967591] Call trace: [ 181.970043] handle_softirqs+0x98/0x368 (P) [ 181.974240] __do_softirq+0x18/0x20 [ 181.977743] ____do_softirq+0x14/0x28 [ 181.981415] call_on_irq_stack+0x24/0x30 [ 181.985180] do_softirq_own_stack+0x20/0x30 [ 181.989379] __irq_exit_rcu+0x114/0x140 [ 181.993142] irq_exit_rcu+0x14/0x28 [ 181.996816] el1_interrupt+0x44/0xb8 [ 182.000316] el1h_64_irq_handler+0x14/0x20 [ 182.004343] el1h_64_irq+0x80/0x88 [ 182.007755] cpuidle_enter_state+0xc4/0x4a8 (P) [ 182.012305] cpuidle_enter+0x3c/0x58 [ 182.015980] cpuidle_idle_call+0x128/0x1c0 [ 182.020005] do_idle+0xe0/0xf0 [ 182.023155] cpu_startup_entry+0x3c/0x48 [ 182.026917] secondary_start_kernel+0xdc/0x120 [ 182.031379] __secondary_switched+0x74/0x78 [ 212.971162] rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 7-.... } 6103 jiffies s: 417 root: 0x80/. [ 212.985935] rcu: blocking rcu_node structures (internal RCU debug): [ 212.992758] Sending NMI from CPU 0 to CPUs 7: [ 212.998539] NMI backtrace for cpu 7 [ 213.004304] CPU: 7 UID: 0 PI ---truncated---

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2025-21666

In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't. Previous commits should have solved the real problems, but we may have more in the future, so to avoid null-ptr-deref, we can return 0 (no space, no data available) but with a warning. This way the code should continue to run in a nearly consistent state and have a warning that allows us to debug future problems.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21668

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mp_blk_ctrl_remove() will continue the for loop until an out-of-bounds exception occurs. pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dev_pm_domain_detach+0x8/0x48 lr : imx8mp_blk_ctrl_shutdown+0x58/0x90 sp : ffffffc084f8bbf0 x29: ffffffc084f8bbf0 x28: ffffff80daf32ac0 x27: 0000000000000000 x26: ffffffc081658d78 x25: 0000000000000001 x24: ffffffc08201b028 x23: ffffff80d0db9490 x22: ffffffc082340a78 x21: 00000000000005b0 x20: ffffff80d19bc180 x19: 000000000000000a x18: ffffffffffffffff x17: ffffffc080a39e08 x16: ffffffc080a39c98 x15: 4f435f464f006c72 x14: 0000000000000004 x13: ffffff80d0172110 x12: 0000000000000000 x11: ffffff80d0537740 x10: ffffff80d05376c0 x9 : ffffffc0808ed2d8 x8 : ffffffc084f8bab0 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff80d19b9420 x4 : fffffffe03466e60 x3 : 0000000080800077 x2 : 0000000000000000 x1 : 0000000000000001 x0 : 0000000000000000 Call trace: dev_pm_domain_detach+0x8/0x48 platform_shutdown+0x2c/0x48 device_shutdown+0x158/0x268 kernel_restart_prepare+0x40/0x58 kernel_kexec+0x58/0xe8 __do_sys_reboot+0x198/0x258 __arm64_sys_reboot+0x2c/0x40 invoke_syscall+0x5c/0x138 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xc8 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x190/0x198 Code: 8128c2d0 ffffffc0 aa1e03e9 d503201f

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21669

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected and would cause issues when we access vsk->transport. A possible scenario is described by Hyunwoo Kim in the attached link, where after a first connect() interrupted by a signal, and a second connect() failed, we can find `vsk->transport` at NULL, leading to a NULL pointer dereference.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21689

A flaw was found in the quatech2 module in the Linux kernel. An incorrect check for invalid port numbers can cause a NULL pointer dereference and result in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-21694

In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone down, but they still happen sometimes. In a memory constrained environment like the kdump image, a softlockup is not just a harmless message, but it can interfere with things like RCU freeing memory, causing the crashdump to get stuck. The second loop in __read_vmcore has a lot more opportunities for natural sleep points, like scheduling out while waiting for a data write to happen, but apparently that is not always enough. Add a cond_resched() to the second loop in __read_vmcore to (hopefully) get rid of the softlockups.

4.1 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2025-21888

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a WARN during dereg_mr for DM type Memory regions (MR) of type DM (device memory) do not have an associated umem. In the __mlx5_ib_dereg_mr() -> mlx5_free_priv_descs() flow, the code incorrectly takes the wrong branch, attempting to call dma_unmap_single() on a DMA address that is not mapped. This results in a WARN [1], as shown below. The issue is resolved by properly accounting for the DM type and ensuring the correct branch is selected in mlx5_free_priv_descs(). [1] WARNING: CPU: 12 PID: 1346 at drivers/iommu/dma-iommu.c:1230 iommu_dma_unmap_page+0x79/0x90 Modules linked in: ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry ovelay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core fuse mlx5_core CPU: 12 UID: 0 PID: 1346 Comm: ibv_rc_pingpong Not tainted 6.12.0-rc7+ #1631 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:iommu_dma_unmap_page+0x79/0x90 Code: 2b 49 3b 29 72 26 49 3b 69 08 73 20 4d 89 f0 44 89 e9 4c 89 e2 48 89 ee 48 89 df 5b 5d 41 5c 41 5d 41 5e 41 5f e9 07 b8 88 ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 66 0f 1f 44 00 RSP: 0018:ffffc90001913a10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810194b0a8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffff88810194b0a8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f537abdd740(0000) GS:ffff88885fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f537aeb8000 CR3: 000000010c248001 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __warn+0x84/0x190 ? iommu_dma_unmap_page+0x79/0x90 ? report_bug+0xf8/0x1c0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x13/0x60 ? asm_exc_invalid_op+0x16/0x20 ? iommu_dma_unmap_page+0x79/0x90 dma_unmap_page_attrs+0xe6/0x290 mlx5_free_priv_descs+0xb0/0xe0 [mlx5_ib] __mlx5_ib_dereg_mr+0x37e/0x520 [mlx5_ib] ? _raw_spin_unlock_irq+0x24/0x40 ? wait_for_completion+0xfe/0x130 ? rdma_restrack_put+0x63/0xe0 [ib_core] ib_dereg_mr_user+0x5f/0x120 [ib_core] ? lock_release+0xc6/0x280 destroy_hw_idr_uobject+0x1d/0x60 [ib_uverbs] uverbs_destroy_uobject+0x58/0x1d0 [ib_uverbs] uobj_destroy+0x3f/0x70 [ib_uverbs] ib_uverbs_cmd_verbs+0x3e4/0xbb0 [ib_uverbs] ? __pfx_uverbs_destroy_def_handler+0x10/0x10 [ib_uverbs] ? lock_acquire+0xc1/0x2f0 ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0x116/0x170 [ib_uverbs] ? lock_release+0xc6/0x280 ib_uverbs_ioctl+0xe7/0x170 [ib_uverbs] ? ib_uverbs_ioctl+0xcb/0x170 [ib_uverbs] __x64_sys_ioctl+0x1b0/0xa70 do_syscall_64+0x6b/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f537adaf17b Code: 0f 1e fa 48 8b 05 1d ad 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ed ac 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffff218f0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffff218f1d8 RCX: 00007f537adaf17b RDX: 00007ffff218f1c0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffff218f1a0 R08: 00007f537aa8d010 R09: 0000561ee2e4f270 R10: 00007f537aace3a8 R11: 0000000000000246 R12: 00007ffff218f190 R13: 000000000000001c R14: 0000561ee2e4d7c0 R15: 00007ffff218f450 </TASK>

3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-703 - Improper Check or Handling of Exceptional Conditions
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
CVE-2025-22087

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix array bounds error with may_goto may_goto uses an additional 8 bytes on the stack, which causes the interpreters[] array to go out of bounds when calculating index by stack_size. 1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT cases, reject loading directly. 2. For non-JIT cases, calculating interpreters[idx] may still cause out-of-bounds array access, and just warn about it. 3. For jit_requested cases, the execution of bpf_func also needs to be warned. So move the definition of function __bpf_prog_ret0_warn out of the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE-125 - Out-of-bounds Read
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-68179

A flaw was found in the Linux kernel on the s390 architecture. A local user with low privileges could trigger a vulnerability by enabling ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP. This issue arises because kernel page table entries are modified without properly flushing the Translation Lookaside Buffer (TLB), which can lead to system crashes and potential data corruption. This could result in a denial of service.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-821 - Incorrect Synchronization
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Moderate
CVE-2025-71151

A memory and information leak vulnerability was found in the Linux kernel's CIFS/SMB3 filesystem driver. When smb3_reconfigure() fails during smb3_sync_session_ctx_passwords(), the newly allocated password buffers (new_password and new_password2) are not freed or securely erased. This causes a memory leak and leaves sensitive password data in kernel memory that could potentially be exposed.

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Fixed 305 products, the same list as for CVE-2022-48969
Threats
Impact Low
References
URL Category
https://access.redhat.com/errata/RHSA-2025:6966 self
https://docs.redhat.com/en/documentation/red_hat_… external
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2278283 external
https://bugzilla.redhat.com/show_bug.cgi?id=2280464 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281340 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281687 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281827 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281829 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281879 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281905 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281907 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281909 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281912 external
https://bugzilla.redhat.com/show_bug.cgi?id=2281914 external
https://bugzilla.redhat.com/show_bug.cgi?id=2282952 external
https://bugzilla.redhat.com/show_bug.cgi?id=2282955 external
https://bugzilla.redhat.com/show_bug.cgi?id=2282959 external
https://bugzilla.redhat.com/show_bug.cgi?id=2284280 external
https://bugzilla.redhat.com/show_bug.cgi?id=2292324 external
https://bugzilla.redhat.com/show_bug.cgi?id=2293458 external
https://bugzilla.redhat.com/show_bug.cgi?id=2297472 external
https://bugzilla.redhat.com/show_bug.cgi?id=2297540 external
https://bugzilla.redhat.com/show_bug.cgi?id=2298411 external
https://bugzilla.redhat.com/show_bug.cgi?id=2300437 external
https://bugzilla.redhat.com/show_bug.cgi?id=2301498 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307840 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307862 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307871 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307883 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307887 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307888 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307889 external
https://bugzilla.redhat.com/show_bug.cgi?id=2307891 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309783 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309789 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309795 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309838 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309850 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309852 external
https://bugzilla.redhat.com/show_bug.cgi?id=2309863 external
https://bugzilla.redhat.com/show_bug.cgi?id=2311706 external
https://bugzilla.redhat.com/show_bug.cgi?id=2311707 external
https://bugzilla.redhat.com/show_bug.cgi?id=2311713 external
https://bugzilla.redhat.com/show_bug.cgi?id=2311719 external
https://bugzilla.redhat.com/show_bug.cgi?id=2312061 external
https://bugzilla.redhat.com/show_bug.cgi?id=2312063 external
https://bugzilla.redhat.com/show_bug.cgi?id=2312108 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313053 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313054 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313055 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313056 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313091 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313093 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313095 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313098 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313102 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313104 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313106 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313107 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313109 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313131 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313134 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313135 external
https://bugzilla.redhat.com/show_bug.cgi?id=2313148 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315156 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315157 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315158 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315171 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315172 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315174 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315180 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315187 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315191 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315205 external
https://bugzilla.redhat.com/show_bug.cgi?id=2315216 external
https://bugzilla.redhat.com/show_bug.cgi?id=2317581 external
https://bugzilla.redhat.com/show_bug.cgi?id=2317584 external
https://bugzilla.redhat.com/show_bug.cgi?id=2317601 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320168 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320169 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320173 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320187 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320200 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320209 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320210 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320212 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320213 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320214 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320220 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320225 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320235 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320238 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320239 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320240 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320242 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320245 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320246 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320248 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320249 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320268 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320274 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320425 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320432 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320443 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320454 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320459 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320462 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320468 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320471 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320475 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320480 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320481 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320484 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320486 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320488 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320489 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320497 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320500 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320501 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320502 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320503 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320506 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320509 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320510 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320515 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320520 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320527 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320529 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320531 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320541 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320543 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320544 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320546 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320547 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320549 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320550 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320552 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320554 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320556 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320557 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320559 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320562 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320563 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320565 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320570 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320571 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320572 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320573 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320574 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320576 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320577 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320586 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320587 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320589 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320590 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320594 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320596 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320598 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320601 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320602 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320610 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320611 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320612 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320615 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320620 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320625 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320629 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320635 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320636 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320658 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320670 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320693 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320707 external
https://bugzilla.redhat.com/show_bug.cgi?id=2320781 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322072 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322303 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322308 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322310 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322312 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322316 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322320 external
https://bugzilla.redhat.com/show_bug.cgi?id=2322323 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323905 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323909 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323918 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323924 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323927 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323929 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323932 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323933 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323938 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323945 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323947 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323950 external
https://bugzilla.redhat.com/show_bug.cgi?id=2323953 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324317 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324320 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324321 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324324 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324325 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324410 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324413 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324419 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324423 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324548 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324566 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324578 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324599 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324610 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324617 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324645 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324650 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324853 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324865 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324869 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324874 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324875 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324889 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324897 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324899 external
https://bugzilla.redhat.com/show_bug.cgi?id=2324901 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327174 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327182 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327189 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327190 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327194 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327332 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327335 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327338 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327343 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327344 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327349 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327358 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327361 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327362 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327365 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327369 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327370 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327373 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327381 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327383 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327888 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327890 external
https://bugzilla.redhat.com/show_bug.cgi?id=2327893 external
https://bugzilla.redhat.com/show_bug.cgi?id=2328791 external
https://bugzilla.redhat.com/show_bug.cgi?id=2328792 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329818 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329919 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329927 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329928 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329929 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329930 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329935 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329936 external
https://bugzilla.redhat.com/show_bug.cgi?id=2329937 external
https://bugzilla.redhat.com/show_bug.cgi?id=2330346 external
https://bugzilla.redhat.com/show_bug.cgi?id=2330357 external
https://bugzilla.redhat.com/show_bug.cgi?id=2330765 external
https://bugzilla.redhat.com/show_bug.cgi?id=2333973 external
https://bugzilla.redhat.com/show_bug.cgi?id=2333974 external
https://bugzilla.redhat.com/show_bug.cgi?id=2333976 external
https://bugzilla.redhat.com/show_bug.cgi?id=2333977 external
https://bugzilla.redhat.com/show_bug.cgi?id=2333982 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334350 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334367 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334373 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334384 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334386 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334388 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334392 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334398 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334399 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334408 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334409 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334419 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334426 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334430 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334432 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334441 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334458 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334461 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334463 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334469 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334472 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334479 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334483 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334486 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334495 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334501 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334503 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334528 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334538 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334539 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334542 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334551 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334561 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334562 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334563 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334573 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334575 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334577 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334667 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334683 external
https://bugzilla.redhat.com/show_bug.cgi?id=2334809 external
https://bugzilla.redhat.com/show_bug.cgi?id=2335899 external
https://bugzilla.redhat.com/show_bug.cgi?id=2335906 external
https://bugzilla.redhat.com/show_bug.cgi?id=2336546 external
https://bugzilla.redhat.com/show_bug.cgi?id=2336550 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337104 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337113 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337117 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337118 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337136 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337148 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337152 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337328 external
https://bugzilla.redhat.com/show_bug.cgi?id=2337333 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338195 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338197 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338199 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338204 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338208 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338214 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338830 external
https://bugzilla.redhat.com/show_bug.cgi?id=2338858 external
https://bugzilla.redhat.com/show_bug.cgi?id=2339126 external
https://bugzilla.redhat.com/show_bug.cgi?id=2339140 external
https://bugzilla.redhat.com/show_bug.cgi?id=2339143 external
https://bugzilla.redhat.com/show_bug.cgi?id=2343169 external
https://bugzilla.redhat.com/show_bug.cgi?id=2343173 external
https://bugzilla.redhat.com/show_bug.cgi?id=2343183 external
https://bugzilla.redhat.com/show_bug.cgi?id=2344683 external
https://bugzilla.redhat.com/show_bug.cgi?id=2345243 external
https://bugzilla.redhat.com/show_bug.cgi?id=2345615 external
https://bugzilla.redhat.com/show_bug.cgi?id=2362882 external
https://issues.redhat.com/browse/RHEL-12439 external
https://issues.redhat.com/browse/RHEL-28791 external
https://issues.redhat.com/browse/RHEL-58641 external
https://issues.redhat.com/browse/RHEL-60028 external
https://issues.redhat.com/browse/RHEL-61203 external
https://issues.redhat.com/browse/RHEL-62339 external
https://issues.redhat.com/browse/RHEL-67304 external
https://issues.redhat.com/browse/RHEL-71541 external
https://issues.redhat.com/browse/RHEL-8810 external
https://issues.redhat.com/browse/RHEL-9279 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2022-48969 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320658 external
https://www.cve.org/CVERecord?id=CVE-2022-48969 external
https://nvd.nist.gov/vuln/detail/CVE-2022-48969 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2022-48989 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320707 external
https://www.cve.org/CVERecord?id=CVE-2022-48989 external
https://nvd.nist.gov/vuln/detail/CVE-2022-48989 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2022-49006 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320781 external
https://www.cve.org/CVERecord?id=CVE-2022-49006 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49006 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2022-49014 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320670 external
https://www.cve.org/CVERecord?id=CVE-2022-49014 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49014 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2022-49029 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320693 external
https://www.cve.org/CVERecord?id=CVE-2022-49029 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49029 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2022-49747 self
https://bugzilla.redhat.com/show_bug.cgi?id=2355435 external
https://www.cve.org/CVERecord?id=CVE-2022-49747 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49747 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2022-49778 self
https://bugzilla.redhat.com/show_bug.cgi?id=2363427 external
https://www.cve.org/CVERecord?id=CVE-2022-49778 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49778 external
https://lore.kernel.org/linux-cve-announce/202505… external
https://access.redhat.com/security/cve/CVE-2022-49804 self
https://bugzilla.redhat.com/show_bug.cgi?id=2363456 external
https://www.cve.org/CVERecord?id=CVE-2022-49804 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49804 external
https://lore.kernel.org/linux-cve-announce/202505… external
https://access.redhat.com/security/cve/CVE-2022-49815 self
https://bugzilla.redhat.com/show_bug.cgi?id=2363358 external
https://www.cve.org/CVERecord?id=CVE-2022-49815 external
https://nvd.nist.gov/vuln/detail/CVE-2022-49815 external
https://lore.kernel.org/linux-cve-announce/202505… external
https://access.redhat.com/security/cve/CVE-2022-50112 self
https://bugzilla.redhat.com/show_bug.cgi?id=2373669 external
https://www.cve.org/CVERecord?id=CVE-2022-50112 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50112 external
https://lore.kernel.org/linux-cve-announce/202506… external
https://access.redhat.com/security/cve/CVE-2022-50121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2373534 external
https://www.cve.org/CVERecord?id=CVE-2022-50121 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50121 external
https://lore.kernel.org/linux-cve-announce/202506… external
https://access.redhat.com/security/cve/CVE-2022-50159 self
https://bugzilla.redhat.com/show_bug.cgi?id=2373696 external
https://www.cve.org/CVERecord?id=CVE-2022-50159 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50159 external
https://lore.kernel.org/linux-cve-announce/202506… external
https://access.redhat.com/security/cve/CVE-2022-50214 self
https://bugzilla.redhat.com/show_bug.cgi?id=2373513 external
https://www.cve.org/CVERecord?id=CVE-2022-50214 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50214 external
https://lore.kernel.org/linux-cve-announce/202506… external
https://access.redhat.com/security/cve/CVE-2022-50319 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395312 external
https://www.cve.org/CVERecord?id=CVE-2022-50319 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50319 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2022-50421 self
https://bugzilla.redhat.com/show_bug.cgi?id=2400737 external
https://www.cve.org/CVERecord?id=CVE-2022-50421 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50421 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2022-50491 self
https://bugzilla.redhat.com/show_bug.cgi?id=2401482 external
https://www.cve.org/CVERecord?id=CVE-2022-50491 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50491 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2022-50511 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402295 external
https://www.cve.org/CVERecord?id=CVE-2022-50511 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50511 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2022-50614 self
https://bugzilla.redhat.com/show_bug.cgi?id=2419885 external
https://www.cve.org/CVERecord?id=CVE-2022-50614 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50614 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2022-50743 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425151 external
https://www.cve.org/CVERecord?id=CVE-2022-50743 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50743 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2022-50811 self
https://bugzilla.redhat.com/show_bug.cgi?id=2426130 external
https://www.cve.org/CVERecord?id=CVE-2022-50811 external
https://nvd.nist.gov/vuln/detail/CVE-2022-50811 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-52672 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281340 external
https://www.cve.org/CVERecord?id=CVE-2023-52672 external
https://nvd.nist.gov/vuln/detail/CVE-2023-52672 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2023-52917 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320213 external
https://www.cve.org/CVERecord?id=CVE-2023-52917 external
https://nvd.nist.gov/vuln/detail/CVE-2023-52917 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2023-53066 self
https://bugzilla.redhat.com/show_bug.cgi?id=2363718 external
https://www.cve.org/CVERecord?id=CVE-2023-53066 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53066 external
https://lore.kernel.org/linux-cve-announce/202505… external
https://access.redhat.com/security/cve/CVE-2023-53117 self
https://bugzilla.redhat.com/show_bug.cgi?id=2363694 external
https://www.cve.org/CVERecord?id=CVE-2023-53117 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53117 external
https://lore.kernel.org/linux-cve-announce/202505… external
https://access.redhat.com/security/cve/CVE-2023-53196 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395317 external
https://www.cve.org/CVERecord?id=CVE-2023-53196 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53196 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53260 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395374 external
https://www.cve.org/CVERecord?id=CVE-2023-53260 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53260 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53261 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395302 external
https://www.cve.org/CVERecord?id=CVE-2023-53261 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53261 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53287 self
https://bugzilla.redhat.com/show_bug.cgi?id=2395698 external
https://www.cve.org/CVERecord?id=CVE-2023-53287 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53287 external
https://lore.kernel.org/linux-cve-announce/202509… external
https://access.redhat.com/security/cve/CVE-2023-53510 self
https://bugzilla.redhat.com/show_bug.cgi?id=2400714 external
https://www.cve.org/CVERecord?id=CVE-2023-53510 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53510 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53519 self
https://bugzilla.redhat.com/show_bug.cgi?id=2400734 external
https://www.cve.org/CVERecord?id=CVE-2023-53519 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53519 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53555 self
https://bugzilla.redhat.com/show_bug.cgi?id=2401465 external
https://www.cve.org/CVERecord?id=CVE-2023-53555 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53555 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53568 self
https://bugzilla.redhat.com/show_bug.cgi?id=2401507 external
https://www.cve.org/CVERecord?id=CVE-2023-53568 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53568 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53595 self
https://bugzilla.redhat.com/show_bug.cgi?id=2401509 external
https://www.cve.org/CVERecord?id=CVE-2023-53595 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53595 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53654 self
https://bugzilla.redhat.com/show_bug.cgi?id=2402189 external
https://www.cve.org/CVERecord?id=CVE-2023-53654 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53654 external
https://lore.kernel.org/linux-cve-announce/202510… external
https://access.redhat.com/security/cve/CVE-2023-53859 self
https://bugzilla.redhat.com/show_bug.cgi?id=2420340 external
https://www.cve.org/CVERecord?id=CVE-2023-53859 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53859 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-53989 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424933 external
https://www.cve.org/CVERecord?id=CVE-2023-53989 external
https://nvd.nist.gov/vuln/detail/CVE-2023-53989 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54089 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425125 external
https://www.cve.org/CVERecord?id=CVE-2023-54089 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54089 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54117 self
https://bugzilla.redhat.com/show_bug.cgi?id=2425079 external
https://www.cve.org/CVERecord?id=CVE-2023-54117 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54117 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54230 self
https://bugzilla.redhat.com/show_bug.cgi?id=2426148 external
https://www.cve.org/CVERecord?id=CVE-2023-54230 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54230 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54278 self
https://bugzilla.redhat.com/show_bug.cgi?id=2426072 external
https://www.cve.org/CVERecord?id=CVE-2023-54278 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54278 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54313 self
https://bugzilla.redhat.com/show_bug.cgi?id=2426085 external
https://www.cve.org/CVERecord?id=CVE-2023-54313 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54313 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2023-54322 self
https://bugzilla.redhat.com/show_bug.cgi?id=2426163 external
https://www.cve.org/CVERecord?id=CVE-2023-54322 external
https://nvd.nist.gov/vuln/detail/CVE-2023-54322 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2024-27008 self
https://bugzilla.redhat.com/show_bug.cgi?id=2278283 external
https://www.cve.org/CVERecord?id=CVE-2024-27008 external
https://nvd.nist.gov/vuln/detail/CVE-2024-27008 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-27398 self
https://bugzilla.redhat.com/show_bug.cgi?id=2280464 external
https://www.cve.org/CVERecord?id=CVE-2024-27398 external
https://nvd.nist.gov/vuln/detail/CVE-2024-27398 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35891 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281687 external
https://www.cve.org/CVERecord?id=CVE-2024-35891 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35891 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35933 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281829 external
https://www.cve.org/CVERecord?id=CVE-2024-35933 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35933 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35934 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281827 external
https://www.cve.org/CVERecord?id=CVE-2024-35934 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35934 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35963 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281914 external
https://www.cve.org/CVERecord?id=CVE-2024-35963 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35963 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35964 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281912 external
https://www.cve.org/CVERecord?id=CVE-2024-35964 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35964 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35965 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281909 external
https://www.cve.org/CVERecord?id=CVE-2024-35965 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35965 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35966 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281907 external
https://www.cve.org/CVERecord?id=CVE-2024-35966 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35966 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35967 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281905 external
https://www.cve.org/CVERecord?id=CVE-2024-35967 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35967 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-35978 self
https://bugzilla.redhat.com/show_bug.cgi?id=2281879 external
https://www.cve.org/CVERecord?id=CVE-2024-35978 external
https://nvd.nist.gov/vuln/detail/CVE-2024-35978 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-36011 self
https://bugzilla.redhat.com/show_bug.cgi?id=2282959 external
https://www.cve.org/CVERecord?id=CVE-2024-36011 external
https://nvd.nist.gov/vuln/detail/CVE-2024-36011 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-36012 self
https://bugzilla.redhat.com/show_bug.cgi?id=2282955 external
https://www.cve.org/CVERecord?id=CVE-2024-36012 external
https://nvd.nist.gov/vuln/detail/CVE-2024-36012 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-36013 self
https://bugzilla.redhat.com/show_bug.cgi?id=2282952 external
https://www.cve.org/CVERecord?id=CVE-2024-36013 external
https://nvd.nist.gov/vuln/detail/CVE-2024-36013 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-36880 self
https://bugzilla.redhat.com/show_bug.cgi?id=2284280 external
https://www.cve.org/CVERecord?id=CVE-2024-36880 external
https://nvd.nist.gov/vuln/detail/CVE-2024-36880 external
https://lore.kernel.org/linux-cve-announce/202405… external
https://access.redhat.com/security/cve/CVE-2024-36968 self
https://bugzilla.redhat.com/show_bug.cgi?id=2292324 external
https://www.cve.org/CVERecord?id=CVE-2024-36968 external
https://nvd.nist.gov/vuln/detail/CVE-2024-36968 external
https://access.redhat.com/security/cve/CVE-2024-38541 self
https://bugzilla.redhat.com/show_bug.cgi?id=2293458 external
https://www.cve.org/CVERecord?id=CVE-2024-38541 external
https://nvd.nist.gov/vuln/detail/CVE-2024-38541 external
https://lore.kernel.org/linux-cve-announce/202406… external
https://access.redhat.com/security/cve/CVE-2024-39500 self
https://bugzilla.redhat.com/show_bug.cgi?id=2297472 external
https://www.cve.org/CVERecord?id=CVE-2024-39500 external
https://nvd.nist.gov/vuln/detail/CVE-2024-39500 external
https://lore.kernel.org/linux-cve-announce/202407… external
https://access.redhat.com/security/cve/CVE-2024-40956 self
https://bugzilla.redhat.com/show_bug.cgi?id=2297540 external
https://www.cve.org/CVERecord?id=CVE-2024-40956 external
https://nvd.nist.gov/vuln/detail/CVE-2024-40956 external
https://lore.kernel.org/linux-cve-announce/202407… external
https://access.redhat.com/security/cve/CVE-2024-41010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2298411 external
https://www.cve.org/CVERecord?id=CVE-2024-41010 external
https://nvd.nist.gov/vuln/detail/CVE-2024-41010 external
https://access.redhat.com/security/cve/CVE-2024-41062 self
https://bugzilla.redhat.com/show_bug.cgi?id=2300437 external
https://www.cve.org/CVERecord?id=CVE-2024-41062 external
https://nvd.nist.gov/vuln/detail/CVE-2024-41062 external
https://lore.kernel.org/linux-cve-announce/202407… external
https://access.redhat.com/security/cve/CVE-2024-42094 self
https://bugzilla.redhat.com/show_bug.cgi?id=2300709 external
https://www.cve.org/CVERecord?id=CVE-2024-42094 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42094 external
https://lore.kernel.org/linux-cve-announce/202407… external
https://access.redhat.com/security/cve/CVE-2024-42133 self
https://bugzilla.redhat.com/show_bug.cgi?id=2301498 external
https://www.cve.org/CVERecord?id=CVE-2024-42133 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42133 external
https://lore.kernel.org/linux-cve-announce/202407… external
https://access.redhat.com/security/cve/CVE-2024-42253 self
https://bugzilla.redhat.com/show_bug.cgi?id=2303634 external
https://www.cve.org/CVERecord?id=CVE-2024-42253 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42253 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42265 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305410 external
https://www.cve.org/CVERecord?id=CVE-2024-42265 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42265 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42278 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305423 external
https://www.cve.org/CVERecord?id=CVE-2024-42278 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42278 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42291 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305436 external
https://www.cve.org/CVERecord?id=CVE-2024-42291 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42291 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42294 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305439 external
https://www.cve.org/CVERecord?id=CVE-2024-42294 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42294 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42302 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305447 external
https://www.cve.org/CVERecord?id=CVE-2024-42302 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42302 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42304 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305449 external
https://www.cve.org/CVERecord?id=CVE-2024-42304 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42304 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42305 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305450 external
https://www.cve.org/CVERecord?id=CVE-2024-42305 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42305 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42312 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305457 external
https://www.cve.org/CVERecord?id=CVE-2024-42312 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42312 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42315 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305460 external
https://www.cve.org/CVERecord?id=CVE-2024-42315 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42315 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42316 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305461 external
https://www.cve.org/CVERecord?id=CVE-2024-42316 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42316 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-42321 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305466 external
https://www.cve.org/CVERecord?id=CVE-2024-42321 external
https://nvd.nist.gov/vuln/detail/CVE-2024-42321 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305478 external
https://www.cve.org/CVERecord?id=CVE-2024-43820 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43820 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43821 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305479 external
https://www.cve.org/CVERecord?id=CVE-2024-43821 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43821 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43823 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305481 external
https://www.cve.org/CVERecord?id=CVE-2024-43823 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43823 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43828 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305486 external
https://www.cve.org/CVERecord?id=CVE-2024-43828 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43828 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43834 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305492 external
https://www.cve.org/CVERecord?id=CVE-2024-43834 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43834 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43846 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305504 external
https://www.cve.org/CVERecord?id=CVE-2024-43846 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43846 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43853 self
https://bugzilla.redhat.com/show_bug.cgi?id=2305511 external
https://www.cve.org/CVERecord?id=CVE-2024-43853 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43853 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2306365 external
https://www.cve.org/CVERecord?id=CVE-2024-43871 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43871 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43873 self
https://bugzilla.redhat.com/show_bug.cgi?id=2306367 external
https://www.cve.org/CVERecord?id=CVE-2024-43873 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43873 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43882 self
https://bugzilla.redhat.com/show_bug.cgi?id=2306376 external
https://www.cve.org/CVERecord?id=CVE-2024-43882 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43882 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43884 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307840 external
https://www.cve.org/CVERecord?id=CVE-2024-43884 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43884 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43889 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307862 external
https://www.cve.org/CVERecord?id=CVE-2024-43889 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43889 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43898 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307871 external
https://www.cve.org/CVERecord?id=CVE-2024-43898 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43898 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43910 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307883 external
https://www.cve.org/CVERecord?id=CVE-2024-43910 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43910 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-43914 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307887 external
https://www.cve.org/CVERecord?id=CVE-2024-43914 external
https://nvd.nist.gov/vuln/detail/CVE-2024-43914 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-44931 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307888 external
https://www.cve.org/CVERecord?id=CVE-2024-44931 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44931 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-44932 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307889 external
https://www.cve.org/CVERecord?id=CVE-2024-44932 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44932 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-44934 self
https://bugzilla.redhat.com/show_bug.cgi?id=2307891 external
https://www.cve.org/CVERecord?id=CVE-2024-44934 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44934 external
https://lore.kernel.org/linux-cve-announce/202408… external
https://access.redhat.com/security/cve/CVE-2024-44952 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309783 external
https://www.cve.org/CVERecord?id=CVE-2024-44952 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44952 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-44958 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309789 external
https://www.cve.org/CVERecord?id=CVE-2024-44958 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44958 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-44964 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309795 external
https://www.cve.org/CVERecord?id=CVE-2024-44964 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44964 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-44975 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309838 external
https://www.cve.org/CVERecord?id=CVE-2024-44975 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44975 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-44987 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309850 external
https://www.cve.org/CVERecord?id=CVE-2024-44987 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44987 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-44989 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309852 external
https://www.cve.org/CVERecord?id=CVE-2024-44989 external
https://nvd.nist.gov/vuln/detail/CVE-2024-44989 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-45000 self
https://bugzilla.redhat.com/show_bug.cgi?id=2309863 external
https://www.cve.org/CVERecord?id=CVE-2024-45000 external
https://nvd.nist.gov/vuln/detail/CVE-2024-45000 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-45009 self
https://bugzilla.redhat.com/show_bug.cgi?id=2311706 external
https://www.cve.org/CVERecord?id=CVE-2024-45009 external
https://nvd.nist.gov/vuln/detail/CVE-2024-45009 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-45010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2311707 external
https://www.cve.org/CVERecord?id=CVE-2024-45010 external
https://nvd.nist.gov/vuln/detail/CVE-2024-45010 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-45016 self
https://bugzilla.redhat.com/show_bug.cgi?id=2311713 external
https://www.cve.org/CVERecord?id=CVE-2024-45016 external
https://nvd.nist.gov/vuln/detail/CVE-2024-45016 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-45022 self
https://bugzilla.redhat.com/show_bug.cgi?id=2311719 external
https://www.cve.org/CVERecord?id=CVE-2024-45022 external
https://nvd.nist.gov/vuln/detail/CVE-2024-45022 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46673 self
https://bugzilla.redhat.com/show_bug.cgi?id=2312061 external
https://www.cve.org/CVERecord?id=CVE-2024-46673 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46673 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46675 self
https://bugzilla.redhat.com/show_bug.cgi?id=2312063 external
https://www.cve.org/CVERecord?id=CVE-2024-46675 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46675 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46711 self
https://bugzilla.redhat.com/show_bug.cgi?id=2312108 external
https://www.cve.org/CVERecord?id=CVE-2024-46711 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46711 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46722 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313053 external
https://www.cve.org/CVERecord?id=CVE-2024-46722 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46722 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46723 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313054 external
https://www.cve.org/CVERecord?id=CVE-2024-46723 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46723 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46724 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313055 external
https://www.cve.org/CVERecord?id=CVE-2024-46724 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46724 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46725 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313056 external
https://www.cve.org/CVERecord?id=CVE-2024-46725 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46725 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46743 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313091 external
https://www.cve.org/CVERecord?id=CVE-2024-46743 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46743 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46745 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313093 external
https://www.cve.org/CVERecord?id=CVE-2024-46745 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46745 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46747 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313095 external
https://www.cve.org/CVERecord?id=CVE-2024-46747 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46747 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46750 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313098 external
https://www.cve.org/CVERecord?id=CVE-2024-46750 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46750 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46754 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313102 external
https://www.cve.org/CVERecord?id=CVE-2024-46754 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46754 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46756 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313104 external
https://www.cve.org/CVERecord?id=CVE-2024-46756 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46756 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46758 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313106 external
https://www.cve.org/CVERecord?id=CVE-2024-46758 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46758 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46759 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313107 external
https://www.cve.org/CVERecord?id=CVE-2024-46759 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46759 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46761 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313109 external
https://www.cve.org/CVERecord?id=CVE-2024-46761 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46761 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46783 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313131 external
https://www.cve.org/CVERecord?id=CVE-2024-46783 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46783 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46786 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313134 external
https://www.cve.org/CVERecord?id=CVE-2024-46786 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46786 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46787 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313135 external
https://www.cve.org/CVERecord?id=CVE-2024-46787 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46787 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46800 self
https://bugzilla.redhat.com/show_bug.cgi?id=2313148 external
https://www.cve.org/CVERecord?id=CVE-2024-46800 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46800 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46805 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315156 external
https://www.cve.org/CVERecord?id=CVE-2024-46805 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46805 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46806 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315157 external
https://www.cve.org/CVERecord?id=CVE-2024-46806 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46806 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46807 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315158 external
https://www.cve.org/CVERecord?id=CVE-2024-46807 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46807 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46819 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315171 external
https://www.cve.org/CVERecord?id=CVE-2024-46819 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46819 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46820 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315172 external
https://www.cve.org/CVERecord?id=CVE-2024-46820 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46820 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315174 external
https://www.cve.org/CVERecord?id=CVE-2024-46822 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46822 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46828 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315180 external
https://www.cve.org/CVERecord?id=CVE-2024-46828 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46828 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46835 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315187 external
https://www.cve.org/CVERecord?id=CVE-2024-46835 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46835 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46839 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315191 external
https://www.cve.org/CVERecord?id=CVE-2024-46839 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46839 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46853 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315205 external
https://www.cve.org/CVERecord?id=CVE-2024-46853 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46853 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46864 self
https://bugzilla.redhat.com/show_bug.cgi?id=2315216 external
https://www.cve.org/CVERecord?id=CVE-2024-46864 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46864 external
https://lore.kernel.org/linux-cve-announce/202409… external
https://access.redhat.com/security/cve/CVE-2024-46871 self
https://bugzilla.redhat.com/show_bug.cgi?id=2317581 external
https://www.cve.org/CVERecord?id=CVE-2024-46871 external
https://nvd.nist.gov/vuln/detail/CVE-2024-46871 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47141 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337328 external
https://www.cve.org/CVERecord?id=CVE-2024-47141 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47141 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-47660 self
https://bugzilla.redhat.com/show_bug.cgi?id=2317584 external
https://www.cve.org/CVERecord?id=CVE-2024-47660 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47660 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47668 self
https://bugzilla.redhat.com/show_bug.cgi?id=2317601 external
https://www.cve.org/CVERecord?id=CVE-2024-47668 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47668 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47678 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320212 external
https://www.cve.org/CVERecord?id=CVE-2024-47678 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47678 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47685 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320268 external
https://www.cve.org/CVERecord?id=CVE-2024-47685 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47685 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47687 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320214 external
https://www.cve.org/CVERecord?id=CVE-2024-47687 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47687 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47692 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320173 external
https://www.cve.org/CVERecord?id=CVE-2024-47692 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47692 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47700 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320274 external
https://www.cve.org/CVERecord?id=CVE-2024-47700 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47700 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47703 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320249 external
https://www.cve.org/CVERecord?id=CVE-2024-47703 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47703 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47705 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320187 external
https://www.cve.org/CVERecord?id=CVE-2024-47705 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47705 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47706 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320238 external
https://www.cve.org/CVERecord?id=CVE-2024-47706 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47706 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47710 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320168 external
https://www.cve.org/CVERecord?id=CVE-2024-47710 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47710 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47713 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320242 external
https://www.cve.org/CVERecord?id=CVE-2024-47713 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47713 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47715 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320225 external
https://www.cve.org/CVERecord?id=CVE-2024-47715 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47715 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47718 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320235 external
https://www.cve.org/CVERecord?id=CVE-2024-47718 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47718 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47719 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320169 external
https://www.cve.org/CVERecord?id=CVE-2024-47719 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47719 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47737 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320239 external
https://www.cve.org/CVERecord?id=CVE-2024-47737 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47737 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47738 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320240 external
https://www.cve.org/CVERecord?id=CVE-2024-47738 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47738 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47739 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320210 external
https://www.cve.org/CVERecord?id=CVE-2024-47739 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47739 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47745 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320248 external
https://www.cve.org/CVERecord?id=CVE-2024-47745 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47745 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-47748 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320245 external
https://www.cve.org/CVERecord?id=CVE-2024-47748 external
https://nvd.nist.gov/vuln/detail/CVE-2024-47748 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-48873 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337104 external
https://www.cve.org/CVERecord?id=CVE-2024-48873 external
https://nvd.nist.gov/vuln/detail/CVE-2024-48873 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-49569 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337136 external
https://www.cve.org/CVERecord?id=CVE-2024-49569 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49569 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-49851 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320246 external
https://www.cve.org/CVERecord?id=CVE-2024-49851 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49851 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49856 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320220 external
https://www.cve.org/CVERecord?id=CVE-2024-49856 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49856 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320200 external
https://www.cve.org/CVERecord?id=CVE-2024-49860 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49860 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49861 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320275 external
https://www.cve.org/CVERecord?id=CVE-2024-49861 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49861 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320209 external
https://www.cve.org/CVERecord?id=CVE-2024-49862 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49862 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49870 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320468 external
https://www.cve.org/CVERecord?id=CVE-2024-49870 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49870 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49875 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320425 external
https://www.cve.org/CVERecord?id=CVE-2024-49875 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49875 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49878 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320527 external
https://www.cve.org/CVERecord?id=CVE-2024-49878 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49878 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49881 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320509 external
https://www.cve.org/CVERecord?id=CVE-2024-49881 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49881 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49882 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320462 external
https://www.cve.org/CVERecord?id=CVE-2024-49882 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49882 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49883 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320501 external
https://www.cve.org/CVERecord?id=CVE-2024-49883 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49883 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49884 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320573 external
https://www.cve.org/CVERecord?id=CVE-2024-49884 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49884 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49885 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320484 external
https://www.cve.org/CVERecord?id=CVE-2024-49885 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49885 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49886 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320488 external
https://www.cve.org/CVERecord?id=CVE-2024-49886 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49886 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49889 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320520 external
https://www.cve.org/CVERecord?id=CVE-2024-49889 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49889 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49904 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320489 external
https://www.cve.org/CVERecord?id=CVE-2024-49904 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49904 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49927 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320572 external
https://www.cve.org/CVERecord?id=CVE-2024-49927 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49927 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49928 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320543 external
https://www.cve.org/CVERecord?id=CVE-2024-49928 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49928 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49929 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320497 external
https://www.cve.org/CVERecord?id=CVE-2024-49929 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49929 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49930 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320529 external
https://www.cve.org/CVERecord?id=CVE-2024-49930 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49930 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49933 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320577 external
https://www.cve.org/CVERecord?id=CVE-2024-49933 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49933 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49934 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320547 external
https://www.cve.org/CVERecord?id=CVE-2024-49934 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49934 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49935 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320570 external
https://www.cve.org/CVERecord?id=CVE-2024-49935 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49935 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49937 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320515 external
https://www.cve.org/CVERecord?id=CVE-2024-49937 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49937 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49938 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320510 external
https://www.cve.org/CVERecord?id=CVE-2024-49938 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49938 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49939 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320562 external
https://www.cve.org/CVERecord?id=CVE-2024-49939 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49939 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49946 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320471 external
https://www.cve.org/CVERecord?id=CVE-2024-49946 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49946 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49948 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320552 external
https://www.cve.org/CVERecord?id=CVE-2024-49948 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49948 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49950 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320459 external
https://www.cve.org/CVERecord?id=CVE-2024-49950 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49950 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49951 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320563 external
https://www.cve.org/CVERecord?id=CVE-2024-49951 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49951 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49954 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320546 external
https://www.cve.org/CVERecord?id=CVE-2024-49954 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49954 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49959 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320550 external
https://www.cve.org/CVERecord?id=CVE-2024-49959 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49959 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49960 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320502 external
https://www.cve.org/CVERecord?id=CVE-2024-49960 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49960 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49962 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320557 external
https://www.cve.org/CVERecord?id=CVE-2024-49962 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49962 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49967 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320549 external
https://www.cve.org/CVERecord?id=CVE-2024-49967 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49967 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49968 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320475 external
https://www.cve.org/CVERecord?id=CVE-2024-49968 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49968 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49971 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320565 external
https://www.cve.org/CVERecord?id=CVE-2024-49971 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49971 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49973 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320541 external
https://www.cve.org/CVERecord?id=CVE-2024-49973 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49973 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49974 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320559 external
https://www.cve.org/CVERecord?id=CVE-2024-49974 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49974 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49975 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320500 external
https://www.cve.org/CVERecord?id=CVE-2024-49975 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49975 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49977 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320574 external
https://www.cve.org/CVERecord?id=CVE-2024-49977 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49977 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49983 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320503 external
https://www.cve.org/CVERecord?id=CVE-2024-49983 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49983 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49991 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320486 external
https://www.cve.org/CVERecord?id=CVE-2024-49991 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49991 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49993 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320432 external
https://www.cve.org/CVERecord?id=CVE-2024-49993 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49993 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49994 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320554 external
https://www.cve.org/CVERecord?id=CVE-2024-49994 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49994 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49995 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320443 external
https://www.cve.org/CVERecord?id=CVE-2024-49995 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49995 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-49999 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320556 external
https://www.cve.org/CVERecord?id=CVE-2024-49999 external
https://nvd.nist.gov/vuln/detail/CVE-2024-49999 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50002 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320571 external
https://www.cve.org/CVERecord?id=CVE-2024-50002 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50002 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50006 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320544 external
https://www.cve.org/CVERecord?id=CVE-2024-50006 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50006 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50008 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320576 external
https://www.cve.org/CVERecord?id=CVE-2024-50008 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50008 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50009 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320506 external
https://www.cve.org/CVERecord?id=CVE-2024-50009 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50009 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50013 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320454 external
https://www.cve.org/CVERecord?id=CVE-2024-50013 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50013 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50014 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320481 external
https://www.cve.org/CVERecord?id=CVE-2024-50014 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50014 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50015 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320531 external
https://www.cve.org/CVERecord?id=CVE-2024-50015 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50015 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50018 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320480 external
https://www.cve.org/CVERecord?id=CVE-2024-50018 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50018 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50019 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320625 external
https://www.cve.org/CVERecord?id=CVE-2024-50019 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50019 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50022 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320598 external
https://www.cve.org/CVERecord?id=CVE-2024-50022 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50022 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50023 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320629 external
https://www.cve.org/CVERecord?id=CVE-2024-50023 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50023 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50024 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320611 external
https://www.cve.org/CVERecord?id=CVE-2024-50024 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50024 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50027 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320635 external
https://www.cve.org/CVERecord?id=CVE-2024-50027 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50027 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50028 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320610 external
https://www.cve.org/CVERecord?id=CVE-2024-50028 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50028 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50029 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320596 external
https://www.cve.org/CVERecord?id=CVE-2024-50029 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50029 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50033 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320589 external
https://www.cve.org/CVERecord?id=CVE-2024-50033 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50033 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50035 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320636 external
https://www.cve.org/CVERecord?id=CVE-2024-50035 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50035 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50038 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320587 external
https://www.cve.org/CVERecord?id=CVE-2024-50038 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50038 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50039 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320620 external
https://www.cve.org/CVERecord?id=CVE-2024-50039 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50039 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50044 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320594 external
https://www.cve.org/CVERecord?id=CVE-2024-50044 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50044 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50046 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320602 external
https://www.cve.org/CVERecord?id=CVE-2024-50046 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50046 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50047 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320586 external
https://www.cve.org/CVERecord?id=CVE-2024-50047 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50047 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50055 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320615 external
https://www.cve.org/CVERecord?id=CVE-2024-50055 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50055 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50057 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320601 external
https://www.cve.org/CVERecord?id=CVE-2024-50057 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50057 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50058 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320612 external
https://www.cve.org/CVERecord?id=CVE-2024-50058 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50058 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50064 self
https://bugzilla.redhat.com/show_bug.cgi?id=2320590 external
https://www.cve.org/CVERecord?id=CVE-2024-50064 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50064 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50067 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322072 external
https://www.cve.org/CVERecord?id=CVE-2024-50067 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50067 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50073 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322312 external
https://www.cve.org/CVERecord?id=CVE-2024-50073 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50073 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50074 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322310 external
https://www.cve.org/CVERecord?id=CVE-2024-50074 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50074 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50075 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322320 external
https://www.cve.org/CVERecord?id=CVE-2024-50075 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50075 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50077 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322303 external
https://www.cve.org/CVERecord?id=CVE-2024-50077 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50077 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50078 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322323 external
https://www.cve.org/CVERecord?id=CVE-2024-50078 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50078 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50081 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322316 external
https://www.cve.org/CVERecord?id=CVE-2024-50081 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50081 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50082 self
https://bugzilla.redhat.com/show_bug.cgi?id=2322308 external
https://www.cve.org/CVERecord?id=CVE-2024-50082 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50082 external
https://lore.kernel.org/linux-cve-announce/202410… external
https://access.redhat.com/security/cve/CVE-2024-50093 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323947 external
https://www.cve.org/CVERecord?id=CVE-2024-50093 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50093 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50101 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323950 external
https://www.cve.org/CVERecord?id=CVE-2024-50101 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50101 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50102 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323929 external
https://www.cve.org/CVERecord?id=CVE-2024-50102 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50102 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50106 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323945 external
https://www.cve.org/CVERecord?id=CVE-2024-50106 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50106 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50107 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323938 external
https://www.cve.org/CVERecord?id=CVE-2024-50107 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50107 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50109 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323909 external
https://www.cve.org/CVERecord?id=CVE-2024-50109 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50109 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50117 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323932 external
https://www.cve.org/CVERecord?id=CVE-2024-50117 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50117 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50120 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323933 external
https://www.cve.org/CVERecord?id=CVE-2024-50120 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50120 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323905 external
https://www.cve.org/CVERecord?id=CVE-2024-50121 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50121 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50126 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323924 external
https://www.cve.org/CVERecord?id=CVE-2024-50126 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50126 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50127 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323927 external
https://www.cve.org/CVERecord?id=CVE-2024-50127 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50127 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50128 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323918 external
https://www.cve.org/CVERecord?id=CVE-2024-50128 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50128 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50130 self
https://bugzilla.redhat.com/show_bug.cgi?id=2323953 external
https://www.cve.org/CVERecord?id=CVE-2024-50130 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50130 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50141 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324413 external
https://www.cve.org/CVERecord?id=CVE-2024-50141 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50141 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50143 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324320 external
https://www.cve.org/CVERecord?id=CVE-2024-50143 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50143 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50150 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324419 external
https://www.cve.org/CVERecord?id=CVE-2024-50150 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50150 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50151 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324324 external
https://www.cve.org/CVERecord?id=CVE-2024-50151 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50151 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324423 external
https://www.cve.org/CVERecord?id=CVE-2024-50152 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50152 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50153 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324321 external
https://www.cve.org/CVERecord?id=CVE-2024-50153 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50153 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50162 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324317 external
https://www.cve.org/CVERecord?id=CVE-2024-50162 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50162 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50163 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324325 external
https://www.cve.org/CVERecord?id=CVE-2024-50163 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50163 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50169 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324410 external
https://www.cve.org/CVERecord?id=CVE-2024-50169 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50169 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50182 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324650 external
https://www.cve.org/CVERecord?id=CVE-2024-50182 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50182 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50186 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324599 external
https://www.cve.org/CVERecord?id=CVE-2024-50186 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50186 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50189 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324610 external
https://www.cve.org/CVERecord?id=CVE-2024-50189 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50189 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50191 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324548 external
https://www.cve.org/CVERecord?id=CVE-2024-50191 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50191 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50197 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324578 external
https://www.cve.org/CVERecord?id=CVE-2024-50197 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50197 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2024-50199 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324645 external
https://www.cve.org/CVERecord?id=CVE-2024-50199 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50199 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2024-50200 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324566 external
https://www.cve.org/CVERecord?id=CVE-2024-50200 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50200 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2024-50201 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324617 external
https://www.cve.org/CVERecord?id=CVE-2024-50201 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50201 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50215 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324875 external
https://www.cve.org/CVERecord?id=CVE-2024-50215 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50215 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50216 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324899 external
https://www.cve.org/CVERecord?id=CVE-2024-50216 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50216 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50219 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324865 external
https://www.cve.org/CVERecord?id=CVE-2024-50219 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50219 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50228 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324869 external
https://www.cve.org/CVERecord?id=CVE-2024-50228 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50228 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50235 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324874 external
https://www.cve.org/CVERecord?id=CVE-2024-50235 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50235 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50236 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324853 external
https://www.cve.org/CVERecord?id=CVE-2024-50236 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50236 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50237 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324897 external
https://www.cve.org/CVERecord?id=CVE-2024-50237 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50237 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50256 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324889 external
https://www.cve.org/CVERecord?id=CVE-2024-50256 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50256 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50261 self
https://bugzilla.redhat.com/show_bug.cgi?id=2324901 external
https://www.cve.org/CVERecord?id=CVE-2024-50261 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50261 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50271 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327174 external
https://www.cve.org/CVERecord?id=CVE-2024-50271 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50271 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50272 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327189 external
https://www.cve.org/CVERecord?id=CVE-2024-50272 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50272 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50278 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327182 external
https://www.cve.org/CVERecord?id=CVE-2024-50278 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50278 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50282 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327190 external
https://www.cve.org/CVERecord?id=CVE-2024-50282 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50282 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50299 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327194 external
https://www.cve.org/CVERecord?id=CVE-2024-50299 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50299 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-50304 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327361 external
https://www.cve.org/CVERecord?id=CVE-2024-50304 external
https://nvd.nist.gov/vuln/detail/CVE-2024-50304 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53042 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327343 external
https://www.cve.org/CVERecord?id=CVE-2024-53042 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53042 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53044 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327381 external
https://www.cve.org/CVERecord?id=CVE-2024-53044 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53044 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53047 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327369 external
https://www.cve.org/CVERecord?id=CVE-2024-53047 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53047 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53050 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327362 external
https://www.cve.org/CVERecord?id=CVE-2024-53050 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53050 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53051 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327365 external
https://www.cve.org/CVERecord?id=CVE-2024-53051 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53051 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53055 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327349 external
https://www.cve.org/CVERecord?id=CVE-2024-53055 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53055 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53057 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327344 external
https://www.cve.org/CVERecord?id=CVE-2024-53057 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53057 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53059 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327383 external
https://www.cve.org/CVERecord?id=CVE-2024-53059 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53059 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53060 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327335 external
https://www.cve.org/CVERecord?id=CVE-2024-53060 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53060 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53070 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327332 external
https://www.cve.org/CVERecord?id=CVE-2024-53070 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53070 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53072 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327370 external
https://www.cve.org/CVERecord?id=CVE-2024-53072 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53072 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53074 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327373 external
https://www.cve.org/CVERecord?id=CVE-2024-53074 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53074 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53082 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327338 external
https://www.cve.org/CVERecord?id=CVE-2024-53082 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53082 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53085 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327358 external
https://www.cve.org/CVERecord?id=CVE-2024-53085 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53085 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53091 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327893 external
https://www.cve.org/CVERecord?id=CVE-2024-53091 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53091 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53093 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327890 external
https://www.cve.org/CVERecord?id=CVE-2024-53093 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53093 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53095 self
https://bugzilla.redhat.com/show_bug.cgi?id=2327888 external
https://www.cve.org/CVERecord?id=CVE-2024-53095 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53095 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53096 self
https://bugzilla.redhat.com/show_bug.cgi?id=2328791 external
https://www.cve.org/CVERecord?id=CVE-2024-53096 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53096 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53097 self
https://bugzilla.redhat.com/show_bug.cgi?id=2328792 external
https://www.cve.org/CVERecord?id=CVE-2024-53097 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53097 external
https://lore.kernel.org/linux-cve-announce/202411… external
https://access.redhat.com/security/cve/CVE-2024-53103 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329818 external
https://www.cve.org/CVERecord?id=CVE-2024-53103 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53103 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53105 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329929 external
https://www.cve.org/CVERecord?id=CVE-2024-53105 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53105 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53110 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329937 external
https://www.cve.org/CVERecord?id=CVE-2024-53110 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53110 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53117 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329935 external
https://www.cve.org/CVERecord?id=CVE-2024-53117 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53117 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53118 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329919 external
https://www.cve.org/CVERecord?id=CVE-2024-53118 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53118 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53120 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329930 external
https://www.cve.org/CVERecord?id=CVE-2024-53120 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53120 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329936 external
https://www.cve.org/CVERecord?id=CVE-2024-53121 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53121 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53123 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329927 external
https://www.cve.org/CVERecord?id=CVE-2024-53123 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53123 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53124 self
https://bugzilla.redhat.com/show_bug.cgi?id=2329928 external
https://www.cve.org/CVERecord?id=CVE-2024-53124 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53124 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53134 self
https://bugzilla.redhat.com/show_bug.cgi?id=2330357 external
https://www.cve.org/CVERecord?id=CVE-2024-53134 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53134 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53136 self
https://bugzilla.redhat.com/show_bug.cgi?id=2330346 external
https://www.cve.org/CVERecord?id=CVE-2024-53136 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53136 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53141 self
https://bugzilla.redhat.com/show_bug.cgi?id=2330763 external
https://www.cve.org/CVERecord?id=CVE-2024-53141 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53141 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53142 self
https://bugzilla.redhat.com/show_bug.cgi?id=2330765 external
https://www.cve.org/CVERecord?id=CVE-2024-53142 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53142 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53146 self
https://bugzilla.redhat.com/show_bug.cgi?id=2333973 external
https://www.cve.org/CVERecord?id=CVE-2024-53146 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53146 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53152 self
https://bugzilla.redhat.com/show_bug.cgi?id=2333974 external
https://www.cve.org/CVERecord?id=CVE-2024-53152 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53152 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53156 self
https://bugzilla.redhat.com/show_bug.cgi?id=2333976 external
https://www.cve.org/CVERecord?id=CVE-2024-53156 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53156 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53160 self
https://bugzilla.redhat.com/show_bug.cgi?id=2333982 external
https://www.cve.org/CVERecord?id=CVE-2024-53160 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53160 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53161 self
https://bugzilla.redhat.com/show_bug.cgi?id=2333977 external
https://www.cve.org/CVERecord?id=CVE-2024-53161 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53161 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53164 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334350 external
https://www.cve.org/CVERecord?id=CVE-2024-53164 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53164 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53166 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334384 external
https://www.cve.org/CVERecord?id=CVE-2024-53166 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53166 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53173 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334398 external
https://www.cve.org/CVERecord?id=CVE-2024-53173 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53173 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53174 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334419 external
https://www.cve.org/CVERecord?id=CVE-2024-53174 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53174 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53176 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334355 external
https://www.cve.org/CVERecord?id=CVE-2024-53176 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53176 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53190 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334408 external
https://www.cve.org/CVERecord?id=CVE-2024-53190 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53190 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53194 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334367 external
https://www.cve.org/CVERecord?id=CVE-2024-53194 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53194 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53203 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334409 external
https://www.cve.org/CVERecord?id=CVE-2024-53203 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53203 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53208 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334392 external
https://www.cve.org/CVERecord?id=CVE-2024-53208 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53208 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53213 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334388 external
https://www.cve.org/CVERecord?id=CVE-2024-53213 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53213 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53216 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334415 external
https://www.cve.org/CVERecord?id=CVE-2024-53216 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53216 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53222 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334373 external
https://www.cve.org/CVERecord?id=CVE-2024-53222 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53222 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53224 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334399 external
https://www.cve.org/CVERecord?id=CVE-2024-53224 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53224 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53232 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334410 external
https://www.cve.org/CVERecord?id=CVE-2024-53232 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53232 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53237 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334386 external
https://www.cve.org/CVERecord?id=CVE-2024-53237 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53237 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-53681 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338214 external
https://www.cve.org/CVERecord?id=CVE-2024-53681 external
https://nvd.nist.gov/vuln/detail/CVE-2024-53681 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-54460 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337117 external
https://www.cve.org/CVERecord?id=CVE-2024-54460 external
https://nvd.nist.gov/vuln/detail/CVE-2024-54460 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-54680 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337118 external
https://www.cve.org/CVERecord?id=CVE-2024-54680 external
https://nvd.nist.gov/vuln/detail/CVE-2024-54680 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-56535 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334441 external
https://www.cve.org/CVERecord?id=CVE-2024-56535 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56535 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56544 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334428 external
https://www.cve.org/CVERecord?id=CVE-2024-56544 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56544 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56551 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334479 external
https://www.cve.org/CVERecord?id=CVE-2024-56551 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56551 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56558 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334575 external
https://www.cve.org/CVERecord?id=CVE-2024-56558 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56558 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56562 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334430 external
https://www.cve.org/CVERecord?id=CVE-2024-56562 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56562 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56566 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334463 external
https://www.cve.org/CVERecord?id=CVE-2024-56566 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56566 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56570 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334469 external
https://www.cve.org/CVERecord?id=CVE-2024-56570 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56570 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56590 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334486 external
https://www.cve.org/CVERecord?id=CVE-2024-56590 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56590 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56591 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334426 external
https://www.cve.org/CVERecord?id=CVE-2024-56591 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56591 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56600 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334458 external
https://www.cve.org/CVERecord?id=CVE-2024-56600 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56600 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56601 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334472 external
https://www.cve.org/CVERecord?id=CVE-2024-56601 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56601 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56602 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334501 external
https://www.cve.org/CVERecord?id=CVE-2024-56602 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56602 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56604 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334495 external
https://www.cve.org/CVERecord?id=CVE-2024-56604 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56604 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56605 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334503 external
https://www.cve.org/CVERecord?id=CVE-2024-56605 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56605 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56611 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334432 external
https://www.cve.org/CVERecord?id=CVE-2024-56611 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56611 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56614 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334573 external
https://www.cve.org/CVERecord?id=CVE-2024-56614 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56614 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56616 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334483 external
https://www.cve.org/CVERecord?id=CVE-2024-56616 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56616 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56623 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334461 external
https://www.cve.org/CVERecord?id=CVE-2024-56623 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56623 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56631 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334528 external
https://www.cve.org/CVERecord?id=CVE-2024-56631 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56631 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56642 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334562 external
https://www.cve.org/CVERecord?id=CVE-2024-56642 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56642 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56644 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334551 external
https://www.cve.org/CVERecord?id=CVE-2024-56644 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56644 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56647 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334561 external
https://www.cve.org/CVERecord?id=CVE-2024-56647 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56647 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56653 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334538 external
https://www.cve.org/CVERecord?id=CVE-2024-56653 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56653 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56654 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334563 external
https://www.cve.org/CVERecord?id=CVE-2024-56654 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56654 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56663 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334539 external
https://www.cve.org/CVERecord?id=CVE-2024-56663 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56663 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56664 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334577 external
https://www.cve.org/CVERecord?id=CVE-2024-56664 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56664 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56667 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334542 external
https://www.cve.org/CVERecord?id=CVE-2024-56667 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56667 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56688 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334667 external
https://www.cve.org/CVERecord?id=CVE-2024-56688 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56688 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56693 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334683 external
https://www.cve.org/CVERecord?id=CVE-2024-56693 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56693 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56729 self
https://bugzilla.redhat.com/show_bug.cgi?id=2334809 external
https://www.cve.org/CVERecord?id=CVE-2024-56729 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56729 external
https://lore.kernel.org/linux-cve-announce/202412… external
https://access.redhat.com/security/cve/CVE-2024-56757 self
https://bugzilla.redhat.com/show_bug.cgi?id=2335899 external
https://www.cve.org/CVERecord?id=CVE-2024-56757 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56757 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-56760 self
https://bugzilla.redhat.com/show_bug.cgi?id=2335906 external
https://www.cve.org/CVERecord?id=CVE-2024-56760 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56760 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-56779 self
https://bugzilla.redhat.com/show_bug.cgi?id=2336550 external
https://www.cve.org/CVERecord?id=CVE-2024-56779 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56779 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-56783 self
https://bugzilla.redhat.com/show_bug.cgi?id=2336546 external
https://www.cve.org/CVERecord?id=CVE-2024-56783 external
https://nvd.nist.gov/vuln/detail/CVE-2024-56783 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57798 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337113 external
https://www.cve.org/CVERecord?id=CVE-2024-57798 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57798 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57809 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337333 external
https://www.cve.org/CVERecord?id=CVE-2024-57809 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57809 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57843 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337148 external
https://www.cve.org/CVERecord?id=CVE-2024-57843 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57843 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57852 self
https://bugzilla.redhat.com/show_bug.cgi?id=2348530 external
https://www.cve.org/CVERecord?id=CVE-2024-57852 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57852 external
https://lore.kernel.org/linux-cve-announce/202502… external
https://access.redhat.com/security/cve/CVE-2024-57879 self
https://bugzilla.redhat.com/show_bug.cgi?id=2337152 external
https://www.cve.org/CVERecord?id=CVE-2024-57879 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57879 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57884 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338199 external
https://www.cve.org/CVERecord?id=CVE-2024-57884 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57884 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57885 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338198 external
https://www.cve.org/CVERecord?id=CVE-2024-57885 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57885 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57888 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338197 external
https://www.cve.org/CVERecord?id=CVE-2024-57888 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57888 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57890 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338208 external
https://www.cve.org/CVERecord?id=CVE-2024-57890 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57890 external
https://git.kernel.org/stable/c/b92667f755749cf10… external
https://git.kernel.org/stable/c/c2f961c46ea0e5274… external
https://git.kernel.org/stable/c/d0257e089d1bbd35c… external
https://access.redhat.com/security/cve/CVE-2024-57894 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338195 external
https://www.cve.org/CVERecord?id=CVE-2024-57894 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57894 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57898 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338204 external
https://www.cve.org/CVERecord?id=CVE-2024-57898 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57898 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57903 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338190 external
https://www.cve.org/CVERecord?id=CVE-2024-57903 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57903 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57929 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338858 external
https://www.cve.org/CVERecord?id=CVE-2024-57929 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57929 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57931 self
https://bugzilla.redhat.com/show_bug.cgi?id=2339140 external
https://www.cve.org/CVERecord?id=CVE-2024-57931 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57931 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-57940 self
https://bugzilla.redhat.com/show_bug.cgi?id=2339126 external
https://www.cve.org/CVERecord?id=CVE-2024-57940 external
https://nvd.nist.gov/vuln/detail/CVE-2024-57940 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2024-58009 self
https://bugzilla.redhat.com/show_bug.cgi?id=2348526 external
https://www.cve.org/CVERecord?id=CVE-2024-58009 external
https://nvd.nist.gov/vuln/detail/CVE-2024-58009 external
https://lore.kernel.org/linux-cve-announce/202502… external
https://access.redhat.com/security/cve/CVE-2024-58064 self
https://bugzilla.redhat.com/show_bug.cgi?id=2350354 external
https://www.cve.org/CVERecord?id=CVE-2024-58064 external
https://nvd.nist.gov/vuln/detail/CVE-2024-58064 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2024-58099 self
https://bugzilla.redhat.com/show_bug.cgi?id=2362882 external
https://www.cve.org/CVERecord?id=CVE-2024-58099 external
https://nvd.nist.gov/vuln/detail/CVE-2024-58099 external
https://lore.kernel.org/linux-cve-announce/202504… external
https://access.redhat.com/security/cve/CVE-2025-1272 self
https://bugzilla.redhat.com/show_bug.cgi?id=2345615 external
https://www.cve.org/CVERecord?id=CVE-2025-1272 external
https://nvd.nist.gov/vuln/detail/CVE-2025-1272 external
https://access.redhat.com/security/cve/CVE-2025-21646 self
https://bugzilla.redhat.com/show_bug.cgi?id=2338830 external
https://www.cve.org/CVERecord?id=CVE-2025-21646 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21646 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2025-21663 self
https://bugzilla.redhat.com/show_bug.cgi?id=2339143 external
https://www.cve.org/CVERecord?id=CVE-2025-21663 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21663 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2025-21666 self
https://bugzilla.redhat.com/show_bug.cgi?id=2343173 external
https://www.cve.org/CVERecord?id=CVE-2025-21666 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21666 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2025-21668 self
https://bugzilla.redhat.com/show_bug.cgi?id=2343183 external
https://www.cve.org/CVERecord?id=CVE-2025-21668 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21668 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2025-21669 self
https://bugzilla.redhat.com/show_bug.cgi?id=2343169 external
https://www.cve.org/CVERecord?id=CVE-2025-21669 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21669 external
https://lore.kernel.org/linux-cve-announce/202501… external
https://access.redhat.com/security/cve/CVE-2025-21689 self
https://bugzilla.redhat.com/show_bug.cgi?id=2344683 external
https://www.cve.org/CVERecord?id=CVE-2025-21689 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21689 external
https://lore.kernel.org/linux-cve-announce/202502… external
https://access.redhat.com/security/cve/CVE-2025-21694 self
https://bugzilla.redhat.com/show_bug.cgi?id=2345243 external
https://www.cve.org/CVERecord?id=CVE-2025-21694 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21694 external
https://git.kernel.org/stable/c/649b266606bc41340… external
https://git.kernel.org/stable/c/65c367bd9d4f43513… external
https://git.kernel.org/stable/c/80828540dad0757b6… external
https://git.kernel.org/stable/c/80da29deb88a3a907… external
https://git.kernel.org/stable/c/84c4ed15626574c9a… external
https://git.kernel.org/stable/c/a5a2ee8144c3897d3… external
https://git.kernel.org/stable/c/cbc5dde0a46124004… external
https://access.redhat.com/security/cve/CVE-2025-21888 self
https://bugzilla.redhat.com/show_bug.cgi?id=2355410 external
https://www.cve.org/CVERecord?id=CVE-2025-21888 external
https://nvd.nist.gov/vuln/detail/CVE-2025-21888 external
https://lore.kernel.org/linux-cve-announce/202503… external
https://access.redhat.com/security/cve/CVE-2025-22087 self
https://bugzilla.redhat.com/show_bug.cgi?id=2360217 external
https://www.cve.org/CVERecord?id=CVE-2025-22087 external
https://nvd.nist.gov/vuln/detail/CVE-2025-22087 external
https://lore.kernel.org/linux-cve-announce/202504… external
https://access.redhat.com/security/cve/CVE-2025-68179 self
https://bugzilla.redhat.com/show_bug.cgi?id=2422662 external
https://www.cve.org/CVERecord?id=CVE-2025-68179 external
https://nvd.nist.gov/vuln/detail/CVE-2025-68179 external
https://lore.kernel.org/linux-cve-announce/202512… external
https://access.redhat.com/security/cve/CVE-2025-71151 self
https://bugzilla.redhat.com/show_bug.cgi?id=2432362 external
https://www.cve.org/CVERecord?id=CVE-2025-71151 external
https://nvd.nist.gov/vuln/detail/CVE-2025-71151 external
https://lore.kernel.org/linux-cve-announce/202601… external
Acknowledgments
ANSSI – French Cybersecurity Agency Nicolas Bouchinet
To clipboard 

Loading 34.9 MB of JSON…



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.