Vulnerability-Lookup

RHSA-2024:4211

Vulnerability from csaf_redhat - Published: 2024-07-02 09:02 - Updated: 2026-09-10 12:49

Summary

Red Hat Security Advisory: kernel security and bug fix update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [Updated 03 July 2024] The text of this advisory has been updated with the correct product name (Red Hat Enterprise Linux 8) in the Topics section. In the Problem Description section, CVEs of the same sub-components have been grouped together. The packages included in this revised update have not been changed in any way from the packages included in the original advisory.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number (CVE-2023-52881,RHV-2024-1001) * kernel: ovl: fix leaked entry (CVE-2021-46972) * kernel: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (CVE-2021-47073) * kernel: gro: fix ownership transfer (CVE-2024-35890) * kernel: tls: (CVE-2024-26584, CVE-2024-26583, CVE-2024-26585) * kernel: wifi: (CVE-2024-35789, CVE-2024-27410, CVE-2024-35838, CVE-2024-35845) * kernel: mlxsw: (CVE-2024-35855, CVE-2024-35854, CVE-2024-35853, CVE-2024-35852, CVE-2024-36007) * kernel: PCI interrupt mapping cause oops [rhel-8] (CVE-2021-46909) * kernel: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVE-2021-47069) * kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng [rhel-8] (CVE-2023-52615) * kernel: net/mlx5e: (CVE-2023-52626, CVE-2024-35835, CVE-2023-52667, CVE-2024-35959) * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset [rhel-8] (CVE-2024-26801) * kernel: Squashfs: check the inode number is not the invalid value of zero (CVE-2024-26982) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout [rhel-8.10] (CVE-2024-27397) * kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() (CVE-2023-52560) * kernel: ppp_async: limit MRU to 64K (CVE-2024-26675) * kernel: x86/mm/swap: (CVE-2024-26759, CVE-2024-26906) * kernel: tipc: fix kernel warning when sending SYN message [rhel-8] (CVE-2023-52700) * kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVE-2024-26907) * kernel: erspan: make sure erspan_base_hdr is present in skb->head (CVE-2024-35888) * kernel: powerpc/imc-pmu/powernv: (CVE-2023-52675, CVE-2023-52686) * kernel: KVM: SVM: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs (CVE-2023-5090) * kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c (CVE-2023-52464) * kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref (CVE-2024-26735) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: crypto: (CVE-2024-26974, CVE-2023-52669, CVE-2023-52813) * kernel: net/mlx5/bnx2x/usb: (CVE-2024-35960, CVE-2024-35958, CVE-2021-47310, CVE-2024-26804, CVE-2021-47311, CVE-2024-26859, CVE-2021-47236, CVE-2023-52703) * kernel: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (CVE-2024-36004) * kernel: perf/core: Bail out early if the request AUX area is out of bound (CVE-2023-52835) * kernel: USB/usbnet: (CVE-2023-52781, CVE-2023-52877, CVE-2021-47495) * kernel: can: (CVE-2023-52878, CVE-2021-47456) * kernel: mISDN: fix possible use-after-free in HFC_cleanup() (CVE-2021-47356) * kernel: udf: Fix NULL pointer dereference in udf_symlink function (CVE-2021-47353) Bug Fix(es): * Kernel panic - kernel BUG at mm/slub.c:376! (JIRA:RHEL-29783) * Temporary values in FIPS integrity test should be zeroized [rhel-8.10.z] (JIRA:RHEL-35361) * RHEL8.6 - kernel: s390/cpum_cf: make crypto counters upward compatible (JIRA:RHEL-36048) * [RHEL8] blktests block/024 failed (JIRA:RHEL-8130) * RHEL8.9: EEH injections results Error: Power fault on Port 0 and other call traces(Everest/1050/Shiner) (JIRA:RHEL-14195) * Latency spikes with Matrox G200 graphic cards (JIRA:RHEL-36172) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2020-26555

A vulnerability was found in Linux Kernel, where Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack. When an attacker connects to a victim device using the address of the device and the victim initiates a Pairing, the attacker can reflect the encrypted nonce even without knowledge of the key.

5.4 (Medium)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 120 products

Product	Version	Remediation
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-0:4.18.0-553.8.1.el8_10.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-abi-stablelists-0:4.18.0-553.8.1.el8_10.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-core-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-core-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-core-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-core-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-core-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-core-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-core-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-core-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-devel-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-devel-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-devel-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-devel-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-devel-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-devel-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-devel-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-devel-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-doc-0:4.18.0-553.8.1.el8_10.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-extra-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-extra-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-extra-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-modules-extra-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-libs-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-libs-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-tools-libs-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:bpftool-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:perf-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-8.10.0.Z.MAIN.EUS:python3-perf-debuginfo-0:4.18.0-553.8.1.el8_10.x86_64	—	Vendor Fix fix Workaround

Known not affected 8 products

Product	Version	Remediation
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-cross-headers-0:4.18.0-553.8.1.el8_10.aarch64	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-cross-headers-0:4.18.0-553.8.1.el8_10.ppc64le	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-cross-headers-0:4.18.0-553.8.1.el8_10.s390x	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-cross-headers-0:4.18.0-553.8.1.el8_10.x86_64	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-headers-0:4.18.0-553.8.1.el8_10.aarch64	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-headers-0:4.18.0-553.8.1.el8_10.ppc64le	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-headers-0:4.18.0-553.8.1.el8_10.s390x	—	Workaround
Unresolved product id: BaseOS-8.10.0.Z.MAIN.EUS:kernel-headers-0:4.18.0-553.8.1.el8_10.x86_64	—	Workaround

Threats

Impact Moderate

CVE-2021-46909

A denial of service flaw was found in the ARM footbridge in the Linux Kernel. This issue may cause an oops if a PCI driver is loaded or bound after the kernel has initialized.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-391 - Unchecked Error Condition

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2021-46972

In the Linux kernel, the following vulnerability has been resolved: ovl: fix leaked dentry Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a metacopy error, which leads to dentry leaks when shutting down the related superblock: overlayfs: refusing to follow metacopy origin for (/file0) ... BUG: Dentry (____ptrval____){i=3f33,n=file3} still in use (1) [unmount of overlay overlay] ... WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1 ... RIP: 0010:umount_check.cold+0x107/0x14d ... Call Trace: d_walk+0x28c/0x950 ? dentry_lru_isolate+0x2b0/0x2b0 ? __kasan_slab_free+0x12/0x20 do_one_tree+0x33/0x60 shrink_dcache_for_umount+0x78/0x1d0 generic_shutdown_super+0x70/0x440 kill_anon_super+0x3e/0x70 deactivate_locked_super+0xc4/0x160 deactivate_super+0xfa/0x140 cleanup_mnt+0x22e/0x370 __cleanup_mnt+0x1a/0x30 task_work_run+0x139/0x210 do_exit+0xb0c/0x2820 ? __kasan_check_read+0x1d/0x30 ? find_held_lock+0x35/0x160 ? lock_release+0x1b6/0x660 ? mm_update_next_owner+0xa20/0xa20 ? reacquire_held_locks+0x3f0/0x3f0 ? __sanitizer_cov_trace_const_cmp4+0x22/0x30 do_group_exit+0x135/0x380 __do_sys_exit_group.isra.0+0x20/0x20 __x64_sys_exit_group+0x3c/0x50 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae ... VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds. Have a nice day... This fix has been tested with a syzkaller reproducer.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2021-47069

A flaw was found in the Linux kernel’s IPC system. This flaw allows an attacker to use a specially crafted program to cause a rare race condition, leading to a denial of service.

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2021-47073

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios init_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems where the Dell WMI interface is supported. While exit_dell_smbios_wmi() unregisters it unconditionally, this leads to the following oops: [ 175.722921] ------------[ cut here ]------------ [ 175.722925] Unexpected driver unregister! [ 175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40 ... [ 175.723089] Call Trace: [ 175.723094] cleanup_module+0x5/0xedd [dell_smbios] ... [ 175.723148] ---[ end trace 064c34e1ad49509d ]--- Make the unregister happen on the same condition the register happens to fix this.

2.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2021-47236

In the Linux kernel, the following vulnerability has been resolved: net: cdc_eem: fix tx fixup skb leak when usbnet transmit a skb, eem fixup it in eem_tx_fixup(), if skb_copy_expand() failed, it return NULL, usbnet_start_xmit() will have no chance to free original skb. fix it by free orginal skb in eem_tx_fixup() first, then check skb clone status, if failed, return NULL to usbnet.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2021-47310

A vulnerability was found in the Linux kernel's TI TLAN driver, where the tlan_remove_one function can lead to a use-after-free issue when the driver attempts to access private data after the network device has already been freed, potentially causing system instability or crash.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2021-47311

A vulnerability was found in the Linux kernel's Qualcomm EMAC driver, where the emac_remove function can lead to a use-after-free issue when the driver tries to access data after the network device has been freed, causing instability and a crash in the network subsystem.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2021-47353

A vulnerability was found in the Linux kernel's UDF file system driver, where the udf_symlink function can dereference a NULL pointer. This occurs because the function uses a value returned from udf_tgetblk without checking if it is NULL, potentially causing system crashes if sb_getblk fails.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2021-47356

A vulnerability was found in the Linux kernel's mISDN driver. This issue arises during the cleanup process, where a timer handler might still be running after the driver has been removed, which can lead to a use-after-free issue, potentially causing a system crash.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2021-47456

In the Linux kernel, the following vulnerability has been resolved: can: peak_pci: peak_pci_remove(): fix UAF When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF. Fix this by releasing 'dev' later. The following log reveals it: [ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513 ] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ] print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0 [ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ] pci_device_remove+0xa9/0x250

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2021-47495

In the Linux kernel, the following vulnerability has been resolved: usbnet: sanity check for maxpacket maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up. V2: fixed typo in log and stylistic issues

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-369 - Divide By Zero

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2022-49057

In the Linux kernel, the following vulnerability has been resolved: block: null_blk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fix the issue by ending it in timeout handler.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-5090

A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

CWE-755 - Improper Handling of Exceptional Conditions

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-52464

A flaw was found in the Linux Kernel. An improper buffer size is provided to the strncat function, which may result in an out-of-bounds write, leading to memory corruption or a denial of service.

2.9 (Low)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52560

A potential memory leak flaw was found in damon_do_test_apply_three_regions() in the Linux kernel. This issue may lead to minor memory issues, resulting in compromised availability.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-401 - Missing Release of Memory after Effective Lifetime

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52615

A vulnerability was found in the hwrng component of the Linux kernel, which caused a deadlock when reading from /dev/hwrng into memory and mmap-ed from /dev/hwrng. This issue is triggered by a recursive read during a page fault and allows a local, authenticated attacker to cause a denial of service.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-400 - Uncontrolled Resource Consumption

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-52626

An operation precedence flaw was found in the Linux kernel’s Mellanox Technologies networking driver. This flaw allows a local user to crash the system or potentially gain access to data that should not be accessible.

6.0 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-52667

A double-free flaw was found in the Linux kernel ConnectX-4 and Connect-IB cards in the Mellanox driver. This issue could allow a local user to crash the system.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-415 - Double Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-52669

In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52675

In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52686

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52700

In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel warning when sending SYN message When sending a SYN message, this kernel stack trace is observed: ... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 ... [ 13.398494] Call Trace: [ 13.398630] <TASK> [ 13.398630] ? __alloc_skb+0xed/0x1a0 [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc] [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290 [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __local_bh_enable_ip+0x37/0x80 [ 13.398630] tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __sys_connect+0x9f/0xd0 [ 13.398630] __sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because commit a41dad905e5a ("iov_iter: saner checks for attempt to copy to/from iterator") has introduced sanity check for copying from/to iov iterator. Lacking of copy direction from the iterator viewpoint would lead to kernel stack trace like above. This commit fixes this issue by initializing the iov iterator with the correct copy direction when sending SYN or ACK without data.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52703

In the Linux kernel, the following vulnerability has been resolved: net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed in the second error path would be the value of act_len from the first call to usb_bulk_msg.[1] With this in mind, let's just not pass act_len to the usb_bulk_msg error paths. 1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-15 - External Control of System or Configuration Setting

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52781

In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52813

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATA_RESET We found a hungtask bug in test_aead_vec_cfg as follows: INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Call trace: __switch_to+0x98/0xe0 __schedule+0x6c4/0xf40 schedule+0xd8/0x1b4 schedule_timeout+0x474/0x560 wait_for_common+0x368/0x4e0 wait_for_completion+0x20/0x30 wait_for_completion+0x20/0x30 test_aead_vec_cfg+0xab4/0xd50 test_aead+0x144/0x1f0 alg_test_aead+0xd8/0x1e0 alg_test+0x634/0x890 cryptomgr_test+0x40/0x70 kthread+0x1e0/0x220 ret_from_fork+0x10/0x18 Kernel panic - not syncing: hung_task: blocked tasks For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask. The problem comes as following: (padata_do_parallel) | rcu_read_lock_bh(); | err = -EINVAL; | (padata_replace) | pinst->flags |= PADATA_RESET; err = -EBUSY | if (pinst->flags & PADATA_RESET) | rcu_read_unlock_bh() | return err In order to resolve the problem, we replace the return err -EBUSY with -EAGAIN, which means parallel_data is changing, and the caller should call it again. v3: remove retry and just change the return err. v2: introduce padata_try_do_parallel() in pcrypt_aead_encrypt and pcrypt_aead_decrypt to solve the hungtask.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-833 - Deadlock

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52835

In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2023-52877

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() It is possible that typec_register_partner() returns ERR_PTR on failure. When port->partner is an error, a NULL pointer dereference may occur as shown below. [91222.095236][ T319] typec port0: failed to register partner (-17) ... [91225.061491][ T319] Unable to handle kernel NULL pointer dereference at virtual address 000000000000039f [91225.274642][ T319] pc : tcpm_pd_data_request+0x310/0x13fc [91225.274646][ T319] lr : tcpm_pd_data_request+0x298/0x13fc [91225.308067][ T319] Call trace: [91225.308070][ T319] tcpm_pd_data_request+0x310/0x13fc [91225.308073][ T319] tcpm_pd_rx_handler+0x100/0x9e8 [91225.355900][ T319] kthread_worker_fn+0x178/0x58c [91225.355902][ T319] kthread+0x150/0x200 [91225.355905][ T319] ret_from_fork+0x10/0x30 Add a check for port->partner to avoid dereferencing a NULL pointer.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52878

In the Linux kernel, the following vulnerability has been resolved: can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds If the "struct can_priv::echoo_skb" is accessed out of bounds, this would cause a kernel crash. Instead, issue a meaningful warning message and return with an error.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2023-52881

A flaw was found in the Linux kernel. Two TCP spoofing primitives exist where an attacker can brute force the server-chosen send window by acknowledging data that was never sent, called "ghost ACKs." There are side channels that also allow the attacker to leak the otherwise secret server-chosen initial sequence number (ISN). One of these side channels leverages TCP SYN cookies.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26583

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete(); any code past that point risks touching already freed data. This could lead to a use-after-free issue and a denial of service condition.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26584

A flaw was found in the tls subsystem of the Linux kernel. When setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on requests to the crypto API, crypto_aead_encrypt and crypto_aead_decrypt functions can return -EBUSY instead of -EINPROGRESS in valid situations. This issue could lead to undefined behavior and a denial of service condition.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-393 - Return of Wrong Status Code

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26585

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(), which could lead to undefined behavior and a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26656

A failure flaw was found in the Linux kernel’s AMDGPU driver in how a user sends ioctl with an invalid address and size when using the AMD GPU. This flaw allows a local user to crash the system.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26675

In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26735

A use-after-free flaw was found in the Linux kernel’s IPv6 protocol functionality. This flaw allows a local user to potentially crash the system.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26759

In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix race when skipping swapcache The Linux kernel CVE team has assigned CVE-2024-26759 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040304-CVE-2024-26759-45f1@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26801

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in how it handles hardware failure when it occurs. This flaw allows a local user to potentially crash the system.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26804

A use-after-free flaw was found in the Linux kernel’s ip_tunnel functionality when a user uses the ip_tunnel infrastructure. This flaw allows a local user to crash the system.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26826

A flaw was found in the Linux kernel. A logical error in the Multipath TCP packet manager causes some packets intended for retransmission to be lost, resulting in a potential denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26859

In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system crash during EEH error handling During EEH error recovery, the bnx2x driver's transmit timeout logic could cause a race condition when handling reset tasks. The bnx2x_tx_timeout() schedules reset tasks via bnx2x_sp_rtnl_task(), which ultimately leads to bnx2x_nic_unload(). In bnx2x_nic_unload() SGEs are freed using bnx2x_free_rx_sge_range(). However, this could overlap with the EEH driver's attempt to reset the device using bnx2x_io_slot_reset(), which also tries to free SGEs. This race condition can result in system crashes due to accessing freed memory locations in bnx2x_free_rx_sge() 799 static inline void bnx2x_free_rx_sge(struct bnx2x *bp, 800 struct bnx2x_fastpath *fp, u16 index) 801 { 802 struct sw_rx_page *sw_buf = &fp->rx_page_ring[index]; 803 struct page *page = sw_buf->page; .... where sw_buf was set to NULL after the call to dma_unmap_page() by the preceding thread. EEH: Beginning: 'slot_reset' PCI 0011:01:00.0#10000: EEH: Invoking bnx2x->slot_reset() bnx2x: [bnx2x_io_slot_reset:14228(eth1)]IO slot reset initializing... bnx2x 0011:01:00.0: enabling device (0140 -> 0142) bnx2x: [bnx2x_io_slot_reset:14244(eth1)]IO slot reset --> driver unload Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc0080000025065fc Oops: Kernel access of bad area, sig: 11 [#1] ..... Call Trace: [c000000003c67a20] [c00800000250658c] bnx2x_io_slot_reset+0x204/0x610 [bnx2x] (unreliable) [c000000003c67af0] [c0000000000518a8] eeh_report_reset+0xb8/0xf0 [c000000003c67b60] [c000000000052130] eeh_pe_report+0x180/0x550 [c000000003c67c70] [c00000000005318c] eeh_handle_normal_event+0x84c/0xa60 [c000000003c67d50] [c000000000053a84] eeh_event_handler+0xf4/0x170 [c000000003c67da0] [c000000000194c58] kthread+0x1c8/0x1d0 [c000000003c67e10] [c00000000000cf64] ret_from_kernel_thread+0x5c/0x64 To solve this issue, we need to verify page pool allocations before freeing.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26906

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() The Linux kernel CVE team has assigned CVE-2024-26906 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041746-CVE-2024-26906-bb35@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26907

A flaw was found in the Linux kernel's mlx5 InfiniBand driver. Certain scenarios could lead to a use-after-free issue, potentially allowing an attacker to escalate their privileges or affect system integrity or stability.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-26974

A race condition was found in drivers/crypto/intel/qat/qat_common/adf_aer.c in the Linux kernel during AER recovery.

5.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-366 - Race Condition within a Thread

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-26982

A flaw was found in the squashfs module in the Linux kernel. A missing check of an inode number with an invalid value of zero can cause an out-of-bounds read and result in a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-27397

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-27410

CVE-2024-27410 is a vulnerability in the Linux kernel’s Wi-Fi subsystem, affecting the nl80211 interface. The issue occurs when a mesh ID is set while simultaneously switching the interface to mesh mode, which can overwrite critical data in the wireless device's configuration. This can lead to unexpected behavior or instability. The issue has been resolved by preventing interface type changes during mesh ID updates. Users should update their kernel to a patched version to address this issue and ensure proper system functionality.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35789

CVE-2024-35789 is a vulnerability in the Linux kernel’s Wi-Fi subsystem (mac80211). It occurs when a station is moved out of a VLAN, and the VLAN is subsequently deleted. A reference to the deleted VLAN’s network device may remain, leading to a use-after-free condition. This can result in system instability or crashes. The issue has been resolved by ensuring that outdated references are cleared when a station changes VLANs.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35835

A double-free vulnerability was found in the `arfs_create_groups` function in the Linux kernel's `net/mlx5e` driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35838

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential sta-link leak When a station is allocated, links are added but not set to valid yet (e.g. during connection to an AP MLD), we might remove the station without ever marking links valid, and leak them. Fix that.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-35845

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The Linux kernel CVE team has assigned CVE-2024-35845 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051718-CVE-2024-35845-65bd@gregkh/T

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35852

CVE-2024-35852 addresses a memory leak in the Linux kernel's mlxsw driver, specifically within the Spectrum ACL TCAM module. The issue occurs when rehash work is canceled while pending, leading to allocated hints not being freed properly. This results in a memory leak that can degrade system performance over time. The problem has been resolved by ensuring that any associated hints are freed when the rehash work is canceled. Users should update their Linux kernel to a version that includes this fix to maintain optimal system performance.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35853

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The Linux kernel CVE team has assigned CVE-2024-35853 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35853-869a@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-35854

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The Linux kernel CVE team has assigned CVE-2024-35854 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051740-CVE-2024-35854-d17b@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-35855

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update The Linux kernel CVE team has assigned CVE-2024-35855 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051741-CVE-2024-35855-c1fb@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35888

In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head The Linux kernel CVE team has assigned CVE-2024-35888 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051947-CVE-2024-35888-1e04@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-35890

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) feature, where packets processed with a fragment list are not properly orphaned due to incorrect handling of socket references. This vulnerability can cause system instability or kernel bugs. The issue has been fixed by making sure that socket references are correctly removed during packet processing. Users should update their kernel to the patched version to mitigate this risk.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35958

This is a vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver, which manages network interfaces on certain platforms. The driver utilizes two types of transmit (TX) queues: one for packets from the network stack and another for packets directed by XDP (eXpress Data Path) operations. The function ena_free_tx_bufs() is responsible for unmapping and freeing descriptors of uncompleted TX transactions. However, it incorrectly assumes that all TX queues handle packets from the network stack, leading to improper handling of descriptors in XDP-specific queues. This mismanagement can result in descriptors not being freed correctly, potentially causing system crashes, especially during a Virtual Function (VF) reset. The issue has been resolved by updating the driver to correctly differentiate between the two types of TX queues, ensuring proper descriptor management. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-35959

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix mlx5e_priv_init() cleanup flow The Linux kernel CVE team has assigned CVE-2024-35959 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052019-CVE-2024-35959-6e06@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-35960

CVE-2024-35960 is a vulnerability in the Linux kernel's Mellanox MLX5 driver that affects flow steering rule handling. When identical rules are created and referenced multiple times, they can fail to properly link into the rule tree, leaving them uninitialized. This can cause system crashes during rule deletion due to invalid references. The issue has been fixed by ensuring all newly created rules are properly initialized and linked. Updating to a patched kernel version resolves the problem and ensures system stability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

CVE-2024-36004

In the Linux kernel, the following vulnerability has been resolved: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue Issue reported by customer during SRIOV testing, call trace: When both i40e and the i40iw driver are loaded, a warning in check_flush_dependency is being triggered. This seems to be because of the i40e driver workqueue is allocated with the WQ_MEM_RECLAIM flag, and the i40iw one is not. Similar error was encountered on ice too and it was fixed by removing the flag. Do the same for i40e too. [Feb 9 09:08] ------------[ cut here ]------------ [ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is flushing !WQ_MEM_RECLAIM infiniband:0x0 [ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 check_flush_dependency+0x10b/0x120 [ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror dm_region_hash dm_log dm_mod fuse [ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1 [ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 [ +0.000001] Workqueue: i40e i40e_service_task [i40e] [ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 [ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48 81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 [ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282 [ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX: 0000000000000027 [ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI: ffff94d47f620bc0 [ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000ffff7fff [ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12: ffff94c5451ea180 [ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15: ffff94c5f1330ab0 [ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) knlGS:0000000000000000 [ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4: 00000000007706f0 [ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ +0.000001] PKRU: 55555554 [ +0.000001] Call Trace: [ +0.000001] <TASK> [ +0.000002] ? __warn+0x80/0x130 [ +0.000003] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? report_bug+0x195/0x1a0 [ +0.000005] ? handle_bug+0x3c/0x70 [ +0.000003] ? exc_invalid_op+0x14/0x70 [ +0.000002] ? asm_exc_invalid_op+0x16/0x20 [ +0.000006] ? check_flush_dependency+0x10b/0x120 [ +0.000002] ? check_flush_dependency+0x10b/0x120 [ +0.000002] __flush_workqueue+0x126/0x3f0 [ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] [ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] [ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] [ +0.000020] i40iw_close+0x4b/0x90 [irdma] [ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] [ +0.000035] i40e_service_task+0x126/0x190 [i40e] [ +0.000024] process_one_work+0x174/0x340 [ +0.000003] worker_th ---truncated---

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-36007

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix warning during rehash As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled. Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1]. Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases. [1] WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 </TASK>

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Low

CVE-2024-42159

A vulnerability was found in the Linux kernel's mpi3mr driver in the mpi3mr_sas_port_add() function, where a lack of proper checks could lead to values that are larger than what the defined size of the num_phys field in the mr_sas_node structure being inserted, causing the field to be overwritten and potentially corrupting the structure. This issue could lead to memory corruption or crashes.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 120 products, the same list as for CVE-2020-26555

Known not affected 8 products, the same list as for CVE-2020-26555

Threats

Impact Moderate

References

381 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:4211	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1918601	external
https://bugzilla.redhat.com/show_bug.cgi?id=2248122	external
https://bugzilla.redhat.com/show_bug.cgi?id=2258875	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265517	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265519	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265520	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265800	external
https://bugzilla.redhat.com/show_bug.cgi?id=2266408	external
https://bugzilla.redhat.com/show_bug.cgi?id=2266831	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267513	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267518	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267730	external
https://bugzilla.redhat.com/show_bug.cgi?id=2270093	external
https://bugzilla.redhat.com/show_bug.cgi?id=2271680	external
https://bugzilla.redhat.com/show_bug.cgi?id=2272692	external
https://bugzilla.redhat.com/show_bug.cgi?id=2272829	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273204	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273278	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273423	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275604	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275633	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275635	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275733	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278337	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278354	external
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281057	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281113	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281157	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281165	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281251	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281253	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281255	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281257	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281272	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281311	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281334	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281346	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281350	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281689	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281693	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281920	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281923	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281925	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281953	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281986	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282394	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282400	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282471	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282472	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282581	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282609	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282612	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282653	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282680	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282698	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282712	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282735	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282902	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282920	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2020-26555	self
https://bugzilla.redhat.com/show_bug.cgi?id=1918601	external
https://www.cve.org/CVERecord?id=CVE-2020-26555	external
https://nvd.nist.gov/vuln/detail/CVE-2020-26555	external
https://access.redhat.com/security/cve/CVE-2021-46909	self
https://bugzilla.redhat.com/show_bug.cgi?id=2266408	external
https://www.cve.org/CVERecord?id=CVE-2021-46909	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46909	external
https://git.kernel.org/stable/c/1fc087fdb98d556b4…	external
https://git.kernel.org/stable/c/2643da6aa57920d91…	external
https://git.kernel.org/stable/c/30e3b4f256b4e366a…	external
https://git.kernel.org/stable/c/532747fd5c7aaa17e…	external
https://git.kernel.org/stable/c/871b569a3e67f570d…	external
https://git.kernel.org/stable/c/c3efce8cc98073396…	external
https://access.redhat.com/security/cve/CVE-2021-46972	self
https://bugzilla.redhat.com/show_bug.cgi?id=2266831	external
https://www.cve.org/CVERecord?id=CVE-2021-46972	external
https://nvd.nist.gov/vuln/detail/CVE-2021-46972	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2021-47069	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267513	external
https://www.cve.org/CVERecord?id=CVE-2021-47069	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47069	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2021-47073	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267518	external
https://www.cve.org/CVERecord?id=CVE-2021-47073	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47073	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2021-47236	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282581	external
https://www.cve.org/CVERecord?id=CVE-2021-47236	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47236	external
https://access.redhat.com/security/cve/CVE-2021-47310	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282472	external
https://www.cve.org/CVERecord?id=CVE-2021-47310	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47310	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47311	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282471	external
https://www.cve.org/CVERecord?id=CVE-2021-47311	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47311	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47353	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282400	external
https://www.cve.org/CVERecord?id=CVE-2021-47353	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47353	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47356	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282394	external
https://www.cve.org/CVERecord?id=CVE-2021-47356	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47356	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47456	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282902	external
https://www.cve.org/CVERecord?id=CVE-2021-47456	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47456	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47495	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282920	external
https://www.cve.org/CVERecord?id=CVE-2021-47495	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47495	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2022-49057	self
https://bugzilla.redhat.com/show_bug.cgi?id=2348326	external
https://www.cve.org/CVERecord?id=CVE-2022-49057	external
https://nvd.nist.gov/vuln/detail/CVE-2022-49057	external
https://lore.kernel.org/linux-cve-announce/202502…	external
https://access.redhat.com/security/cve/CVE-2023-5090	self
https://bugzilla.redhat.com/show_bug.cgi?id=2248122	external
https://www.cve.org/CVERecord?id=CVE-2023-5090	external
https://nvd.nist.gov/vuln/detail/CVE-2023-5090	external
https://access.redhat.com/security/cve/CVE-2023-52464	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265800	external
https://www.cve.org/CVERecord?id=CVE-2023-52464	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52464	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2023-52560	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267730	external
https://www.cve.org/CVERecord?id=CVE-2023-52560	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52560	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52615	self
https://bugzilla.redhat.com/show_bug.cgi?id=2270093	external
https://www.cve.org/CVERecord?id=CVE-2023-52615	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52615	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52626	self
https://bugzilla.redhat.com/show_bug.cgi?id=2271680	external
https://www.cve.org/CVERecord?id=CVE-2023-52626	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52626	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52667	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281350	external
https://www.cve.org/CVERecord?id=CVE-2023-52667	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52667	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52669	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281346	external
https://www.cve.org/CVERecord?id=CVE-2023-52669	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52669	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52675	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281334	external
https://www.cve.org/CVERecord?id=CVE-2023-52675	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52675	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52686	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281311	external
https://www.cve.org/CVERecord?id=CVE-2023-52686	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52686	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52700	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282609	external
https://www.cve.org/CVERecord?id=CVE-2023-52700	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52700	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52703	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282612	external
https://www.cve.org/CVERecord?id=CVE-2023-52703	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52703	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52781	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282698	external
https://www.cve.org/CVERecord?id=CVE-2023-52781	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52781	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52813	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282653	external
https://www.cve.org/CVERecord?id=CVE-2023-52813	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52813	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52835	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282735	external
https://www.cve.org/CVERecord?id=CVE-2023-52835	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52835	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52877	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282712	external
https://www.cve.org/CVERecord?id=CVE-2023-52877	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52877	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52878	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282680	external
https://www.cve.org/CVERecord?id=CVE-2023-52878	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52878	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52881	self
https://bugzilla.redhat.com/show_bug.cgi?id=2258875	external
https://www.cve.org/CVERecord?id=CVE-2023-52881	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52881	external
https://lore.kernel.org/all/20231205161841.270292…	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26583	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265520	external
https://www.cve.org/CVERecord?id=CVE-2024-26583	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26583	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26584	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265519	external
https://www.cve.org/CVERecord?id=CVE-2024-26584	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26584	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26585	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265517	external
https://www.cve.org/CVERecord?id=CVE-2024-26585	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26585	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26656	self
https://bugzilla.redhat.com/show_bug.cgi?id=2272692	external
https://www.cve.org/CVERecord?id=CVE-2024-26656	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26656	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26675	self
https://bugzilla.redhat.com/show_bug.cgi?id=2272829	external
https://www.cve.org/CVERecord?id=CVE-2024-26675	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26675	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26735	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273278	external
https://www.cve.org/CVERecord?id=CVE-2024-26735	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26735	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26759	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273204	external
https://www.cve.org/CVERecord?id=CVE-2024-26759	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26759	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26801	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273429	external
https://www.cve.org/CVERecord?id=CVE-2024-26801	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26801	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26804	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273423	external
https://www.cve.org/CVERecord?id=CVE-2024-26804	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26804	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26826	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275604	external
https://www.cve.org/CVERecord?id=CVE-2024-26826	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26826	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275733	external
https://www.cve.org/CVERecord?id=CVE-2024-26859	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26859	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26906	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275635	external
https://www.cve.org/CVERecord?id=CVE-2024-26906	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26906	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26907	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275633	external
https://www.cve.org/CVERecord?id=CVE-2024-26907	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26907	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26974	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278354	external
https://www.cve.org/CVERecord?id=CVE-2024-26974	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26974	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26982	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278337	external
https://www.cve.org/CVERecord?id=CVE-2024-26982	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26982	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://www.cve.org/CVERecord?id=CVE-2024-27397	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27397	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27410	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281113	external
https://www.cve.org/CVERecord?id=CVE-2024-27410	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27410	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35789	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281057	external
https://www.cve.org/CVERecord?id=CVE-2024-35789	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35789	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35835	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281165	external
https://www.cve.org/CVERecord?id=CVE-2024-35835	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35835	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35838	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281157	external
https://www.cve.org/CVERecord?id=CVE-2024-35838	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35838	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35845	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281272	external
https://www.cve.org/CVERecord?id=CVE-2024-35845	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35845	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281257	external
https://www.cve.org/CVERecord?id=CVE-2024-35852	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35852	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281255	external
https://www.cve.org/CVERecord?id=CVE-2024-35853	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35853	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35854	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281253	external
https://www.cve.org/CVERecord?id=CVE-2024-35854	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35854	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35855	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281251	external
https://www.cve.org/CVERecord?id=CVE-2024-35855	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35855	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35888	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281693	external
https://www.cve.org/CVERecord?id=CVE-2024-35888	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35888	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35890	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281689	external
https://www.cve.org/CVERecord?id=CVE-2024-35890	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35890	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35958	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281925	external
https://www.cve.org/CVERecord?id=CVE-2024-35958	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35958	external
https://access.redhat.com/security/cve/CVE-2024-35959	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281923	external
https://www.cve.org/CVERecord?id=CVE-2024-35959	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35959	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35960	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281920	external
https://www.cve.org/CVERecord?id=CVE-2024-35960	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35960	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36004	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281953	external
https://www.cve.org/CVERecord?id=CVE-2024-36004	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36004	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36007	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281986	external
https://www.cve.org/CVERecord?id=CVE-2024-36007	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36007	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-42159	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301530	external
https://www.cve.org/CVERecord?id=CVE-2024-42159	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42159	external
https://lore.kernel.org/linux-cve-announce/202407…	external

Acknowledgments

Red Hat Maxim Levitsky

JSON

To clipboard

Loading 2.6 MB of JSON…

CVE-2020-26555 (GCVE-0-2020-26555)

Vulnerability from cvelistv5 – Published: 2021-05-24 17:41 – Updated: 2025-11-04 19:12

Summary

Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

5 references

URL	Tags
https://www.bluetooth.com/learn-about-bluetooth/k…	x_refsource_MISC
https://kb.cert.org/vuls/id/799380	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://www.intel.com/content/www/us/en/security-…	x_refsource_CONFIRM
https://www.kb.cert.org/vuls/id/799380

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T19:12:16.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/799380"
          },
          {
            "name": "FEDORA-2021-a35b44fd9f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/799380"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-08T17:06:22.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://kb.cert.org/vuls/id/799380"
        },
        {
          "name": "FEDORA-2021-a35b44fd9f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-26555",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/",
              "refsource": "MISC",
              "url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security/"
            },
            {
              "name": "https://kb.cert.org/vuls/id/799380",
              "refsource": "MISC",
              "url": "https://kb.cert.org/vuls/id/799380"
            },
            {
              "name": "FEDORA-2021-a35b44fd9f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ/"
            },
            {
              "name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html",
              "refsource": "CONFIRM",
              "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-26555",
    "datePublished": "2021-05-24T17:41:15.000Z",
    "dateReserved": "2020-10-04T00:00:00.000Z",
    "dateUpdated": "2025-11-04T19:12:16.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-46909 (GCVE-0-2021-46909)

Vulnerability from cvelistv5 – Published: 2024-02-27 06:53 – Updated: 2026-05-11 13:44

Title

ARM: footbridge: fix PCI interrupt mapping

Summary

In the Linux kernel, the following vulnerability has been resolved: ARM: footbridge: fix PCI interrupt mapping Since commit 30fdfb929e82 ("PCI: Add a call to pci_assign_irq() in pci_device_probe()"), the PCI code will call the IRQ mapping function whenever a PCI driver is probed. If these are marked as __init, this causes an oops if a PCI driver is loaded or bound after the kernel has initialised.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-05 22:33 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/532747fd5c7aaa17e…
https://git.kernel.org/stable/c/2643da6aa57920d91…
https://git.kernel.org/stable/c/871b569a3e67f570d…
https://git.kernel.org/stable/c/1fc087fdb98d556b4…
https://git.kernel.org/stable/c/c3efce8cc98073396…
https://git.kernel.org/stable/c/30e3b4f256b4e366a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < 532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf (git) Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < 2643da6aa57920d9159a1a579fb04f89a2b0d29a (git) Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < 871b569a3e67f570df9f5ba195444dc7c621293b (git) Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < 1fc087fdb98d556b416c82ed6e3964a30885f47a (git) Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < c3efce8cc9807339633ee30e39882f4c8626ee1d (git) Affected: 30fdfb929e82450bbf3d0e0aba56efbc29b52b52 , < 30e3b4f256b4e366a61658c294f6a21b8626dda7 (git)
Linux	Linux	Affected: 4.13 Unaffected: 0 , < 4.13 (semver) Unaffected: 4.14.232 , ≤ 4.14.* (semver) Unaffected: 4.19.189 , ≤ 4.19.* (semver) Unaffected: 5.4.114 , ≤ 5.4.* (semver) Unaffected: 5.10.32 , ≤ 5.10.* (semver) Unaffected: 5.11.16 , ≤ 5.11.* (semver) Unaffected: 5.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46909",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T22:33:27.334758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:15.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.879Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2643da6aa57920d9159a1a579fb04f89a2b0d29a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/871b569a3e67f570df9f5ba195444dc7c621293b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1fc087fdb98d556b416c82ed6e3964a30885f47a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3efce8cc9807339633ee30e39882f4c8626ee1d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/30e3b4f256b4e366a61658c294f6a21b8626dda7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/mach-footbridge/cats-pci.c",
            "arch/arm/mach-footbridge/ebsa285-pci.c",
            "arch/arm/mach-footbridge/netwinder-pci.c",
            "arch/arm/mach-footbridge/personal-pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            },
            {
              "lessThan": "2643da6aa57920d9159a1a579fb04f89a2b0d29a",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            },
            {
              "lessThan": "871b569a3e67f570df9f5ba195444dc7c621293b",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            },
            {
              "lessThan": "1fc087fdb98d556b416c82ed6e3964a30885f47a",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            },
            {
              "lessThan": "c3efce8cc9807339633ee30e39882f4c8626ee1d",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            },
            {
              "lessThan": "30e3b4f256b4e366a61658c294f6a21b8626dda7",
              "status": "affected",
              "version": "30fdfb929e82450bbf3d0e0aba56efbc29b52b52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm/mach-footbridge/cats-pci.c",
            "arch/arm/mach-footbridge/ebsa285-pci.c",
            "arch/arm/mach-footbridge/netwinder-pci.c",
            "arch/arm/mach-footbridge/personal-pci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.232",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.232",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.189",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.114",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.32",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.16",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: footbridge: fix PCI interrupt mapping\n\nSince commit 30fdfb929e82 (\"PCI: Add a call to pci_assign_irq() in\npci_device_probe()\"), the PCI code will call the IRQ mapping function\nwhenever a PCI driver is probed. If these are marked as __init, this\ncauses an oops if a PCI driver is loaded or bound after the kernel has\ninitialised."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:44:13.718Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/532747fd5c7aaa17ee5cf79f3e947c31eb0e35cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/2643da6aa57920d9159a1a579fb04f89a2b0d29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/871b569a3e67f570df9f5ba195444dc7c621293b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc087fdb98d556b416c82ed6e3964a30885f47a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3efce8cc9807339633ee30e39882f4c8626ee1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/30e3b4f256b4e366a61658c294f6a21b8626dda7"
        }
      ],
      "title": "ARM: footbridge: fix PCI interrupt mapping",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46909",
    "datePublished": "2024-02-27T06:53:50.181Z",
    "dateReserved": "2024-02-25T13:45:52.718Z",
    "dateUpdated": "2026-05-11T13:44:13.718Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-46972 (GCVE-0-2021-46972)

Vulnerability from cvelistv5 – Published: 2024-02-27 18:47 – Updated: 2026-05-11 13:45

Title

ovl: fix leaked dentry

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-28 17:00 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/71d58457a8afc650d…
https://git.kernel.org/stable/c/cf3e3330bc5719fa9…
https://git.kernel.org/stable/c/d587cfaef72b1b6f4…
https://git.kernel.org/stable/c/eaab1d45cdb4bb0c8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6815f479ca90ee7fd2e28b2a420f796b974155fe , < 71d58457a8afc650da5d3292a7f7029317654d95 (git) Affected: 6815f479ca90ee7fd2e28b2a420f796b974155fe , < cf3e3330bc5719fa9d658e3e2f596bde89344a94 (git) Affected: 6815f479ca90ee7fd2e28b2a420f796b974155fe , < d587cfaef72b1b6f4b2774827123bce91f497cc8 (git) Affected: 6815f479ca90ee7fd2e28b2a420f796b974155fe , < eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.35 , ≤ 5.10.* (semver) Unaffected: 5.11.19 , ≤ 5.11.* (semver) Unaffected: 5.12.2 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-46972",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T17:00:35.229463Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T17:00:43.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:17:42.888Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f7029317654d95"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d587cfaef72b1b6f4b2774827123bce91f497cc8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "71d58457a8afc650da5d3292a7f7029317654d95",
              "status": "affected",
              "version": "6815f479ca90ee7fd2e28b2a420f796b974155fe",
              "versionType": "git"
            },
            {
              "lessThan": "cf3e3330bc5719fa9d658e3e2f596bde89344a94",
              "status": "affected",
              "version": "6815f479ca90ee7fd2e28b2a420f796b974155fe",
              "versionType": "git"
            },
            {
              "lessThan": "d587cfaef72b1b6f4b2774827123bce91f497cc8",
              "status": "affected",
              "version": "6815f479ca90ee7fd2e28b2a420f796b974155fe",
              "versionType": "git"
            },
            {
              "lessThan": "eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41",
              "status": "affected",
              "version": "6815f479ca90ee7fd2e28b2a420f796b974155fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.11.*",
              "status": "unaffected",
              "version": "5.11.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.35",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.19",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix leaked dentry\n\nSince commit 6815f479ca90 (\"ovl: use only uppermetacopy state in\novl_lookup()\"), overlayfs doesn\u0027t put temporary dentry when there is a\nmetacopy error, which leads to dentry leaks when shutting down the related\nsuperblock:\n\n  overlayfs: refusing to follow metacopy origin for (/file0)\n  ...\n  BUG: Dentry (____ptrval____){i=3f33,n=file3}  still in use (1) [unmount of overlay overlay]\n  ...\n  WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d\n  CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1\n  ...\n  RIP: 0010:umount_check.cold+0x107/0x14d\n  ...\n  Call Trace:\n   d_walk+0x28c/0x950\n   ? dentry_lru_isolate+0x2b0/0x2b0\n   ? __kasan_slab_free+0x12/0x20\n   do_one_tree+0x33/0x60\n   shrink_dcache_for_umount+0x78/0x1d0\n   generic_shutdown_super+0x70/0x440\n   kill_anon_super+0x3e/0x70\n   deactivate_locked_super+0xc4/0x160\n   deactivate_super+0xfa/0x140\n   cleanup_mnt+0x22e/0x370\n   __cleanup_mnt+0x1a/0x30\n   task_work_run+0x139/0x210\n   do_exit+0xb0c/0x2820\n   ? __kasan_check_read+0x1d/0x30\n   ? find_held_lock+0x35/0x160\n   ? lock_release+0x1b6/0x660\n   ? mm_update_next_owner+0xa20/0xa20\n   ? reacquire_held_locks+0x3f0/0x3f0\n   ? __sanitizer_cov_trace_const_cmp4+0x22/0x30\n   do_group_exit+0x135/0x380\n   __do_sys_exit_group.isra.0+0x20/0x20\n   __x64_sys_exit_group+0x3c/0x50\n   do_syscall_64+0x45/0x70\n   entry_SYSCALL_64_after_hwframe+0x44/0xae\n  ...\n  VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds.  Have a nice day...\n\nThis fix has been tested with a syzkaller reproducer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:45:29.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/71d58457a8afc650da5d3292a7f7029317654d95"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf3e3330bc5719fa9d658e3e2f596bde89344a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/d587cfaef72b1b6f4b2774827123bce91f497cc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/eaab1d45cdb4bb0c846bd23c3d666d5b90af7b41"
        }
      ],
      "title": "ovl: fix leaked dentry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-46972",
    "datePublished": "2024-02-27T18:47:07.276Z",
    "dateReserved": "2024-02-27T18:42:55.943Z",
    "dateUpdated": "2026-05-11T13:45:29.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47069 (GCVE-0-2021-47069)

Vulnerability from cvelistv5 – Published: 2024-03-01 21:15 – Updated: 2026-08-05 08:45

Title

ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry

Summary

In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later call pipelined_send. This leads to a very hard to trigger race where a do_mq_timedreceive call might return and leave do_mq_timedsend to rely on an invalid address, causing the following crash: RIP: 0010:wake_q_add_safe+0x13/0x60 Call Trace: __x64_sys_mq_timedsend+0x2a9/0x490 do_syscall_64+0x80/0x680 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f5928e40343 The race occurs as: 1. do_mq_timedreceive calls wq_sleep with the address of `struct ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it holds a valid `struct ext_wait_queue *` as long as the stack has not been overwritten. 2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call __pipelined_op. 3. Sender calls __pipelined_op::smp_store_release(&this->state, STATE_READY). Here is where the race window begins. (`this` is `ewq_addr`.) 4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it will see `state == STATE_READY` and break. 5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's stack. (Although the address may not get overwritten until another function happens to touch it, which means it can persist around for an indefinite time.) 6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a `struct ext_wait_queue *`, and uses it to find a task_struct to pass to the wake_q_add_safe call. In the lucky case where nothing has overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct. In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a bogus address as the receiver's task_struct causing the crash. do_mq_timedsend::__pipelined_op() should not dereference `this` after setting STATE_READY, as the receiver counterpart is now free to return. Change __pipelined_op to call wake_q_add_safe on the receiver's task_struct returned by get_task_struct, instead of dereferencing `this` which sits on the receiver's stack. As Manfred pointed out, the race potentially also exists in ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix those in the same way.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-21 16:15 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/4528c0c323085e645…
https://git.kernel.org/stable/c/807fa14536b26803b…
https://git.kernel.org/stable/c/a11ddb37bf367e6b5…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 , < 4528c0c323085e645b8765913b4a7fd42cf49b65 (git) Affected: c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 , < 807fa14536b26803b858da878b643be72952a097 (git) Affected: c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04 , < a11ddb37bf367e6b5239b95ca759e5389bb46048 (git)
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.10.40 , ≤ 5.10.* (semver) Unaffected: 5.12.7 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T16:15:09.996738Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T16:15:20.262Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4528c0c323085e645b8765913b4a7fd42cf49b65"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/807fa14536b26803b858da878b643be72952a097"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a11ddb37bf367e6b5239b95ca759e5389bb46048"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "ipc/mqueue.c",
            "ipc/msg.c",
            "ipc/sem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4528c0c323085e645b8765913b4a7fd42cf49b65",
              "status": "affected",
              "version": "c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04",
              "versionType": "git"
            },
            {
              "lessThan": "807fa14536b26803b858da878b643be72952a097",
              "status": "affected",
              "version": "c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04",
              "versionType": "git"
            },
            {
              "lessThan": "a11ddb37bf367e6b5239b95ca759e5389bb46048",
              "status": "affected",
              "version": "c5b2cbdbdac563f46ecd5e187253ab1abbd6fc04",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "ipc/mqueue.c",
            "ipc/msg.c",
            "ipc/sem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.40",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.7",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry\n\ndo_mq_timedreceive calls wq_sleep with a stack local address.  The\nsender (do_mq_timedsend) uses this address to later call pipelined_send.\n\nThis leads to a very hard to trigger race where a do_mq_timedreceive\ncall might return and leave do_mq_timedsend to rely on an invalid\naddress, causing the following crash:\n\n  RIP: 0010:wake_q_add_safe+0x13/0x60\n  Call Trace:\n   __x64_sys_mq_timedsend+0x2a9/0x490\n   do_syscall_64+0x80/0x680\n   entry_SYSCALL_64_after_hwframe+0x44/0xa9\n  RIP: 0033:0x7f5928e40343\n\nThe race occurs as:\n\n1. do_mq_timedreceive calls wq_sleep with the address of `struct\n   ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it\n   holds a valid `struct ext_wait_queue *` as long as the stack has not\n   been overwritten.\n\n2. `ewq_addr` gets added to info-\u003ee_wait_q[RECV].list in wq_add, and\n   do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call\n   __pipelined_op.\n\n3. Sender calls __pipelined_op::smp_store_release(\u0026this-\u003estate,\n   STATE_READY).  Here is where the race window begins.  (`this` is\n   `ewq_addr`.)\n\n4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it\n   will see `state == STATE_READY` and break.\n\n5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed\n   to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive\u0027s\n   stack.  (Although the address may not get overwritten until another\n   function happens to touch it, which means it can persist around for an\n   indefinite time.)\n\n6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a\n   `struct ext_wait_queue *`, and uses it to find a task_struct to pass to\n   the wake_q_add_safe call.  In the lucky case where nothing has\n   overwritten `ewq_addr` yet, `ewq_addr-\u003etask` is the right task_struct.\n   In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a\n   bogus address as the receiver\u0027s task_struct causing the crash.\n\ndo_mq_timedsend::__pipelined_op() should not dereference `this` after\nsetting STATE_READY, as the receiver counterpart is now free to return.\nChange __pipelined_op to call wake_q_add_safe on the receiver\u0027s\ntask_struct returned by get_task_struct, instead of dereferencing `this`\nwhich sits on the receiver\u0027s stack.\n\nAs Manfred pointed out, the race potentially also exists in\nipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare.  Fix\nthose in the same way."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through local IPC syscalls (mq_timedsend/mq_timedreceive, msgsnd/msgrcv/msgctl, semop/semctl) and is not reachable by processing remote or adjacent-link network traffic.\nAC:L - The attacker fully controls both sides of the race by running concurrent sender and receiver (or RMID) operations on their own message queue or semaphore set, so success does not depend on an external condition outside their influence.\nPR:L - An unprivileged local user can mq_open/msgget/semget their own objects and exercise send/receive/RMID paths; CAP_SYS_RESOURCE is only needed to exceed resource limits, not to hit the vulnerable code.\nUI:N - The attacker performs the concurrent IPC operations themselves and does not need any separate victim or administrator action.\nS:U - This is a standard in-kernel stack use-after-free within the host OS authority and does not cross a VM, IOMMU, or other security boundary.\nC:H - The dangling stack pointer is reloaded into wake_q_add_safe as a task_struct *, and this stack UAF can be leveraged via stack reuse/heap primitives for arbitrary kernel memory disclosure under UAF scoring guidance.\nI:H - wake_q_add_safe/__wake_q_add perform cmpxchg and list writes through the attacker-influenced task pointer and may put_task_struct/wake_up_process on a bogus object, yielding write and control-flow hijack primitives.\nA:H - The issue was observed to crash in wake_q_add_safe with a bogus task_struct pointer, so kernel oops/panic availability impact is High even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:45:50.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4528c0c323085e645b8765913b4a7fd42cf49b65"
        },
        {
          "url": "https://git.kernel.org/stable/c/807fa14536b26803b858da878b643be72952a097"
        },
        {
          "url": "https://git.kernel.org/stable/c/a11ddb37bf367e6b5239b95ca759e5389bb46048"
        }
      ],
      "title": "ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47069",
    "datePublished": "2024-03-01T21:15:08.598Z",
    "dateReserved": "2024-02-29T22:33:44.296Z",
    "dateUpdated": "2026-08-05T08:45:50.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47073 (GCVE-0-2021-47073)

Vulnerability from cvelistv5 – Published: 2024-03-01 21:15 – Updated: 2026-05-11 13:47

Title

platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-05 22:11 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/75cfc833da4a21111…
https://git.kernel.org/stable/c/6fa78a6b9a3beb676…
https://git.kernel.org/stable/c/0cf036a0d325200e6…
https://git.kernel.org/stable/c/8d746ea7c687bab06…
https://git.kernel.org/stable/c/3a53587423d25c87a…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1a258e670434f404a4500b65ba1afea2c2b29bba , < 75cfc833da4a2111106d4c134e93e0c7f41e35e7 (git) Affected: 1a258e670434f404a4500b65ba1afea2c2b29bba , < 6fa78a6b9a3beb676a010dc489c1257f7e432525 (git) Affected: 1a258e670434f404a4500b65ba1afea2c2b29bba , < 0cf036a0d325200e6c27b90908e51195bbc557b1 (git) Affected: 1a258e670434f404a4500b65ba1afea2c2b29bba , < 8d746ea7c687bab060a2c05a35c449302406cd52 (git) Affected: 1a258e670434f404a4500b65ba1afea2c2b29bba , < 3a53587423d25c87af4b4126a806a0575104b45e (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 4.19.192 , ≤ 4.19.* (semver) Unaffected: 5.4.122 , ≤ 5.4.* (semver) Unaffected: 5.10.40 , ≤ 5.10.* (semver) Unaffected: 5.12.7 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T22:11:59.293322Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:13:23.078Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:24:39.704Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75cfc833da4a2111106d4c134e93e0c7f41e35e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6fa78a6b9a3beb676a010dc489c1257f7e432525"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0cf036a0d325200e6c27b90908e51195bbc557b1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8d746ea7c687bab060a2c05a35c449302406cd52"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a53587423d25c87af4b4126a806a0575104b45e"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell-smbios-wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75cfc833da4a2111106d4c134e93e0c7f41e35e7",
              "status": "affected",
              "version": "1a258e670434f404a4500b65ba1afea2c2b29bba",
              "versionType": "git"
            },
            {
              "lessThan": "6fa78a6b9a3beb676a010dc489c1257f7e432525",
              "status": "affected",
              "version": "1a258e670434f404a4500b65ba1afea2c2b29bba",
              "versionType": "git"
            },
            {
              "lessThan": "0cf036a0d325200e6c27b90908e51195bbc557b1",
              "status": "affected",
              "version": "1a258e670434f404a4500b65ba1afea2c2b29bba",
              "versionType": "git"
            },
            {
              "lessThan": "8d746ea7c687bab060a2c05a35c449302406cd52",
              "status": "affected",
              "version": "1a258e670434f404a4500b65ba1afea2c2b29bba",
              "versionType": "git"
            },
            {
              "lessThan": "3a53587423d25c87af4b4126a806a0575104b45e",
              "status": "affected",
              "version": "1a258e670434f404a4500b65ba1afea2c2b29bba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/dell/dell-smbios-wmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.192",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.122",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.40",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.7",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios\n\ninit_dell_smbios_wmi() only registers the dell_smbios_wmi_driver on systems\nwhere the Dell WMI interface is supported. While exit_dell_smbios_wmi()\nunregisters it unconditionally, this leads to the following oops:\n\n[  175.722921] ------------[ cut here ]------------\n[  175.722925] Unexpected driver unregister!\n[  175.722939] WARNING: CPU: 1 PID: 3630 at drivers/base/driver.c:194 driver_unregister+0x38/0x40\n...\n[  175.723089] Call Trace:\n[  175.723094]  cleanup_module+0x5/0xedd [dell_smbios]\n...\n[  175.723148] ---[ end trace 064c34e1ad49509d ]---\n\nMake the unregister happen on the same condition the register happens\nto fix this."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:47:33.478Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75cfc833da4a2111106d4c134e93e0c7f41e35e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fa78a6b9a3beb676a010dc489c1257f7e432525"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cf036a0d325200e6c27b90908e51195bbc557b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d746ea7c687bab060a2c05a35c449302406cd52"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a53587423d25c87af4b4126a806a0575104b45e"
        }
      ],
      "title": "platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47073",
    "datePublished": "2024-03-01T21:15:11.466Z",
    "dateReserved": "2024-02-29T22:33:44.297Z",
    "dateUpdated": "2026-05-11T13:47:33.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47236 (GCVE-0-2021-47236)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:19 – Updated: 2026-05-11 13:50

Title

net: cdc_eem: fix tx fixup skb leak

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:38 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/f12554b0ff639e746…
https://git.kernel.org/stable/c/14184ec5c958b589b…
https://git.kernel.org/stable/c/1bcacd6088d61c0ac…
https://git.kernel.org/stable/c/f4e6a7f19c82f39b1…
https://git.kernel.org/stable/c/81de2ed06df8b5451…
https://git.kernel.org/stable/c/05b2b9f7d24b5663d…
https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4…
https://git.kernel.org/stable/c/c3b26fdf1b32f91c7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < f12554b0ff639e74612cc01b3b4a049e098d2d65 (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < 14184ec5c958b589ba934da7363a2877879204df (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < 1bcacd6088d61c0ac6a990d87975600a81f3247e (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < f4e6a7f19c82f39b1803e91c54718f0d7143767d (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < 81de2ed06df8b5451e050fe6a318af3263dbff3f (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < 05b2b9f7d24b5663d9b47427fe1555bdafd3ea02 (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88 (git) Affected: 9f722c0978b04acba209f8ca1896ad05814bc3a3 , < c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7 (git)
Linux	Linux	Affected: 2.6.30 Unaffected: 0 , < 2.6.30 (semver) Unaffected: 4.4.274 , ≤ 4.4.* (semver) Unaffected: 4.9.274 , ≤ 4.9.* (semver) Unaffected: 4.14.238 , ≤ 4.14.* (semver) Unaffected: 4.19.196 , ≤ 4.19.* (semver) Unaffected: 5.4.128 , ≤ 5.4.* (semver) Unaffected: 5.10.46 , ≤ 5.10.* (semver) Unaffected: 5.12.13 , ≤ 5.12.* (semver) Unaffected: 5.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47236",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:01.951930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:39:57.883Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:07.941Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f12554b0ff639e74612cc01b3b4a049e098d2d65"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a2877879204df"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f4e6a7f19c82f39b1803e91c54718f0d7143767d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81de2ed06df8b5451e050fe6a318af3263dbff3f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_eem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f12554b0ff639e74612cc01b3b4a049e098d2d65",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "14184ec5c958b589ba934da7363a2877879204df",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "1bcacd6088d61c0ac6a990d87975600a81f3247e",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "f4e6a7f19c82f39b1803e91c54718f0d7143767d",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "81de2ed06df8b5451e050fe6a318af3263dbff3f",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "05b2b9f7d24b5663d9b47427fe1555bdafd3ea02",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            },
            {
              "lessThan": "c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7",
              "status": "affected",
              "version": "9f722c0978b04acba209f8ca1896ad05814bc3a3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/cdc_eem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.196",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.274",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.274",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.238",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.196",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.128",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.46",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: cdc_eem: fix tx fixup skb leak\n\nwhen usbnet transmit a skb, eem fixup it in eem_tx_fixup(),\nif skb_copy_expand() failed, it return NULL,\nusbnet_start_xmit() will have no chance to free original skb.\n\nfix it by free orginal skb in eem_tx_fixup() first,\nthen check skb clone status, if failed, return NULL to usbnet."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:50:35.712Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f12554b0ff639e74612cc01b3b4a049e098d2d65"
        },
        {
          "url": "https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a2877879204df"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4e6a7f19c82f39b1803e91c54718f0d7143767d"
        },
        {
          "url": "https://git.kernel.org/stable/c/81de2ed06df8b5451e050fe6a318af3263dbff3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4f7a9fc9d094c0c4a66f2ad7c37b1dbe9e78f88"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b26fdf1b32f91c7a3bc743384b4a298ab53ad7"
        }
      ],
      "title": "net: cdc_eem: fix tx fixup skb leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47236",
    "datePublished": "2024-05-21T14:19:37.724Z",
    "dateReserved": "2024-04-10T18:59:19.531Z",
    "dateUpdated": "2026-05-11T13:50:35.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47310 (GCVE-0-2021-47310)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-05-11 13:52

Title

net: ti: fix UAF in tlan_remove_one

Summary

In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlan_remove_one priv is netdev private data and it cannot be used after free_netdev() call. Using priv after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-21 15:35 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a18a8d9cfbb112ad7…
https://git.kernel.org/stable/c/c263ae8c7e4c48238…
https://git.kernel.org/stable/c/0538b0ab7d2c396e3…
https://git.kernel.org/stable/c/a0a817b2d308fac09…
https://git.kernel.org/stable/c/b7e5563f2a7862a9e…
https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0…
https://git.kernel.org/stable/c/93efab0ef2a607fff…
https://git.kernel.org/stable/c/0336f8ffece62f882…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < a18a8d9cfbb112ad72e625372849adc3986fd6bf (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < c263ae8c7e4c482387de5e6c89e213f8173fe8b6 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < 0538b0ab7d2c396e385694228c7cdcd2d2c514e9 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < a0a817b2d308fac090a05cbbe80988e073ac5193 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < b7e5563f2a7862a9e4796abb9908b092f677e3c1 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < 93efab0ef2a607fff9166d447c4035f98b5db342 (git) Affected: 1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa , < 0336f8ffece62f882ab3012820965a786a983f70 (git)
Linux	Linux	Affected: 3.10 Unaffected: 0 , < 3.10 (semver) Unaffected: 4.4.277 , ≤ 4.4.* (semver) Unaffected: 4.9.277 , ≤ 4.9.* (semver) Unaffected: 4.14.241 , ≤ 4.14.* (semver) Unaffected: 4.19.199 , ≤ 4.19.* (semver) Unaffected: 5.4.135 , ≤ 5.4.* (semver) Unaffected: 5.10.53 , ≤ 5.10.* (semver) Unaffected: 5.13.5 , ≤ 5.13.* (semver) Unaffected: 5.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47310",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T15:35:38.649783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:17.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.440Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a18a8d9cfbb112ad72e625372849adc3986fd6bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c263ae8c7e4c482387de5e6c89e213f8173fe8b6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a0a817b2d308fac090a05cbbe80988e073ac5193"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7e5563f2a7862a9e4796abb9908b092f677e3c1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0336f8ffece62f882ab3012820965a786a983f70"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/tlan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a18a8d9cfbb112ad72e625372849adc3986fd6bf",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "c263ae8c7e4c482387de5e6c89e213f8173fe8b6",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "0538b0ab7d2c396e385694228c7cdcd2d2c514e9",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "a0a817b2d308fac090a05cbbe80988e073ac5193",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "b7e5563f2a7862a9e4796abb9908b092f677e3c1",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "93efab0ef2a607fff9166d447c4035f98b5db342",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            },
            {
              "lessThan": "0336f8ffece62f882ab3012820965a786a983f70",
              "status": "affected",
              "version": "1e0a8b13d35510e711fdf72e9a3e30bcb2bd49fa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/ti/tlan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.277",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.277",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.241",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.199",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.135",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.53",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.5",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: fix UAF in tlan_remove_one\n\npriv is netdev private data and it cannot be\nused after free_netdev() call. Using priv after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:52:00.968Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a18a8d9cfbb112ad72e625372849adc3986fd6bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c263ae8c7e4c482387de5e6c89e213f8173fe8b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0538b0ab7d2c396e385694228c7cdcd2d2c514e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0a817b2d308fac090a05cbbe80988e073ac5193"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7e5563f2a7862a9e4796abb9908b092f677e3c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2a062fcfe1d6f1b0a86fa76ae21c277d65f4405"
        },
        {
          "url": "https://git.kernel.org/stable/c/93efab0ef2a607fff9166d447c4035f98b5db342"
        },
        {
          "url": "https://git.kernel.org/stable/c/0336f8ffece62f882ab3012820965a786a983f70"
        }
      ],
      "title": "net: ti: fix UAF in tlan_remove_one",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47310",
    "datePublished": "2024-05-21T14:35:28.649Z",
    "dateReserved": "2024-05-21T14:28:16.972Z",
    "dateUpdated": "2026-05-11T13:52:00.968Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47311 (GCVE-0-2021-47311)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-05-11 13:52

Title

net: qcom/emac: fix UAF in emac_remove

Summary

In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emac_remove adpt is netdev private data and it cannot be used after free_netdev() call. Using adpt after free_netdev() can cause UAF bug. Fix it by moving free_netdev() at the end of the function.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-19 18:50 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/4d04a42b926e68214…
https://git.kernel.org/stable/c/b1e091331920f8fbf…
https://git.kernel.org/stable/c/11e9d163d631198bb…
https://git.kernel.org/stable/c/2b70ca92847c619d6…
https://git.kernel.org/stable/c/b560521eca03d0a2d…
https://git.kernel.org/stable/c/8a225a6e07a57a153…
https://git.kernel.org/stable/c/ad297cd2db8953e22…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < 4d04a42b926e682140776e54188f4a44f1f01a81 (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < b1e091331920f8fbfc747dcbd16263fcd71abb2d (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < 11e9d163d631198bb3eb41a677a61b499516c0f7 (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < 2b70ca92847c619d6264c7372ef74fcbfd1e048c (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < b560521eca03d0a2db6093a5a632cbdd0a0cf833 (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < 8a225a6e07a57a1538d53637cb3d82bd3e477839 (git) Affected: 54e19bc74f3380d414681762ceed9f7245bc6a6e , < ad297cd2db8953e2202970e9504cab247b6c7cb4 (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 4.9.277 , ≤ 4.9.* (semver) Unaffected: 4.14.241 , ≤ 4.14.* (semver) Unaffected: 4.19.199 , ≤ 4.19.* (semver) Unaffected: 5.4.135 , ≤ 5.4.* (semver) Unaffected: 5.10.53 , ≤ 5.10.* (semver) Unaffected: 5.13.5 , ≤ 5.13.* (semver) Unaffected: 5.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.445Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47311",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-19T18:50:38.591727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-19T18:50:45.314Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qualcomm/emac/emac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d04a42b926e682140776e54188f4a44f1f01a81",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "b1e091331920f8fbfc747dcbd16263fcd71abb2d",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "11e9d163d631198bb3eb41a677a61b499516c0f7",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "2b70ca92847c619d6264c7372ef74fcbfd1e048c",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "b560521eca03d0a2db6093a5a632cbdd0a0cf833",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "8a225a6e07a57a1538d53637cb3d82bd3e477839",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            },
            {
              "lessThan": "ad297cd2db8953e2202970e9504cab247b6c7cb4",
              "status": "affected",
              "version": "54e19bc74f3380d414681762ceed9f7245bc6a6e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qualcomm/emac/emac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.277",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.277",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.241",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.199",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.135",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.53",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.5",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qcom/emac: fix UAF in emac_remove\n\nadpt is netdev private data and it cannot be\nused after free_netdev() call. Using adpt after free_netdev()\ncan cause UAF bug. Fix it by moving free_netdev() at the end of the\nfunction."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:52:02.532Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d04a42b926e682140776e54188f4a44f1f01a81"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1e091331920f8fbfc747dcbd16263fcd71abb2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/11e9d163d631198bb3eb41a677a61b499516c0f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b70ca92847c619d6264c7372ef74fcbfd1e048c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b560521eca03d0a2db6093a5a632cbdd0a0cf833"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a225a6e07a57a1538d53637cb3d82bd3e477839"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad297cd2db8953e2202970e9504cab247b6c7cb4"
        }
      ],
      "title": "net: qcom/emac: fix UAF in emac_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47311",
    "datePublished": "2024-05-21T14:35:29.304Z",
    "dateReserved": "2024-05-21T14:28:16.973Z",
    "dateUpdated": "2026-05-11T13:52:02.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47353 (GCVE-0-2021-47353)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-05-11 13:53

Title

udf: Fix NULL pointer dereference in udf_symlink function

Summary

In the Linux kernel, the following vulnerability has been resolved: udf: Fix NULL pointer dereference in udf_symlink function In function udf_symlink, epos.bh is assigned with the value returned by udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c and returns the value of sb_getblk function that could be NULL. Then, epos.bh is used without any check, causing a possible NULL pointer dereference when sb_getblk fails. This fix adds a check to validate the value of epos.bh.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-23 19:03 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/2f3d9ddd32a28803b…
https://git.kernel.org/stable/c/371566f63cbd0bb6f…
https://git.kernel.org/stable/c/baea588a42d675e35…
https://git.kernel.org/stable/c/3638705ecd5ad2785…
https://git.kernel.org/stable/c/80d505aee6398cf8b…
https://git.kernel.org/stable/c/21bf1414580c36ffc…
https://git.kernel.org/stable/c/aebed6b19e51a3400…
https://git.kernel.org/stable/c/5150877e4d99f8505…
https://git.kernel.org/stable/c/fa236c2b2d4436d9f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2f3d9ddd32a28803baa547e6274983b67d5e287c (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 371566f63cbd0bb6fbb25b8fe9d5798268d35af9 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < baea588a42d675e35daeaddd10fbc9700550bc4d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3638705ecd5ad2785e996f820121c0ad15ce64b5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 80d505aee6398cf8beb72475c7edcf1733c1c68b (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 21bf1414580c36ffc8d8de043beb3508cf812238 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < aebed6b19e51a34003d998da5ebb1dfdd2cb1d02 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5150877e4d99f85057a458daac7cd7c01005d5c6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 4.4.276 , ≤ 4.4.* (semver) Unaffected: 4.9.276 , ≤ 4.9.* (semver) Unaffected: 4.14.240 , ≤ 4.14.* (semver) Unaffected: 4.19.198 , ≤ 4.19.* (semver) Unaffected: 5.4.133 , ≤ 5.4.* (semver) Unaffected: 5.10.51 , ≤ 5.10.* (semver) Unaffected: 5.12.18 , ≤ 5.12.* (semver) Unaffected: 5.13.3 , ≤ 5.13.* (semver) Unaffected: 5.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47353",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T19:03:03.353127Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:14:54.819Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.447Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2f3d9ddd32a28803baa547e6274983b67d5e287c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/371566f63cbd0bb6fbb25b8fe9d5798268d35af9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/baea588a42d675e35daeaddd10fbc9700550bc4d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3638705ecd5ad2785e996f820121c0ad15ce64b5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/80d505aee6398cf8beb72475c7edcf1733c1c68b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21bf1414580c36ffc8d8de043beb3508cf812238"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aebed6b19e51a34003d998da5ebb1dfdd2cb1d02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5150877e4d99f85057a458daac7cd7c01005d5c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2f3d9ddd32a28803baa547e6274983b67d5e287c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "371566f63cbd0bb6fbb25b8fe9d5798268d35af9",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "baea588a42d675e35daeaddd10fbc9700550bc4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3638705ecd5ad2785e996f820121c0ad15ce64b5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "80d505aee6398cf8beb72475c7edcf1733c1c68b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "21bf1414580c36ffc8d8de043beb3508cf812238",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "aebed6b19e51a34003d998da5ebb1dfdd2cb1d02",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5150877e4d99f85057a458daac7cd7c01005d5c6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/udf/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.276",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.276",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.240",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.198",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.133",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.51",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.18",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudf: Fix NULL pointer dereference in udf_symlink function\n\nIn function udf_symlink, epos.bh is assigned with the value returned\nby udf_tgetblk. The function udf_tgetblk is defined in udf/misc.c\nand returns the value of sb_getblk function that could be NULL.\nThen, epos.bh is used without any check, causing a possible\nNULL pointer dereference when sb_getblk fails.\n\nThis fix adds a check to validate the value of epos.bh."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:53:03.838Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2f3d9ddd32a28803baa547e6274983b67d5e287c"
        },
        {
          "url": "https://git.kernel.org/stable/c/371566f63cbd0bb6fbb25b8fe9d5798268d35af9"
        },
        {
          "url": "https://git.kernel.org/stable/c/baea588a42d675e35daeaddd10fbc9700550bc4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3638705ecd5ad2785e996f820121c0ad15ce64b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/80d505aee6398cf8beb72475c7edcf1733c1c68b"
        },
        {
          "url": "https://git.kernel.org/stable/c/21bf1414580c36ffc8d8de043beb3508cf812238"
        },
        {
          "url": "https://git.kernel.org/stable/c/aebed6b19e51a34003d998da5ebb1dfdd2cb1d02"
        },
        {
          "url": "https://git.kernel.org/stable/c/5150877e4d99f85057a458daac7cd7c01005d5c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa236c2b2d4436d9f19ee4e5d5924e90ffd7bb43"
        }
      ],
      "title": "udf: Fix NULL pointer dereference in udf_symlink function",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47353",
    "datePublished": "2024-05-21T14:35:57.122Z",
    "dateReserved": "2024-05-21T14:28:16.986Z",
    "dateUpdated": "2026-05-11T13:53:03.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47356 (GCVE-0-2021-47356)

Vulnerability from cvelistv5 – Published: 2024-05-21 14:35 – Updated: 2026-05-11 13:53

Title

mISDN: fix possible use-after-free in HFC_cleanup()

Summary

In the Linux kernel, the following vulnerability has been resolved: mISDN: fix possible use-after-free in HFC_cleanup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-01-16 21:04 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/49331c07ef0f8fdfa…
https://git.kernel.org/stable/c/54ff3202928952a10…
https://git.kernel.org/stable/c/7867ddc5f3de7f289…
https://git.kernel.org/stable/c/5f2818185da0fe82a…
https://git.kernel.org/stable/c/3ecd228c636ee17c1…
https://git.kernel.org/stable/c/b7ee9ae1e0cf55a03…
https://git.kernel.org/stable/c/61370ff07e0acc657…
https://git.kernel.org/stable/c/ed7c3739d0a07e2ec…
https://git.kernel.org/stable/c/009fc857c5f6fda81…

Impacted products

20 products

Vendor	Product	Version
Linux	Linux	Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 54ff3202928952a100c477248e65ac6db01258a7 (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 7867ddc5f3de7f289aee63233afc0df4b62834c5 (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 5f2818185da0fe82a932f0856633038b66faf124 (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 3ecd228c636ee17c14662729737fa07242a93cb0 (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 61370ff07e0acc657559a8fac02551dfeb9d3020 (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda (git) Affected: 87c5fa1bb42624254a2013cbbc3b170d6017f5d6 , < 009fc857c5f6fda81f2f7dd851b2d54193a8e733 (git)
Linux	Linux	Affected: 2.6.29 Unaffected: 0 , < 2.6.29 (semver) Unaffected: 4.4.276 , ≤ 4.4.* (semver) Unaffected: 4.9.276 , ≤ 4.9.* (semver) Unaffected: 4.14.240 , ≤ 4.14.* (semver) Unaffected: 4.19.198 , ≤ 4.19.* (semver) Unaffected: 5.4.133 , ≤ 5.4.* (semver) Unaffected: 5.10.51 , ≤ 5.10.* (semver) Unaffected: 5.12.18 , ≤ 5.12.* (semver) Unaffected: 5.13.3 , ≤ 5.13.* (semver) Unaffected: 5.14 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 1da177e4c3f4 , < 49331c07ef0f (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 54ff32029289 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 7867ddc5f3de (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 5f2818185da0 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 3ecd228c636e (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < b7ee9ae1e0cf (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 61370ff07e0a (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < ed7c3739d0a0 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 009fc857c5f6 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.4.276 , ≤ 4.4.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.9.276 , ≤ 4.9.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.14.240 , ≤ 4.14.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.19.198 , ≤ 4.19.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.4.133 , ≤ 5.4.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.10.51 , ≤ 5.10.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.12.18 , ≤ 5.12.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.13.3 , ≤ 5.13.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.14 cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "49331c07ef0f",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "54ff32029289",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "7867ddc5f3de",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5f2818185da0",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3ecd228c636e",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "b7ee9ae1e0cf",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "61370ff07e0a",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "ed7c3739d0a0",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "009fc857c5f6",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.4.*",
                "status": "unaffected",
                "version": "4.4.276",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.9.*",
                "status": "unaffected",
                "version": "4.9.276",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.14.*",
                "status": "unaffected",
                "version": "4.14.240",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.19.*",
                "status": "unaffected",
                "version": "4.19.198",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.4.*",
                "status": "unaffected",
                "version": "5.4.133",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.51",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.12.*",
                "status": "unaffected",
                "version": "5.12.18",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.13.*",
                "status": "unaffected",
                "version": "5.13.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.14"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47356",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T21:04:48.759363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:05:18.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:32:08.504Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/isdn/hardware/mISDN/hfcpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "54ff3202928952a100c477248e65ac6db01258a7",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "7867ddc5f3de7f289aee63233afc0df4b62834c5",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "5f2818185da0fe82a932f0856633038b66faf124",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "3ecd228c636ee17c14662729737fa07242a93cb0",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "61370ff07e0acc657559a8fac02551dfeb9d3020",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            },
            {
              "lessThan": "009fc857c5f6fda81f2f7dd851b2d54193a8e733",
              "status": "affected",
              "version": "87c5fa1bb42624254a2013cbbc3b170d6017f5d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/isdn/hardware/mISDN/hfcpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.4.*",
              "status": "unaffected",
              "version": "4.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.12.*",
              "status": "unaffected",
              "version": "5.12.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.13.*",
              "status": "unaffected",
              "version": "5.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.276",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.276",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.240",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.198",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.133",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.51",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.12.18",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.13.3",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmISDN: fix possible use-after-free in HFC_cleanup()\n\nThis module\u0027s remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver\u0027s remove function\nhas finished, which would result in a use-after-free.\n\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:53:07.476Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49331c07ef0f8fdfa42b30ba6a83a657b29d7fbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/54ff3202928952a100c477248e65ac6db01258a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7867ddc5f3de7f289aee63233afc0df4b62834c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f2818185da0fe82a932f0856633038b66faf124"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ecd228c636ee17c14662729737fa07242a93cb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7ee9ae1e0cf55a037c4a99af2acc5d78cb7802d"
        },
        {
          "url": "https://git.kernel.org/stable/c/61370ff07e0acc657559a8fac02551dfeb9d3020"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7c3739d0a07e2ec3ccbffe7e93cea01c438cda"
        },
        {
          "url": "https://git.kernel.org/stable/c/009fc857c5f6fda81f2f7dd851b2d54193a8e733"
        }
      ],
      "title": "mISDN: fix possible use-after-free in HFC_cleanup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47356",
    "datePublished": "2024-05-21T14:35:59.097Z",
    "dateReserved": "2024-05-21T14:28:16.987Z",
    "dateUpdated": "2026-05-11T13:53:07.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:4211

CVE-2020-26555 (GCVE-0-2020-26555)

CVE-2021-46909 (GCVE-0-2021-46909)

CVE-2021-46972 (GCVE-0-2021-46972)

CVE-2021-47069 (GCVE-0-2021-47069)

CVE-2021-47073 (GCVE-0-2021-47073)

CVE-2021-47236 (GCVE-0-2021-47236)

CVE-2021-47310 (GCVE-0-2021-47310)

CVE-2021-47311 (GCVE-0-2021-47311)

CVE-2021-47353 (GCVE-0-2021-47353)

CVE-2021-47356 (GCVE-0-2021-47356)

Tags

Sightings

Nomenclature

Related by attack behaviour