Vulnerability-Lookup

RHSA-2024:4533

Vulnerability from csaf_redhat - Published: 2024-07-15 05:18 - Updated: 2026-08-18 20:56

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: tls: race between async notify and socket close (CVE-2024-26583) * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: Bluetooth: Avoid potential use-after-free in hci_error_reset (CVE-2024-26801) * kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (CVE-2024-26852) * kernel: icmp: prevent possible NULL dereferences from icmp_build_probe() (CVE-2024-35857) * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898) * kernel: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (CVE-2024-35969) * kernel: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (CVE-2024-36016) * kernel: netfilter: nf_tables: honor table dormant flag from netdev release event path (CVE-2024-36005) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-47548

A vulnerability was found in the Linux kernel's Hisilicon Ethernet driver, in the hns_dsaf_ge_srst_by_port() function, which allows for a possible array overflow, which occurs when an input value exceeds the expected range, leading to potential memory corruption.

6.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

CWE-129 - Improper Validation of Array Index

Affected products

Fixed 200 products

Product	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.73.1.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-284.73.1.el9_2.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-uki-virt-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.73.1.el9_2.x86_64	—	Vendor Fix fix Workaround

Known not affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-doc-0:5.14.0-284.73.1.el9_2.noarch		—	Workaround

Threats

Impact Moderate

CVE-2021-47596

A vulnerability was found in the Linux kernel's HNS3 network driver related to a use-after-free condition in the hclgevf_send_mbx_msg function. The issue occurs when the hns3_remove function uninstalls a client instance before uninstalling the acceleration engine device, leading to access of freed memory during the device's uninstall process, resulting in system crash.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2022-48627

A flaw was found in the Linux kernel's virtual terminal driver which causes a memory overlapping copy to occur, this overlapping copy can lead to data corruption and could potentially allow an attacker interacting with a virtual terminal to corrupt or expose system memory.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-1260 - Improper Handling of Overlap Between Protected Memory Ranges

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2023-52638

A vulnerability was found in the Linux kernel's Controller Area Network (CAN) protocol, within the J1939 protocol implementation. This issue occurs due to a potential deadlock caused by a race condition involving three locks: j1939_socks_lock, active_session_list_lock, and sk_session_queue_lock. This issue was identified in a Syzbot bug report.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-833 - Deadlock

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26583

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread that calls recvmsg/sendmsg may exit as soon as the async crypto handler calls complete(); any code past that point risks touching already freed data. This could lead to a use-after-free issue and a denial of service condition.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26585

A race condition vulnerability was found in the tls subsystem of the Linux kernel. The submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(), which could lead to undefined behavior and a denial of service.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26720

[REJECTED CVE]

0.0 (None)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CWE-369 - Divide By Zero

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

CVE-2024-26783

A vulnerability was found in the Linux kernel's memory management subsystem. The `wakeup_kswapd()` function was called with an incorrect zone index. This error could disrupt the proper functioning of memory management, potentially leading to system instability or performance issues.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-762 - Mismatched Memory Management Routines

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26801

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in how it handles hardware failure when it occurs. This flaw allows a local user to potentially crash the system.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-825 - Expired Pointer Dereference

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26852

A use-after-free flaw was found in ip6_route_mpath_notify() in the Linux kernel. This may lead to a crash.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-35857

A flaw was found in the Linux kernel's ICMP protocol. Under some conditions, a NULL pointer dereference can be triggered due to a missing check, causing a system crash and resulting in a denial of service.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-35898

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() The Linux kernel CVE team has assigned CVE-2024-35898 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051951-CVE-2024-35898-a10e@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-366 - Race Condition within a Thread

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-35969

This CVE addresses a race condition in the Linux kernel's IPv6 subsystem, specifically between the ipv6_get_ifaddr and ipv6_del_addr functions. This race condition can lead to use-after-free scenarios, potentially causing system instability or crashes.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-36005

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: honor table dormant flag from netdev release event path The Linux kernel CVE team has assigned CVE-2024-36005 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-36005-2336@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Low

CVE-2024-36016

A vulnerability was found in the Linux kernel's `n_gsm` driver, affecting the `tty` subsystem. It occurs when switching between basic and advanced option modes in GSM multiplexing, leading to potential out-of-bounds memory writes. This happens because certain state variables, like `gsm->len` and `gsm->state`, are not properly reset during mode changes. The issue could result in memory corruption.

6.4 (Medium)


                
                  CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-36886

A use-after-free (UAF) flaw exists in the Linux Kernel within the reassembly of fragmented TIPC messages, specifically in the tipc_buf_append() function. The issue results due to a lack of checks in the error handling cleanup and can trigger a UAF on "struct sk_buff", which may lead to remote code execution.

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 200 products, the same list as for CVE-2021-47548

Known not affected 1 product, the same list as for CVE-2021-47548

Threats

Impact Important

References

100 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:4533	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265517	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265520	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267509	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273082	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273141	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273466	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275761	external
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281247	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281669	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281900	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281949	external
https://bugzilla.redhat.com/show_bug.cgi?id=2283401	external
https://bugzilla.redhat.com/show_bug.cgi?id=2283894	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293230	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-47548	self
https://bugzilla.redhat.com/show_bug.cgi?id=2283401	external
https://www.cve.org/CVERecord?id=CVE-2021-47548	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47548	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47596	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293230	external
https://www.cve.org/CVERecord?id=CVE-2021-47596	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47596	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2022-48627	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267509	external
https://www.cve.org/CVERecord?id=CVE-2022-48627	external
https://nvd.nist.gov/vuln/detail/CVE-2022-48627	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52638	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273082	external
https://www.cve.org/CVERecord?id=CVE-2023-52638	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52638	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26583	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265520	external
https://www.cve.org/CVERecord?id=CVE-2024-26583	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26583	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26585	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265517	external
https://www.cve.org/CVERecord?id=CVE-2024-26585	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26585	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-26720	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273141	external
https://www.cve.org/CVERecord?id=CVE-2024-26720	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26720	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273466	external
https://www.cve.org/CVERecord?id=CVE-2024-26783	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26783	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26801	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273429	external
https://www.cve.org/CVERecord?id=CVE-2024-26801	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26801	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275761	external
https://www.cve.org/CVERecord?id=CVE-2024-26852	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26852	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-35857	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281247	external
https://www.cve.org/CVERecord?id=CVE-2024-35857	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35857	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35898	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281669	external
https://www.cve.org/CVERecord?id=CVE-2024-35898	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35898	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35969	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281900	external
https://www.cve.org/CVERecord?id=CVE-2024-35969	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35969	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36005	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281949	external
https://www.cve.org/CVERecord?id=CVE-2024-36005	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36005	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36016	self
https://bugzilla.redhat.com/show_bug.cgi?id=2283894	external
https://www.cve.org/CVERecord?id=CVE-2024-36016	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36016	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://www.cve.org/CVERecord?id=CVE-2024-36886	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36886	external
https://lore.kernel.org/all/752f1ccf762223d109845…	external
https://lore.kernel.org/linux-cve-announce/202405…	external

JSON

To clipboard

Loading 1.2 MB of JSON…

CVE-2021-47548 (GCVE-0-2021-47548)

Vulnerability from cvelistv5 – Published: 2024-05-24 15:09 – Updated: 2026-05-11 13:56

Title

ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

Summary

In the Linux kernel, the following vulnerability has been resolved: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() The if statement: if (port >= DSAF_GE_NUM) return; limits the value of port less than DSAF_GE_NUM (i.e., 8). However, if the value of port is 6 or 7, an array overflow could occur: port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off; because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6). To fix this possible array overflow, we first check port and if it is greater than or equal to DSAF_MAX_PORT_NUM, the function returns.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-05 14:45 UTC

CWE

CWE-129 - Improper Validation of Array Index

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/948968f8747650447…
https://git.kernel.org/stable/c/abbd5faa0748d0aa9…
https://git.kernel.org/stable/c/dd07f8971b81ad98c…
https://git.kernel.org/stable/c/99bb25cb6753beaf2…
https://git.kernel.org/stable/c/22519eff7df2d88ad…
https://git.kernel.org/stable/c/fc7ffa7f10b9454a8…
https://git.kernel.org/stable/c/a66998e0fbf213d47…

Impacted products

16 products

Vendor	Product	Version
Linux	Linux	Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < 948968f8747650447c8f21c9fdba0e1973be040b (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < abbd5faa0748d0aa95d5191d56ff7a17a6275bd1 (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < dd07f8971b81ad98cc754b179b331b57f35aa1ff (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < 99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < 22519eff7df2d88adcc2568d86046ce1e2b52803 (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < fc7ffa7f10b9454a86369405d9814bf141b30627 (git) Affected: 850bfa3b78ea8849fef78ed74f5f2ccf947db0ca , < a66998e0fbf213d47d02813b9679426129d0d114 (git)
Linux	Linux	Affected: 4.7 Unaffected: 0 , < 4.7 (semver) Unaffected: 4.9.292 , ≤ 4.9.* (semver) Unaffected: 4.14.257 , ≤ 4.14.* (semver) Unaffected: 4.19.220 , ≤ 4.19.* (semver) Unaffected: 5.4.164 , ≤ 5.4.* (semver) Unaffected: 5.10.84 , ≤ 5.10.* (semver) Unaffected: 5.15.7 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 1da177e4c3f4 , < 948968f87476 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < abbd5faa0748 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < dd07f8971b81 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 99bb25cb6753 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < 22519eff7df2 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < fc7ffa7f10b9 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 1da177e4c3f4 , < a66998e0fbf2 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.9.292 , ≤ 4.9.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.14.257 , ≤ 4.14* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.19.220 , ≤ 4.19.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.4.164 , ≤ 5.4.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.10.84 , ≤ 5.10.* (custom) cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	Unaffected: 5.15.7 , ≤ 5.15.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.16 cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "948968f87476",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "abbd5faa0748",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "dd07f8971b81",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "99bb25cb6753",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "22519eff7df2",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "fc7ffa7f10b9",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "a66998e0fbf2",
                "status": "affected",
                "version": "1da177e4c3f4",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.9.*",
                "status": "unaffected",
                "version": "4.9.292",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.14*",
                "status": "unaffected",
                "version": "4.14.257",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "4.19.*",
                "status": "unaffected",
                "version": "4.19.220",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.4.*",
                "status": "unaffected",
                "version": "5.4.164",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.10.*",
                "status": "unaffected",
                "version": "5.10.84",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.15.*",
                "status": "unaffected",
                "version": "5.15.7",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "5.16"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47548",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T14:45:02.339644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-129",
                "description": "CWE-129 Improper Validation of Array Index",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T14:45:10.947Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/948968f8747650447c8f21c9fdba0e1973be040b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/abbd5faa0748d0aa95d5191d56ff7a17a6275bd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd07f8971b81ad98cc754b179b331b57f35aa1ff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22519eff7df2d88adcc2568d86046ce1e2b52803"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc7ffa7f10b9454a86369405d9814bf141b30627"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a66998e0fbf213d47d02813b9679426129d0d114"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "948968f8747650447c8f21c9fdba0e1973be040b",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "abbd5faa0748d0aa95d5191d56ff7a17a6275bd1",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "dd07f8971b81ad98cc754b179b331b57f35aa1ff",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "22519eff7df2d88adcc2568d86046ce1e2b52803",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "fc7ffa7f10b9454a86369405d9814bf141b30627",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            },
            {
              "lessThan": "a66998e0fbf213d47d02813b9679426129d0d114",
              "status": "affected",
              "version": "850bfa3b78ea8849fef78ed74f5f2ccf947db0ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns/hns_dsaf_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.257",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.292",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.257",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.220",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.164",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.84",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.7",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()\n\nThe if statement:\n  if (port \u003e= DSAF_GE_NUM)\n        return;\n\nlimits the value of port less than DSAF_GE_NUM (i.e., 8).\nHowever, if the value of port is 6 or 7, an array overflow could occur:\n  port_rst_off = dsaf_dev-\u003emac_cb[port]-\u003eport_rst_off;\n\nbecause the length of dsaf_dev-\u003emac_cb is DSAF_MAX_PORT_NUM (i.e., 6).\n\nTo fix this possible array overflow, we first check port and if it is\ngreater than or equal to DSAF_MAX_PORT_NUM, the function returns."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:56:45.302Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/948968f8747650447c8f21c9fdba0e1973be040b"
        },
        {
          "url": "https://git.kernel.org/stable/c/abbd5faa0748d0aa95d5191d56ff7a17a6275bd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd07f8971b81ad98cc754b179b331b57f35aa1ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/99bb25cb6753beaf2c2bc37927c2ecc0ceff3f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/22519eff7df2d88adcc2568d86046ce1e2b52803"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc7ffa7f10b9454a86369405d9814bf141b30627"
        },
        {
          "url": "https://git.kernel.org/stable/c/a66998e0fbf213d47d02813b9679426129d0d114"
        }
      ],
      "title": "ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47548",
    "datePublished": "2024-05-24T15:09:52.634Z",
    "dateReserved": "2024-05-24T15:02:54.829Z",
    "dateUpdated": "2026-05-11T13:56:45.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-47596 (GCVE-0-2021-47596)

Vulnerability from cvelistv5 – Published: 2024-06-19 14:53 – Updated: 2026-05-11 13:57

Title

net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg

Summary

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg Currently, the hns3_remove function firstly uninstall client instance, and then uninstall acceletion engine device. The netdevice is freed in client instance uninstall process, but acceletion engine device uninstall process still use it to trace runtime information. This causes a use after free problem. So fixes it by check the instance register state to avoid use after free.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:12 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/12512bc8f25b8ba97…
https://git.kernel.org/stable/c/4f4a353f6fe033807…
https://git.kernel.org/stable/c/27cbf64a766e86f06…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d8355240cf8fb8b9e002b5c8458578435cea85c2 , < 12512bc8f25b8ba9795dfbae0e9ca57ff13fd542 (git) Affected: d8355240cf8fb8b9e002b5c8458578435cea85c2 , < 4f4a353f6fe033807cd026a5de81c67469ff19b0 (git) Affected: d8355240cf8fb8b9e002b5c8458578435cea85c2 , < 27cbf64a766e86f068ce6214f04c00ceb4db1af4 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.88 , ≤ 5.10.* (semver) Unaffected: 5.15.11 , ≤ 5.15.* (semver) Unaffected: 5.16 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:47:39.492Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12512bc8f25b8ba9795dfbae0e9ca57ff13fd542"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4f4a353f6fe033807cd026a5de81c67469ff19b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/27cbf64a766e86f068ce6214f04c00ceb4db1af4"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-47596",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:12:27.308735Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:52.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12512bc8f25b8ba9795dfbae0e9ca57ff13fd542",
              "status": "affected",
              "version": "d8355240cf8fb8b9e002b5c8458578435cea85c2",
              "versionType": "git"
            },
            {
              "lessThan": "4f4a353f6fe033807cd026a5de81c67469ff19b0",
              "status": "affected",
              "version": "d8355240cf8fb8b9e002b5c8458578435cea85c2",
              "versionType": "git"
            },
            {
              "lessThan": "27cbf64a766e86f068ce6214f04c00ceb4db1af4",
              "status": "affected",
              "version": "d8355240cf8fb8b9e002b5c8458578435cea85c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.88",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.11",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix use-after-free bug in hclgevf_send_mbx_msg\n\nCurrently, the hns3_remove function firstly uninstall client instance,\nand then uninstall acceletion engine device. The netdevice is freed in\nclient instance uninstall process, but acceletion engine device uninstall\nprocess still use it to trace runtime information. This causes a use after\nfree problem.\n\nSo fixes it by check the instance register state to avoid use after free."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:57:35.996Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12512bc8f25b8ba9795dfbae0e9ca57ff13fd542"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f4a353f6fe033807cd026a5de81c67469ff19b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/27cbf64a766e86f068ce6214f04c00ceb4db1af4"
        }
      ],
      "title": "net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47596",
    "datePublished": "2024-06-19T14:53:58.243Z",
    "dateReserved": "2024-05-24T15:11:00.733Z",
    "dateUpdated": "2026-05-11T13:57:35.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-48627 (GCVE-0-2022-48627)

Vulnerability from cvelistv5 – Published: 2024-03-02 21:31 – Updated: 2026-05-11 18:43

Title

vt: fix memory overlapping when deleting chars in the buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic. Fix this problem by using replacing the scr_memcpyw with scr_memmovew.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-12 14:23 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/c8686c014b5e872ba…
https://git.kernel.org/stable/c/815be99d934e32929…
https://git.kernel.org/stable/c/bfee93c9a6c395f9a…
https://git.kernel.org/stable/c/57964a5710252bc82…
https://git.kernel.org/stable/c/14d2cc21ca622310b…
https://git.kernel.org/stable/c/39cdb68c64d84e71a…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < c8686c014b5e872ba7e334f33ca553f14446fc29 (git) Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < 815be99d934e3292906536275f2b8d5131cdf52c (git) Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < bfee93c9a6c395f9aa62268f1cedf64999844926 (git) Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < 57964a5710252bc82fe22d9fa98c180c58c20244 (git) Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < 14d2cc21ca622310babf373e3a8f0b40acfe8265 (git) Affected: 81732c3b2fede049a692e58a7ceabb6d18ffb18c , < 39cdb68c64d84e71a4a717000b6e5de208ee60cc (git)
Linux	Linux	Affected: 3.7 Unaffected: 0 , < 3.7 (semver) Unaffected: 4.19.312 , ≤ 4.19.* (semver) Unaffected: 5.4.274 , ≤ 5.4.* (semver) Unaffected: 5.10.132 , ≤ 5.10.* (semver) Unaffected: 5.15.56 , ≤ 5.15.* (semver) Unaffected: 5.18.13 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48627",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-12T14:23:17.504508Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:04:55.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.441Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8686c014b5e872ba7e334f33ca553f14446fc29"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/815be99d934e3292906536275f2b8d5131cdf52c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bfee93c9a6c395f9aa62268f1cedf64999844926"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/57964a5710252bc82fe22d9fa98c180c58c20244"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/14d2cc21ca622310babf373e3a8f0b40acfe8265"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39cdb68c64d84e71a4a717000b6e5de208ee60cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c8686c014b5e872ba7e334f33ca553f14446fc29",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            },
            {
              "lessThan": "815be99d934e3292906536275f2b8d5131cdf52c",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            },
            {
              "lessThan": "bfee93c9a6c395f9aa62268f1cedf64999844926",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            },
            {
              "lessThan": "57964a5710252bc82fe22d9fa98c180c58c20244",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            },
            {
              "lessThan": "14d2cc21ca622310babf373e3a8f0b40acfe8265",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            },
            {
              "lessThan": "39cdb68c64d84e71a4a717000b6e5de208ee60cc",
              "status": "affected",
              "version": "81732c3b2fede049a692e58a7ceabb6d18ffb18c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.312",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.312",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.274",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.132",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.56",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.13",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: fix memory overlapping when deleting chars in the buffer\n\nA memory overlapping copy occurs when deleting a long line. This memory\noverlapping copy can cause data corruption when scr_memcpyw is optimized\nto memcpy because memcpy does not ensure its behavior if the destination\nbuffer overlaps with the source buffer. The line buffer is not always\nbroken, because the memcpy utilizes the hardware acceleration, whose\nresult is not deterministic.\n\nFix this problem by using replacing the scr_memcpyw with scr_memmovew."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:43:59.424Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c8686c014b5e872ba7e334f33ca553f14446fc29"
        },
        {
          "url": "https://git.kernel.org/stable/c/815be99d934e3292906536275f2b8d5131cdf52c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfee93c9a6c395f9aa62268f1cedf64999844926"
        },
        {
          "url": "https://git.kernel.org/stable/c/57964a5710252bc82fe22d9fa98c180c58c20244"
        },
        {
          "url": "https://git.kernel.org/stable/c/14d2cc21ca622310babf373e3a8f0b40acfe8265"
        },
        {
          "url": "https://git.kernel.org/stable/c/39cdb68c64d84e71a4a717000b6e5de208ee60cc"
        }
      ],
      "title": "vt: fix memory overlapping when deleting chars in the buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48627",
    "datePublished": "2024-03-02T21:31:48.383Z",
    "dateReserved": "2024-02-25T13:44:28.314Z",
    "dateUpdated": "2026-05-11T18:43:59.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52638 (GCVE-0-2023-52638)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:54 – Updated: 2026-05-11 19:30

Title

can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock

Summary

In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks_lock - active_session_list_lock - sk_session_queue_lock A reasonable fix is to change j1939_socks_lock to an rwlock, since in the rare situations where a write lock is required for the linked list that j1939_socks_lock is protecting, the code does not attempt to acquire any more locks. This would break the circular lock dependency, where, for example, the current thread already locks j1939_socks_lock and attempts to acquire sk_session_queue_lock, and at the same time, another thread attempts to acquire j1939_socks_lock while holding sk_session_queue_lock. NOTE: This patch along does not fix the unregister_netdevice bug reported by Syzbot; instead, it solves a deadlock situation to prepare for one or more further patches to actually fix the Syzbot bug, which appears to be a reference counting problem within the j1939 codebase. [mkl: remove unrelated newline change]

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 19:30 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/03358aba991668d3b…
https://git.kernel.org/stable/c/aedda066d717a0b43…
https://git.kernel.org/stable/c/26dfe112ec2e95fe0…
https://git.kernel.org/stable/c/559b6322f9480bff6…
https://git.kernel.org/stable/c/6cdedc18ba7b9dacc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5b9272e93f2efe3f6cda60cc2c26817b2ce49386 , < 03358aba991668d3bb2c65b3c82aa32c36851170 (git) Affected: 5b9272e93f2efe3f6cda60cc2c26817b2ce49386 , < aedda066d717a0b4335d7e0a00b2e3a61e40afcf (git) Affected: 5b9272e93f2efe3f6cda60cc2c26817b2ce49386 , < 26dfe112ec2e95fe0099681f6aec33da13c2dd8e (git) Affected: 5b9272e93f2efe3f6cda60cc2c26817b2ce49386 , < 559b6322f9480bff68cfa98d108991e945a4f284 (git) Affected: 5b9272e93f2efe3f6cda60cc2c26817b2ce49386 , < 6cdedc18ba7b9dacc36466e27e3267d201948c8d (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T19:30:24.987517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T19:57:30.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/03358aba991668d3bb2c65b3c82aa32c36851170"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aedda066d717a0b4335d7e0a00b2e3a61e40afcf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/26dfe112ec2e95fe0099681f6aec33da13c2dd8e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/559b6322f9480bff68cfa98d108991e945a4f284"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6cdedc18ba7b9dacc36466e27e3267d201948c8d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/can/j1939/j1939-priv.h",
            "net/can/j1939/main.c",
            "net/can/j1939/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03358aba991668d3bb2c65b3c82aa32c36851170",
              "status": "affected",
              "version": "5b9272e93f2efe3f6cda60cc2c26817b2ce49386",
              "versionType": "git"
            },
            {
              "lessThan": "aedda066d717a0b4335d7e0a00b2e3a61e40afcf",
              "status": "affected",
              "version": "5b9272e93f2efe3f6cda60cc2c26817b2ce49386",
              "versionType": "git"
            },
            {
              "lessThan": "26dfe112ec2e95fe0099681f6aec33da13c2dd8e",
              "status": "affected",
              "version": "5b9272e93f2efe3f6cda60cc2c26817b2ce49386",
              "versionType": "git"
            },
            {
              "lessThan": "559b6322f9480bff68cfa98d108991e945a4f284",
              "status": "affected",
              "version": "5b9272e93f2efe3f6cda60cc2c26817b2ce49386",
              "versionType": "git"
            },
            {
              "lessThan": "6cdedc18ba7b9dacc36466e27e3267d201948c8d",
              "status": "affected",
              "version": "5b9272e93f2efe3f6cda60cc2c26817b2ce49386",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/can/j1939/j1939-priv.h",
            "net/can/j1939/main.c",
            "net/can/j1939/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: j1939: prevent deadlock by changing j1939_socks_lock to rwlock\n\nThe following 3 locks would race against each other, causing the\ndeadlock situation in the Syzbot bug report:\n\n- j1939_socks_lock\n- active_session_list_lock\n- sk_session_queue_lock\n\nA reasonable fix is to change j1939_socks_lock to an rwlock, since in\nthe rare situations where a write lock is required for the linked list\nthat j1939_socks_lock is protecting, the code does not attempt to\nacquire any more locks. This would break the circular lock dependency,\nwhere, for example, the current thread already locks j1939_socks_lock\nand attempts to acquire sk_session_queue_lock, and at the same time,\nanother thread attempts to acquire j1939_socks_lock while holding\nsk_session_queue_lock.\n\nNOTE: This patch along does not fix the unregister_netdevice bug\nreported by Syzbot; instead, it solves a deadlock situation to prepare\nfor one or more further patches to actually fix the Syzbot bug, which\nappears to be a reference counting problem within the j1939 codebase.\n\n[mkl: remove unrelated newline change]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:30:50.170Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03358aba991668d3bb2c65b3c82aa32c36851170"
        },
        {
          "url": "https://git.kernel.org/stable/c/aedda066d717a0b4335d7e0a00b2e3a61e40afcf"
        },
        {
          "url": "https://git.kernel.org/stable/c/26dfe112ec2e95fe0099681f6aec33da13c2dd8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/559b6322f9480bff68cfa98d108991e945a4f284"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cdedc18ba7b9dacc36466e27e3267d201948c8d"
        }
      ],
      "title": "can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52638",
    "datePublished": "2024-04-03T14:54:41.271Z",
    "dateReserved": "2024-03-06T09:52:12.093Z",
    "dateUpdated": "2026-05-11T19:30:50.170Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26583 (GCVE-0-2024-26583)

Vulnerability from cvelistv5 – Published: 2024-02-21 14:59 – Updated: 2026-08-05 11:26

Title

tls: fix race between async notify and socket close

Summary

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-02-22 16:41 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/f17d21ea73918ace8…
https://git.kernel.org/stable/c/7a3ca06d04d589dee…
https://git.kernel.org/stable/c/86dc27ee36f558fe2…
https://git.kernel.org/stable/c/6209319b2efdd8524…
https://git.kernel.org/stable/c/aec7961916f3f9e88…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0cada33241d9de205522e3858b18e506ca5cce2c , < f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7 (git) Affected: 0cada33241d9de205522e3858b18e506ca5cce2c , < 7a3ca06d04d589deec81f56229a9a9d62352ce01 (git) Affected: 0cada33241d9de205522e3858b18e506ca5cce2c , < 86dc27ee36f558fe223dbdfbfcb6856247356f4a (git) Affected: 0cada33241d9de205522e3858b18e506ca5cce2c , < 6209319b2efdd8524691187ee99c40637558fa33 (git) Affected: 0cada33241d9de205522e3858b18e506ca5cce2c , < aec7961916f3f9e88766e2688992da6980f11b8d (git) Affected: cf4cc95a15f599560c7abd89095a7973a4b9cec3 (git) Affected: 9b81d43da15e56ed89f083f326561acdcaf549ce (git) Affected: 5.4.44 , < 5.5 (semver) Affected: 5.6.16 , < 5.7 (semver)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.15.160 , ≤ 5.15.* (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26583",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-22T16:41:40.480459Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:01.043Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:29:46.349Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "7a3ca06d04d589deec81f56229a9a9d62352ce01",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "86dc27ee36f558fe223dbdfbfcb6856247356f4a",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "6209319b2efdd8524691187ee99c40637558fa33",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "lessThan": "aec7961916f3f9e88766e2688992da6980f11b8d",
              "status": "affected",
              "version": "0cada33241d9de205522e3858b18e506ca5cce2c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf4cc95a15f599560c7abd89095a7973a4b9cec3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9b81d43da15e56ed89f083f326561acdcaf549ce",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.44",
              "versionType": "semver"
            },
            {
              "lessThan": "5.7",
              "status": "affected",
              "version": "5.6.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tls.h",
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.160",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between async notify and socket close\n\nThe submitting thread (one which called recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete()\nso any code past that point risks touching already freed data.\n\nTry to avoid the locking and extra flags altogether.\nHave the main thread hold an extra reference, this way\nwe can depend solely on the atomic ref counter for\nsynchronization.\n\nDon\u0027t futz with reiniting the completion, either, we are now\ntightly controlling when completion fires."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is kTLS record processing (`net/tls/tls_sw.c`); the RX-side race is driven by TLS records sent by the remote peer of a kTLS-offloaded socket (kTLS HTTPS servers, NVMe-TCP/TLS), which controls how many async decryptions are in flight and when the final completion fires. Per kernel scoring guidance, kTLS bugs triggered by remote peer data are Network.\nAC:L - The attacker controls both sides of the race \u2014 it supplies the data that triggers the async crypto completions and drives the socket teardown (locally via its own close(), remotely by ending the request/connection so the server closes) \u2014 and can retry across thousands of concurrent connections until the window is won.\nPR:N - There is no capability or authorization check anywhere in net/tls; a remote peer of a public kTLS server needs no credentials, and a local attacker needs only an ordinary unprivileged socket to set the TLS ULP and install keys.\nUI:N - No victim action is required; the socket close that closes the race is ordinary application behavior the attacker induces, not a user-performed operation.\nS:U - The corruption is confined to kernel slab memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed `tls_sw_context_rx`/`tls_sw_context_tx` comes from a generic kmalloc cache and can be reclaimed by attacker-controlled objects, so the use-after-free gives control over freed-object contents and can be leveraged for kernel memory disclosure.\nI:H - The callback performs writes into the freed object (`spin_unlock_bh`, `test_and_set_bit` on `tx_bitmask`) and queues a `delayed_work` residing in freed memory whose function pointer is later dereferenced, yielding heap corruption at known offsets and a control-flow hijack primitive.\nA:H - The use-after-free reliably produces slab corruption, oopses and panics, and the lost-wakeup half of the race can leave the submitting thread blocked forever in uninterruptible sleep holding the socket."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:02.205Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
        },
        {
          "url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
        },
        {
          "url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
        }
      ],
      "title": "tls: fix race between async notify and socket close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26583",
    "datePublished": "2024-02-21T14:59:11.845Z",
    "dateReserved": "2024-02-19T14:20:24.125Z",
    "dateUpdated": "2026-08-05T11:26:02.205Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26585 (GCVE-0-2024-26585)

Vulnerability from cvelistv5 – Published: 2024-02-21 14:59 – Updated: 2026-08-05 11:26

Title

tls: fix race between tx work scheduling and socket close

Summary

In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). Reorder scheduling the work before calling complete(). This seems more logical in the first place, as it's the inverse order of what the submitting thread will do.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-28 17:07 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/dd32621f19243f89c…
https://git.kernel.org/stable/c/196f198ca6fce04ba…
https://git.kernel.org/stable/c/6db22d6c7a6dc914b…
https://git.kernel.org/stable/c/e327ed60bff4a991c…
https://git.kernel.org/stable/c/e01e3934a1b2d1229…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a42055e8d2c30d4decfc13ce943d09c7b9dad221 , < dd32621f19243f89ce830919496a5dcc2158aa33 (git) Affected: a42055e8d2c30d4decfc13ce943d09c7b9dad221 , < 196f198ca6fce04ba6ce262f5a0e4d567d7d219d (git) Affected: a42055e8d2c30d4decfc13ce943d09c7b9dad221 , < 6db22d6c7a6dc914b12c0469b94eb639b6a8a146 (git) Affected: a42055e8d2c30d4decfc13ce943d09c7b9dad221 , < e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57 (git) Affected: a42055e8d2c30d4decfc13ce943d09c7b9dad221 , < e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26585",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-28T17:07:29.305466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-28T17:07:36.266Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:29:48.732Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd32621f19243f89ce830919496a5dcc2158aa33",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "196f198ca6fce04ba6ce262f5a0e4d567d7d219d",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "6db22d6c7a6dc914b12c0469b94eb639b6a8a146",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            },
            {
              "lessThan": "e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb",
              "status": "affected",
              "version": "a42055e8d2c30d4decfc13ce943d09c7b9dad221",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between tx work scheduling and socket close\n\nSimilarly to previous commit, the submitting thread (recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete().\nReorder scheduling the work before calling complete().\nThis seems more logical in the first place, as it\u0027s\nthe inverse order of what the submitting thread will do."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the net/tls software TX path of a kTLS-terminating server, where the encrypt-then-close sequence is driven entirely by remote client traffic (request eliciting a response plus `Connection: close`/RST), and the remote peer additionally controls whether records stay queued at the head of tx_list via its TCP receive window, which is the precondition for reaching the post-complete() code. No local access to the target is needed.\nAC:L - The attacker controls both sides of the race \u2014 one side issues the sendmsg that leaves an async encryption in flight, the other issues the close that blocks in tls_encrypt_async_wait() and then frees ctx \u2014 and can retry across thousands of concurrent connections at no cost. No memory layout or victim state outside the attacker\u0027s influence is required.\nPR:N - A kTLS-offloading HTTPS server accepts connections from arbitrary unauthenticated clients with no client certificate in the typical deployment; locally, setsockopt(TCP_ULP,\"tls\") plus TLS_TX requires no capability at all once the tls module is loaded. Neither path needs an account or privilege on the target.\nUI:N - The race fires during ordinary kTLS record encryption and socket teardown on an established connection. No action by any local user or administrator is required.\nS:U - The use-after-free on struct tls_sw_context_tx and the resulting timer/workqueue corruption all occur in kernel memory managed by the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - After kfree(ctx) the callback and the later timer expiry re-read freed, attacker-groomable memory \u2014 timer-\u003efunction, dwork-\u003ewq, and tx_work-\u003esk, the last of which is dereferenced as a struct sock * by tx_work_handler/tls_tx_records. Controlling that fake sock and the redirected call is leverageable into arbitrary kernel memory disclosure.\nI:H - The stale callback performs an atomic bit-set into the reallocated slab object at a fixed offset and writes dwork-\u003ewq, dwork-\u003ecpu and timer-\u003eexpires into freed memory, then links that freed object into the global timer wheel. That yields a controlled heap write plus a function pointer read from reclaimed memory, i.e. a control-flow hijack primitive.\nA:H - Arming a delayed_work inside a freed slab object after cancel_delayed_work_sync() reliably produces slab and timer-wheel corruption, and tx_work_handler running against an already-freed TLS context oopses on the stale sk. Any of these panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:04.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd32621f19243f89ce830919496a5dcc2158aa33"
        },
        {
          "url": "https://git.kernel.org/stable/c/196f198ca6fce04ba6ce262f5a0e4d567d7d219d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6db22d6c7a6dc914b12c0469b94eb639b6a8a146"
        },
        {
          "url": "https://git.kernel.org/stable/c/e327ed60bff4a991cd7a709c47c4f0c5b4a4fd57"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01e3934a1b2d122919f73bc6ddbe1cdafc4bbdb"
        }
      ],
      "title": "tls: fix race between tx work scheduling and socket close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26585",
    "datePublished": "2024-02-21T14:59:13.088Z",
    "dateReserved": "2024-02-19T14:20:24.125Z",
    "dateUpdated": "2026-08-05T11:26:04.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26720 (GCVE-0-2024-26720)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:55 – Updated: 2024-12-19 11:15

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-12-19T11:15:27.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26720",
    "datePublished": "2024-04-03T14:55:20.286Z",
    "dateRejected": "2024-12-19T11:15:27.766Z",
    "dateReserved": "2024-02-19T14:20:24.161Z",
    "dateUpdated": "2024-12-19T11:15:27.766Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26783 (GCVE-0-2024-26783)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-09-08 08:38

Title

mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa node doesn't have its local memory so it has no managed zones, the following oops has been observed. It's because wakeup_kswapd() is called with a wrong zone index, -1. Fixed it by checking the index before calling wakeup_kswapd(). > BUG: unable to handle page fault for address: 00000000000033f3 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops: 0000 [#1] PREEMPT SMP NOPTI > CPU: 2 PID: 895 Comm: masim Not tainted 6.6.0-dirty #255 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > RIP: 0010:wakeup_kswapd (./linux/mm/vmscan.c:7812) > Code: (omitted) > RSP: 0000:ffffc90004257d58 EFLAGS: 00010286 > RAX: ffffffffffffffff RBX: ffff88883fff0480 RCX: 0000000000000003 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88883fff0480 > RBP: ffffffffffffffff R08: ff0003ffffffffff R09: ffffffffffffffff > R10: ffff888106c95540 R11: 0000000055555554 R12: 0000000000000003 > R13: 0000000000000000 R14: 0000000000000000 R15: ffff88883fff0940 > FS: 00007fc4b8124740(0000) GS:ffff888827c00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000033f3 CR3: 000000026cc08004 CR4: 0000000000770ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > <TASK> > ? __die > ? page_fault_oops > ? __pte_offset_map_lock > ? exc_page_fault > ? asm_exc_page_fault > ? wakeup_kswapd > migrate_misplaced_page > __handle_mm_fault > handle_mm_fault > do_user_addr_fault > exc_page_fault > asm_exc_page_fault > RIP: 0033:0x55b897ba0808 > Code: (omitted) > RSP: 002b:00007ffeefa821a0 EFLAGS: 00010287 > RAX: 000055b89983acd0 RBX: 00007ffeefa823f8 RCX: 000055b89983acd0 > RDX: 00007fc2f8122010 RSI: 0000000000020000 RDI: 000055b89983acd0 > RBP: 00007ffeefa821a0 R08: 0000000000000037 R09: 0000000000000075 > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 > R13: 00007ffeefa82410 R14: 000055b897ba5dd8 R15: 00007fc4b8340000 > </TASK>

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-04 16:20 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/e5ec1c24e71dbf144…
https://git.kernel.org/stable/c/d6159bd4c00594249…
https://git.kernel.org/stable/c/bdd21eed8b72f9e28…
https://git.kernel.org/stable/c/2774f256e7c0219e2…
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

5 products

Vendor	Product	Version
Linux	Linux	Affected: c574bbe917036c8968b984c82c7b13194fe5ce98 , < e5ec1c24e71dbf144677a975d6ba91043c2193db (git) Affected: c574bbe917036c8968b984c82c7b13194fe5ce98 , < d6159bd4c00594249e305bfe02304c67c506264e (git) Affected: c574bbe917036c8968b984c82c7b13194fe5ce98 , < bdd21eed8b72f9e28d6c279f6db258e090c79080 (git) Affected: c574bbe917036c8968b984c82c7b13194fe5ce98 , < 2774f256e7c0219e2b0a0894af1c76bdabc4f974 (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.140 , ≤ 6.1.* (semver) Unaffected: 6.6.22 , ≤ 6.6.* (semver) Unaffected: 6.7.9 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.6 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-04T16:20:18.928013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:21.039Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:34.540Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d6159bd4c00594249e305bfe02304c67c506264e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bdd21eed8b72f9e28d6c279f6db258e090c79080"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2774f256e7c0219e2b0a0894af1c76bdabc4f974"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:38:56.711Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e5ec1c24e71dbf144677a975d6ba91043c2193db",
              "status": "affected",
              "version": "c574bbe917036c8968b984c82c7b13194fe5ce98",
              "versionType": "git"
            },
            {
              "lessThan": "d6159bd4c00594249e305bfe02304c67c506264e",
              "status": "affected",
              "version": "c574bbe917036c8968b984c82c7b13194fe5ce98",
              "versionType": "git"
            },
            {
              "lessThan": "bdd21eed8b72f9e28d6c279f6db258e090c79080",
              "status": "affected",
              "version": "c574bbe917036c8968b984c82c7b13194fe5ce98",
              "versionType": "git"
            },
            {
              "lessThan": "2774f256e7c0219e2b0a0894af1c76bdabc4f974",
              "status": "affected",
              "version": "c574bbe917036c8968b984c82c7b13194fe5ce98",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/migrate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index\n\nWith numa balancing on, when a numa system is running where a numa node\ndoesn\u0027t have its local memory so it has no managed zones, the following\noops has been observed.  It\u0027s because wakeup_kswapd() is called with a\nwrong zone index, -1.  Fixed it by checking the index before calling\nwakeup_kswapd().\n\n\u003e BUG: unable to handle page fault for address: 00000000000033f3\n\u003e #PF: supervisor read access in kernel mode\n\u003e #PF: error_code(0x0000) - not-present page\n\u003e PGD 0 P4D 0\n\u003e Oops: 0000 [#1] PREEMPT SMP NOPTI\n\u003e CPU: 2 PID: 895 Comm: masim Not tainted 6.6.0-dirty #255\n\u003e Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n\u003e    rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\n\u003e RIP: 0010:wakeup_kswapd (./linux/mm/vmscan.c:7812)\n\u003e Code: (omitted)\n\u003e RSP: 0000:ffffc90004257d58 EFLAGS: 00010286\n\u003e RAX: ffffffffffffffff RBX: ffff88883fff0480 RCX: 0000000000000003\n\u003e RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88883fff0480\n\u003e RBP: ffffffffffffffff R08: ff0003ffffffffff R09: ffffffffffffffff\n\u003e R10: ffff888106c95540 R11: 0000000055555554 R12: 0000000000000003\n\u003e R13: 0000000000000000 R14: 0000000000000000 R15: ffff88883fff0940\n\u003e FS:  00007fc4b8124740(0000) GS:ffff888827c00000(0000) knlGS:0000000000000000\n\u003e CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\u003e CR2: 00000000000033f3 CR3: 000000026cc08004 CR4: 0000000000770ee0\n\u003e DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n\u003e DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\u003e PKRU: 55555554\n\u003e Call Trace:\n\u003e  \u003cTASK\u003e\n\u003e ? __die\n\u003e ? page_fault_oops\n\u003e ? __pte_offset_map_lock\n\u003e ? exc_page_fault\n\u003e ? asm_exc_page_fault\n\u003e ? wakeup_kswapd\n\u003e migrate_misplaced_page\n\u003e __handle_mm_fault\n\u003e handle_mm_fault\n\u003e do_user_addr_fault\n\u003e exc_page_fault\n\u003e asm_exc_page_fault\n\u003e RIP: 0033:0x55b897ba0808\n\u003e Code: (omitted)\n\u003e RSP: 002b:00007ffeefa821a0 EFLAGS: 00010287\n\u003e RAX: 000055b89983acd0 RBX: 00007ffeefa823f8 RCX: 000055b89983acd0\n\u003e RDX: 00007fc2f8122010 RSI: 0000000000020000 RDI: 000055b89983acd0\n\u003e RBP: 00007ffeefa821a0 R08: 0000000000000037 R09: 0000000000000075\n\u003e R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000\n\u003e R13: 00007ffeefa82410 R14: 000055b897ba5dd8 R15: 00007fc4b8340000\n\u003e  \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:04:06.074Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e5ec1c24e71dbf144677a975d6ba91043c2193db"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6159bd4c00594249e305bfe02304c67c506264e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdd21eed8b72f9e28d6c279f6db258e090c79080"
        },
        {
          "url": "https://git.kernel.org/stable/c/2774f256e7c0219e2b0a0894af1c76bdabc4f974"
        }
      ],
      "title": "mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26783",
    "datePublished": "2024-04-04T08:20:17.118Z",
    "dateReserved": "2024-02-19T14:20:24.177Z",
    "dateUpdated": "2026-09-08T08:38:56.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26801 (GCVE-0-2024-26801)

Vulnerability from cvelistv5 – Published: 2024-04-04 08:20 – Updated: 2026-08-05 11:27

Title

Bluetooth: Avoid potential use-after-free in hci_error_reset

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would free the hci_dev and lead to a use-after-free in hci_error_reset. Here's the call trace observed on a ChromeOS device with Intel AX201: queue_work_on+0x3e/0x6c __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>] ? init_wait_entry+0x31/0x31 __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>] hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>] process_one_work+0x1d8/0x33f worker_thread+0x21b/0x373 kthread+0x13a/0x152 ? pr_cont_work+0x54/0x54 ? kthread_blkcg+0x31/0x31 ret_from_fork+0x1f/0x30 This patch holds the reference count on the hci_dev while processing a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-15 19:27 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/e0b278650f07acf2e…
https://git.kernel.org/stable/c/98fb98fd37e42fd4c…
https://git.kernel.org/stable/c/6dd0a9dfa99f8990a…
https://git.kernel.org/stable/c/da4569d450b193e39…
https://git.kernel.org/stable/c/45085686b9559bfbe…
https://git.kernel.org/stable/c/2ab9a19d896f5a0dd…
https://git.kernel.org/stable/c/dd594cdc24f2e48da…
https://git.kernel.org/stable/c/2449007d3f73b2842…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < e0b278650f07acf2e0932149183458468a731c03 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < 98fb98fd37e42fd4ce13ff657ea64503e24b6090 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < 6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < da4569d450b193e39e87119fd316c0291b585d14 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < 45085686b9559bfbe3a4f41d3d695a520668f5e1 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < 2ab9a19d896f5a0dd386e1f001c5309bc35f433b (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < dd594cdc24f2e48dab441732e6dfcafd6b0711d1 (git) Affected: c7741d16a57cbf97eebe53f27e8216b1ff20e20c , < 2449007d3f73b2842c9734f45f0aadb522daf592 (git)
Linux	Linux	Affected: 4.0 Unaffected: 0 , < 4.0 (semver) Unaffected: 4.19.309 , ≤ 4.19.* (semver) Unaffected: 5.4.271 , ≤ 5.4.* (semver) Unaffected: 5.10.212 , ≤ 5.10.* (semver) Unaffected: 5.15.151 , ≤ 5.15.* (semver) Unaffected: 6.1.81 , ≤ 6.1.* (semver) Unaffected: 6.6.21 , ≤ 6.6.* (semver) Unaffected: 6.7.9 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.522Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-15T19:27:12.303916Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-15T19:27:19.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0b278650f07acf2e0932149183458468a731c03",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "98fb98fd37e42fd4ce13ff657ea64503e24b6090",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "da4569d450b193e39e87119fd316c0291b585d14",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "45085686b9559bfbe3a4f41d3d695a520668f5e1",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "2ab9a19d896f5a0dd386e1f001c5309bc35f433b",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "dd594cdc24f2e48dab441732e6dfcafd6b0711d1",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            },
            {
              "lessThan": "2449007d3f73b2842c9734f45f0aadb522daf592",
              "status": "affected",
              "version": "c7741d16a57cbf97eebe53f27e8216b1ff20e20c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.309",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.309",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.271",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.151",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.81",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Avoid potential use-after-free in hci_error_reset\n\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\n\nHere\u0027s the call trace observed on a ChromeOS device with Intel AX201:\n   queue_work_on+0x3e/0x6c\n   __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth \u003cHASH:3b4a6\u003e]\n   ? init_wait_entry+0x31/0x31\n   __hci_cmd_sync+0x16/0x20 [bluetooth \u003cHASH:3b4a 6\u003e]\n   hci_error_reset+0x4f/0xa4 [bluetooth \u003cHASH:3b4a 6\u003e]\n   process_one_work+0x1d8/0x33f\n   worker_thread+0x21b/0x373\n   kthread+0x13a/0x152\n   ? pr_cont_work+0x54/0x54\n   ? kthread_blkcg+0x31/0x31\n    ret_from_fork+0x1f/0x30\n\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The `HCI_EV_HARDWARE_ERROR` event that queues `hci_error_reset` is emitted by the Bluetooth controller, and an attacker within Bluetooth radio range can induce a controller firmware exception (the well-documented BrakTooth-class malformed-LMP faults) to generate it while simultaneously leaving the controller unresponsive, which is the exact precondition for the reset/unregister race. This is radio-proximity access, not routable network access.\nAC:L - Once the controller is wedged, the sequence is effectively deterministic: `btintel_hw_error()` blocks for two full `HCI_INIT_TIMEOUT` intervals while `hci_cmd_timeout()` counts to five and fires the GPIO reset, so the race window in which `hci_error_reset` runs against `hci_unregister_dev`/`hci_release_dev` is seconds wide and both sides are driven by the same attacker-induced controller failure. The bug was reproducible enough to be observed in the field on shipping ChromeOS/Intel AX201 hardware.\nPR:N - An over-the-air attacker needs no pairing, bonding, authentication, or any account on the target \u2014 malformed link-layer traffic that faults the controller firmware is processed before any credential check. No host-side privileges are involved at all since the triggering event arrives from the controller.\nUI:N - No victim action is required; the hardware error event, the command timeouts, the GPIO reset and the resulting USB disconnect/unregister all occur automatically inside the kernel once the controller faults.\nS:U - The use-after-free corrupts kernel heap memory within the same security authority as the vulnerable code; no VM, hypervisor, or IOMMU boundary is crossed.\nC:H - `hci_release_dev()` frees `hdev-\u003eworkqueue` (and ultimately `kfree(hdev)`) while `hci_error_reset` is still executing, so `queue_work_on()` reads `wq-\u003eflags` and `wq-\u003ecpu_pwq` out of a freed slab object the attacker can groom by reclaiming it, yielding a kernel-memory read primitive and disclosure of adjacent heap contents and pointers.\nI:H - After the freed `workqueue_struct` is reclaimed with attacker-controlled data, `queue_work_on()` performs a list insertion into the pool worklist derived from that freed memory, giving a controlled write primitive suitable for corrupting adjacent kernel objects and hijacking control flow; the stale `hdev` is likewise written through by the continuing close/open sequence.\nA:H - The confirmed use-after-free reliably oopses or panics the kernel (the reported crash in `queue_work_on` from `hci_error_reset`), and the freed/destroyed workqueue also strands the subsequent `destroy_workqueue(hdev-\u003ereq_workqueue)` drain, permanently wedging the Bluetooth stack."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:22.708Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0b278650f07acf2e0932149183458468a731c03"
        },
        {
          "url": "https://git.kernel.org/stable/c/98fb98fd37e42fd4ce13ff657ea64503e24b6090"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dd0a9dfa99f8990a08eb8fdd8e79bee31c7d8e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/da4569d450b193e39e87119fd316c0291b585d14"
        },
        {
          "url": "https://git.kernel.org/stable/c/45085686b9559bfbe3a4f41d3d695a520668f5e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ab9a19d896f5a0dd386e1f001c5309bc35f433b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd594cdc24f2e48dab441732e6dfcafd6b0711d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2449007d3f73b2842c9734f45f0aadb522daf592"
        }
      ],
      "title": "Bluetooth: Avoid potential use-after-free in hci_error_reset",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26801",
    "datePublished": "2024-04-04T08:20:29.211Z",
    "dateReserved": "2024-02-19T14:20:24.179Z",
    "dateUpdated": "2026-08-05T11:27:22.708Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26852 (GCVE-0-2024-26852)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:17 – Updated: 2026-08-05 11:27

Title

net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

Summary

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release() calls after ip6_route_mpath_notify(), in the cleanup phase. [1] BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 Read of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037 CPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 rt6_fill_node+0x1460/0x1ac0 inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184 ip6_route_mpath_notify net/ipv6/route.c:5198 [inline] ip6_route_multipath_add net/ipv6/route.c:5404 [inline] inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f73dd87dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9 RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 RBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858 </TASK> Allocated by task 23037: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:372 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc+0x22e/0x490 mm/slub.c:3994 kmalloc include/linux/slab.h:594 [inline] kzalloc include/linux/slab.h:711 [inline] fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758 ip6_route_multipath_add net/ipv6/route.c:5298 [inline] inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 Freed by task 16: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640 poison_slab_object+0xa6/0xe0 m ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-19 20:41 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/31ea5bcc7d4cd1423…
https://git.kernel.org/stable/c/664f9c647260cc9d6…
https://git.kernel.org/stable/c/79ce2e54cc0ae366f…
https://git.kernel.org/stable/c/cae3303257950d03f…
https://git.kernel.org/stable/c/394334fe2ae3b9f1e…
https://git.kernel.org/stable/c/ed883060c38721ed8…
https://git.kernel.org/stable/c/61b34f73cdbdb8eaf…
https://git.kernel.org/stable/c/685f7d531264599b3…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

4 products

Vendor	Product	Version
Linux	Linux	Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 31ea5bcc7d4cd1423de6be327a2c034725704136 (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 664f9c647260cc9d68b4e31d9899530d89dd045e (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 79ce2e54cc0ae366f45516c00bf1b19aa43e9abe (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < cae3303257950d03ffec2df4a45e836f10d26c24 (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 394334fe2ae3b9f1e2332b873857e84cb28aac18 (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < ed883060c38721ed828061f6c0c30e5147326c9a (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda (git) Affected: 3b1137fe74829e021f483756a648cbb87c8a1b4a , < 685f7d531264599b3f167f1e94bbd22f120e5fab (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 4.19.310 , ≤ 4.19.* (semver) Unaffected: 5.4.272 , ≤ 5.4.* (semver) Unaffected: 5.10.213 , ≤ 5.10.* (semver) Unaffected: 5.15.152 , ≤ 5.15.* (semver) Unaffected: 6.1.82 , ≤ 6.1.* (semver) Unaffected: 6.6.22 , ≤ 6.6.* (semver) Unaffected: 6.7.10 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 3b1137fe7482 , < 31ea5bcc7d4c (custom) Affected: 3b1137fe7482 , < 664f9c647260 (custom) Affected: 3b1137fe7482 , < 79ce2e54cc0a (custom) Affected: 3b1137fe7482 , < cae330325795 (custom) Affected: 3b1137fe7482 , < 394334fe2ae3 (custom) Affected: 3b1137fe7482 , < ed883060c387 (custom) Affected: 3b1137fe7482 , < 61b34f73cdbd (custom) Affected: 3b1137fe7482 , < 685f7d531264 (custom) Affected: 4.11 Unaffected: 0 , < 4.11 (custom) Unaffected: 4.19.310 , ≤ 4.20 (custom) Unaffected: 5.4.272 , ≤ 5.5 (custom) Unaffected: 5.10.213 , ≤ 5.11 (custom) Unaffected: 5.15.152 , ≤ 5.16 (custom) Unaffected: 6.1.82 , ≤ 6.2 (custom) Unaffected: 6.6.22 , ≤ 6.7 (custom) Unaffected: 6.7.10 , ≤ 6.8 (custom) Unaffected: 6.8 , ≤ * (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.699Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "31ea5bcc7d4c",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "664f9c647260",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "79ce2e54cc0a",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "cae330325795",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "394334fe2ae3",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "ed883060c387",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "61b34f73cdbd",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "lessThan": "685f7d531264",
                "status": "affected",
                "version": "3b1137fe7482",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "4.11"
              },
              {
                "lessThan": "4.11",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "4.20",
                "status": "unaffected",
                "version": "4.19.310",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.5",
                "status": "unaffected",
                "version": "5.4.272",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.213",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.152",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.2",
                "status": "unaffected",
                "version": "6.1.82",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.22",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.8",
                "status": "unaffected",
                "version": "6.7.10",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "6.8",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-19T20:41:29.771297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T21:48:49.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:49:33.817Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31ea5bcc7d4cd1423de6be327a2c034725704136",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "664f9c647260cc9d68b4e31d9899530d89dd045e",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "79ce2e54cc0ae366f45516c00bf1b19aa43e9abe",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "cae3303257950d03ffec2df4a45e836f10d26c24",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "394334fe2ae3b9f1e2332b873857e84cb28aac18",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "ed883060c38721ed828061f6c0c30e5147326c9a",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            },
            {
              "lessThan": "685f7d531264599b3f167f1e94bbd22f120e5fab",
              "status": "affected",
              "version": "3b1137fe74829e021f483756a648cbb87c8a1b4a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.310",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.310",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.272",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.213",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.152",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.10",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: avoid possible UAF in ip6_route_mpath_notify()\n\nsyzbot found another use-after-free in ip6_route_mpath_notify() [1]\n\nCommit f7225172f25a (\"net/ipv6: prevent use after free in\nip6_route_mpath_notify\") was not able to fix the root cause.\n\nWe need to defer the fib6_info_release() calls after\nip6_route_mpath_notify(), in the cleanup phase.\n\n[1]\nBUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0\nRead of size 4 at addr ffff88809a07fc64 by task syz-executor.2/23037\n\nCPU: 0 PID: 23037 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-01035-gea7f3cfaa588 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x167/0x540 mm/kasan/report.c:488\n  kasan_report+0x142/0x180 mm/kasan/report.c:601\n rt6_fill_node+0x1460/0x1ac0\n  inet6_rt_notify+0x13b/0x290 net/ipv6/route.c:6184\n  ip6_route_mpath_notify net/ipv6/route.c:5198 [inline]\n  ip6_route_multipath_add net/ipv6/route.c:5404 [inline]\n  inet6_rtm_newroute+0x1d0f/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\nRIP: 0033:0x7f73dd87dda9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f73de6550c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f73dd9ac050 RCX: 00007f73dd87dda9\nRDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005\nRBP: 00007f73dd8ca47a R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f73dd9ac050 R15: 00007ffdbdeb7858\n \u003c/TASK\u003e\n\nAllocated by task 23037:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:372 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3981 [inline]\n  __kmalloc+0x22e/0x490 mm/slub.c:3994\n  kmalloc include/linux/slab.h:594 [inline]\n  kzalloc include/linux/slab.h:711 [inline]\n  fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155\n  ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3758\n  ip6_route_multipath_add net/ipv6/route.c:5298 [inline]\n  inet6_rtm_newroute+0x744/0x2300 net/ipv6/route.c:5517\n  rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6597\n  netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543\n  netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]\n  netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367\n  netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x221/0x270 net/socket.c:745\n  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584\n  ___sys_sendmsg net/socket.c:2638 [inline]\n  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667\n do_syscall_64+0xf9/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n\nFreed by task 16:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640\n  poison_slab_object+0xa6/0xe0 m\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by an RTM_NEWROUTE message sent over an AF_NETLINK/NETLINK_ROUTE socket via sendmsg(), which requires local access to the system. There is no remote packet-processing path into ip6_route_multipath_add().\nAC:L - The attacker creates both sides of the condition: they drop the last reference themselves and can widen the window arbitrarily by supplying many nexthops, by setting RTA_EXPIRES=0 so the non-rtnl gc softirq reaps the route, and by lowering net.ipv6.route.gc_interval inside their own netns, with unlimited retries. syzbot reproduced it, confirming reliable triggerability.\nPR:L - rtnetlink_rcv_msg() only requires netlink_net_capable(skb, CAP_NET_ADMIN), which is evaluated against the network namespace\u0027s user namespace, so any unprivileged local user obtains it with `unshare -Urn`. Multipath ECMP routes are addable in that namespace using RTNH_F_ONLINK gateways, which bypasses gateway reachability validation.\nUI:N - The entire sequence is performed by the attacker\u0027s own process in a single netlink transaction; no victim action, mount, or other interaction is needed.\nS:U - The use-after-free corrupts kernel heap memory and is exploited within the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - rt6_fill_node() reads the freed kmalloc-512 fib6_info and copies its contents into an RTM_NEWROUTE netlink message returned to the attacker\u0027s socket, including dereferencing pointers taken from freed memory such as rt-\u003efib6_metrics (passed to rtnetlink_put_metrics()), rt-\u003efib6_table, and rt-\u003efib6_nh. Reclaiming the freed slot with controlled data turns this into an arbitrary kernel-memory read leaked directly to userspace.\nI:H - This is a use-after-free on a 512-byte kmalloc object that an unprivileged attacker can spray and reclaim, after which the kernel dereferences attacker-controlled pointers and performs a list_for_each_entry_safe() walk over the freed fib6_siblings list head. That yields controlled pointer traversal and corruption suitable for privilege escalation.\nA:H - The KASAN slab-use-after-free in rt6_fill_node() causes an oops/panic when the freed object is unmapped, poisoned, or reclaimed with invalid pointers, and it can be triggered repeatedly to reliably crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:48.147Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31ea5bcc7d4cd1423de6be327a2c034725704136"
        },
        {
          "url": "https://git.kernel.org/stable/c/664f9c647260cc9d68b4e31d9899530d89dd045e"
        },
        {
          "url": "https://git.kernel.org/stable/c/79ce2e54cc0ae366f45516c00bf1b19aa43e9abe"
        },
        {
          "url": "https://git.kernel.org/stable/c/cae3303257950d03ffec2df4a45e836f10d26c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/394334fe2ae3b9f1e2332b873857e84cb28aac18"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed883060c38721ed828061f6c0c30e5147326c9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/61b34f73cdbdb8eaf9ea12e9e2eb3b29716c4dda"
        },
        {
          "url": "https://git.kernel.org/stable/c/685f7d531264599b3f167f1e94bbd22f120e5fab"
        }
      ],
      "title": "net/ipv6: avoid possible UAF in ip6_route_mpath_notify()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26852",
    "datePublished": "2024-04-17T10:17:15.923Z",
    "dateReserved": "2024-02-19T14:20:24.183Z",
    "dateUpdated": "2026-08-05T11:27:48.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:4533

CVE-2021-47548 (GCVE-0-2021-47548)

CVE-2021-47596 (GCVE-0-2021-47596)

CVE-2022-48627 (GCVE-0-2022-48627)

CVE-2023-52638 (GCVE-0-2023-52638)

CVE-2024-26583 (GCVE-0-2024-26583)

CVE-2024-26585 (GCVE-0-2024-26585)

CVE-2024-26720 (GCVE-0-2024-26720)

CVE-2024-26783 (GCVE-0-2024-26783)

CVE-2024-26801 (GCVE-0-2024-26801)

CVE-2024-26852 (GCVE-0-2024-26852)

Tags

Sightings

Nomenclature

Related by attack behaviour