Vulnerability-Lookup

RHSA-2024:8613

Vulnerability from csaf_redhat - Published: 2024-10-30 00:39 - Updated: 2026-09-27 23:34

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: ovl: fix use after free in struct ovl_aio_req (CVE-2023-1252) * hw: cpu: intel: Native Branch History Injection (BHI) (CVE-2024-2201) * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489) * kernel: blk-mq: fix IO hang from sbitmap wakeup race (CVE-2024-26671) * kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (CVE-2024-26686) * kernel: mptcp: fix data re-injection from stale subflow (CVE-2024-26826) * kernel: mac802154: fix llsec key resources release in mac802154_llsec_key_del (CVE-2024-26961) * kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47384) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: ipv6: prevent possible NULL dereference in rt6_probe() (CVE-2024-40960) * kernel: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (CVE-2024-40998) * kernel: filelock: fix potential use-after-free in posix_lock_inode (CVE-2024-41049) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: powerpc/eeh: avoid possible crash when edev->pdev changes (CVE-2024-41064) * kernel: nvmet: fix a possible leak when destroy a ctrl during qp establishment (CVE-2024-42152) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-47384

A vulnerability was found in the Linux kernel's hwmon driver for the w83793 module where NULL pointer dereference caused by an obsolete structure field lm75[]. During specific device read operations, if certain values are read from the device, the driver could attempt to access a NULL pointer, leading to potential system crashes or instability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 200 products

Product	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-284.90.1.el9_2.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-uki-virt-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix Workaround

Known not affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-doc-0:5.14.0-284.90.1.el9_2.noarch		—	Workaround

Threats

Impact Moderate

CVE-2022-50720

In the Linux kernel, the following vulnerability has been resolved: x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC (or x2APIC). X2APIC mode is mostly compatible with legacy APIC, but it disables the memory-mapped APIC interface in favor of one that uses MSRs. The APIC mode is controlled by the EXT bit in the APIC MSR. The MMIO/xAPIC interface has some problems, most notably the APIC LEAK [1]. This bug allows an attacker to use the APIC MMIO interface to extract data from the SGX enclave. Introduce support for a new feature that will allow the BIOS to lock the APIC in x2APIC mode. If the APIC is locked in x2APIC mode and the kernel tries to disable the APIC or revert to legacy APIC mode a GP fault will occur. Introduce support for a new MSR (IA32_XAPIC_DISABLE_STATUS) and handle the new locked mode when the LEGACY_XAPIC_DISABLED bit is set by preventing the kernel from trying to disable the x2APIC. On platforms with the IA32_XAPIC_DISABLE_STATUS MSR, if SGX or TDX are enabled the LEGACY_XAPIC_DISABLED will be set by the BIOS. If legacy APIC is required, then it SGX and TDX need to be disabled in the BIOS. [1]: https://aepicleak.com/aepicleak.pdf

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Affected products

Fixed 201 products

Product	Version	Remediation
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-devel-matched-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-doc-0:5.14.0-284.90.1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.2.0.Z.EUS:rtla-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-284.90.1.el9_2.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-core-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-modules-extra-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-tools-libs-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-uki-virt-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:bpftool-debuginfo-0:7.0.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.2.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-284.90.1.el9_2.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2023-1252

A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2023-52489

A race condition was found on a PFN in the Linux Kernel, which can fall into the device memory region with the system memory configuration. Normal zone start and end PFNs contain the device memory PFNs as well, and the compaction triggered will try on the device memory PFNs and end up in NOP. This may lead to compromised Availability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-2201

A flaw was found in some Intel CPUs where mitigations for the Spectre V2/BHI vulnerability were incomplete. This issue may allow an attacker to read arbitrary memory, compromising system integrity and exposing sensitive information.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-1423 - Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-26671

A possible IO hang from sbitmap wakeup race was found in the Linux kernel. This may lead to compromised Availability.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-26686

A vulnerability was found in the do_task_stat() function in the Linux kernel, where due to excessive lock contention, a potential hard lockup could be created. This can create a performance bottleneck and lead to kernel unresponsiveness.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-413 - Improper Resource Locking

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-26826

A flaw was found in the Linux kernel. A logical error in the Multipath TCP packet manager causes some packets intended for retransmission to be lost, resulting in a potential denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-26961

A flaw was found in the Linux Kernel where resources are improperly managed in IEEE 802.15.4 networking, leading to a potential use-after-free issue, resulting in a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-459 - Incomplete Cleanup

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-36889

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_nxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snd_una: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules linked in: CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005 Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8 8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe <0f> 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9 RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4 RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000 R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000 FS: 0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0 Call Trace: <TASK> __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline] mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline] __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615 mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767 process_one_work+0x1e0/0x560 kernel/workqueue.c:3254 process_scheduled_works kernel/workqueue.c:3335 [inline] worker_thread+0x3c7/0x640 kernel/workqueue.c:3416 kthread+0x121/0x170 kernel/kthread.c:388 ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK> When fallback to TCP happens early on a client socket, snd_nxt is not yet initialized and any incoming ack will copy such value into snd_una. If the mptcp worker (dumbly) tries mptcp-level re-injection after such ack, that would unconditionally trigger a send buffer cleanup using 'bad' snd_una values. We could easily disable re-injection for fallback sockets, but such dumb behavior already helped catching a few subtle issues and a very low to zero impact in practice. Instead address the issue always initializing snd_nxt (and write_seq, for consistency) at connect time.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-665 - Improper Initialization

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-40960

A vulnerability was found in the Linux kernel's IPv6 routing component, where a NULL dereference occurs in the rt6_probe() function. This issue happens when the function attempts to access a resource without confirming its availability, leading to potential crashes.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-40998

A vulnerability was found in the Linux kernel's ext4 filesystem within the __ext4_fill_super() function, where uninitialized access to ratelimit_state->lock can occur, where the sysfs interface is registered before properly initializing rs->lock, potentially allowing other processes to modify rs->interval to a non-zero value.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-908 - Use of Uninitialized Resource

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-41049

A use-after-free vulnerability was found in the Linux kernel in trace_posix_lock_inode(). This issue occurred when the request pointer was changed to point to a lock entry added to the inode's list. Before the tracepoint could fire, another task raced in and freed the lock.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-41055

In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

CVE-2024-41064

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock while taking a copy of edev->pdev->bus.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-413 - Improper Resource Locking

Affected products

Fixed 201 products, the same list as for CVE-2022-50720

Threats

Impact Moderate

CVE-2024-42152

A vulnerability was found in the Linux kernel's nvme driver. A lack of proper checks can lead to a race condition during the destruction of a queue pair when a controller is being established. This issue can lead to system instability or crashes.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-404 - Improper Resource Shutdown or Release

Affected products

Fixed 200 products, the same list as for CVE-2021-47384

Known not affected 1 product, the same list as for CVE-2021-47384

Threats

Impact Moderate

References

101 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:8613	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2176140	external
https://bugzilla.redhat.com/show_bug.cgi?id=2268118	external
https://bugzilla.redhat.com/show_bug.cgi?id=2269189	external
https://bugzilla.redhat.com/show_bug.cgi?id=2272811	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273109	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275604	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278176	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282356	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284571	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297544	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297582	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300422	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300439	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301519	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-47384	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282356	external
https://www.cve.org/CVERecord?id=CVE-2021-47384	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47384	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2022-50720	self
https://bugzilla.redhat.com/show_bug.cgi?id=2425047	external
https://www.cve.org/CVERecord?id=CVE-2022-50720	external
https://nvd.nist.gov/vuln/detail/CVE-2022-50720	external
https://lore.kernel.org/linux-cve-announce/202512…	external
https://access.redhat.com/security/cve/CVE-2023-1252	self
https://bugzilla.redhat.com/show_bug.cgi?id=2176140	external
https://www.cve.org/CVERecord?id=CVE-2023-1252	external
https://nvd.nist.gov/vuln/detail/CVE-2023-1252	external
https://lore.kernel.org/lkml/20211115165433.44995…	external
https://access.redhat.com/security/cve/CVE-2023-52489	self
https://bugzilla.redhat.com/show_bug.cgi?id=2269189	external
https://www.cve.org/CVERecord?id=CVE-2023-52489	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52489	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2024-2201	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268118	external
https://www.cve.org/CVERecord?id=CVE-2024-2201	external
https://nvd.nist.gov/vuln/detail/CVE-2024-2201	external
https://download.vusec.net/papers/inspectre_sec24.pdf	external
https://www.intel.com/content/www/us/en/developer…	external
https://www.openwall.com/lists/oss-security/2024/…	external
https://www.vusec.net/projects/native-bhi/	external
https://access.redhat.com/security/cve/CVE-2024-26671	self
https://bugzilla.redhat.com/show_bug.cgi?id=2272811	external
https://www.cve.org/CVERecord?id=CVE-2024-26671	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26671	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26686	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273109	external
https://www.cve.org/CVERecord?id=CVE-2024-26686	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26686	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26826	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275604	external
https://www.cve.org/CVERecord?id=CVE-2024-26826	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26826	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26961	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278176	external
https://www.cve.org/CVERecord?id=CVE-2024-26961	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26961	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36889	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284571	external
https://www.cve.org/CVERecord?id=CVE-2024-36889	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36889	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-40960	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297544	external
https://www.cve.org/CVERecord?id=CVE-2024-40960	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40960	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40998	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297582	external
https://www.cve.org/CVERecord?id=CVE-2024-40998	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40998	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41049	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300422	external
https://www.cve.org/CVERecord?id=CVE-2024-41049	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41049	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41055	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300429	external
https://www.cve.org/CVERecord?id=CVE-2024-41055	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41055	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41064	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300439	external
https://www.cve.org/CVERecord?id=CVE-2024-41064	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41064	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42152	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301519	external
https://www.cve.org/CVERecord?id=CVE-2024-42152	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42152	external
https://lore.kernel.org/linux-cve-announce/202407…	external

Acknowledgments

Google Project Zero Jann Horn

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2021-47384 (GCVE-0-2021-47384)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:03 – Updated: 2026-05-11 13:53

Title

hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field

Summary

In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field If driver read tmp value sufficient for (tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs. (It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients(). The patch fixes possible NULL pointer dereference by removing lm75[]. Found by Linux Driver Verification project (linuxtesting.org). [groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-21 18:21 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/6cb01fe630eaffc5a…
https://git.kernel.org/stable/c/7c4fd5de39f273626…
https://git.kernel.org/stable/c/746011193f44f97f8…
https://git.kernel.org/stable/c/dd4d747ef05addab8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf48d17623281c2b3185030ed23f148bd47e15de , < 6cb01fe630eaffc5a2c3f7364436caddba286623 (git) Affected: cf48d17623281c2b3185030ed23f148bd47e15de , < 7c4fd5de39f273626a2b0f3a446d2cc85cd47616 (git) Affected: cf48d17623281c2b3185030ed23f148bd47e15de , < 746011193f44f97f8784edcf8327c587946745fc (git) Affected: cf48d17623281c2b3185030ed23f148bd47e15de , < dd4d747ef05addab887dc8ff0d6ab9860bbcd783 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.4.151 , ≤ 5.4.* (semver) Unaffected: 5.10.71 , ≤ 5.10.* (semver) Unaffected: 5.14.10 , ≤ 5.14.* (semver) Unaffected: 5.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2021-47384",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-21T18:21:42.087450Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T18:44:47.091Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T05:39:59.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6cb01fe630eaffc5a2c3f7364436caddba286623"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7c4fd5de39f273626a2b0f3a446d2cc85cd47616"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/746011193f44f97f8784edcf8327c587946745fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dd4d747ef05addab887dc8ff0d6ab9860bbcd783"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/w83793.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6cb01fe630eaffc5a2c3f7364436caddba286623",
              "status": "affected",
              "version": "cf48d17623281c2b3185030ed23f148bd47e15de",
              "versionType": "git"
            },
            {
              "lessThan": "7c4fd5de39f273626a2b0f3a446d2cc85cd47616",
              "status": "affected",
              "version": "cf48d17623281c2b3185030ed23f148bd47e15de",
              "versionType": "git"
            },
            {
              "lessThan": "746011193f44f97f8784edcf8327c587946745fc",
              "status": "affected",
              "version": "cf48d17623281c2b3185030ed23f148bd47e15de",
              "versionType": "git"
            },
            {
              "lessThan": "dd4d747ef05addab887dc8ff0d6ab9860bbcd783",
              "status": "affected",
              "version": "cf48d17623281c2b3185030ed23f148bd47e15de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/w83793.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.71",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.14.*",
              "status": "unaffected",
              "version": "5.14.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.151",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.71",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read tmp value sufficient for\n(tmp \u0026 0x08) \u0026\u0026 (!(tmp \u0026 0x80)) \u0026\u0026 ((tmp \u0026 0x7) == ((tmp \u003e\u003e 4) \u0026 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignments]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T13:53:39.015Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6cb01fe630eaffc5a2c3f7364436caddba286623"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c4fd5de39f273626a2b0f3a446d2cc85cd47616"
        },
        {
          "url": "https://git.kernel.org/stable/c/746011193f44f97f8784edcf8327c587946745fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd4d747ef05addab887dc8ff0d6ab9860bbcd783"
        }
      ],
      "title": "hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2021-47384",
    "datePublished": "2024-05-21T15:03:44.955Z",
    "dateReserved": "2024-05-21T14:58:30.812Z",
    "dateUpdated": "2026-05-11T13:53:39.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-50720 (GCVE-0-2022-50720)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:22 – Updated: 2026-05-11 19:24

Title

x86/apic: Don't disable x2APIC if locked

Summary

Severity

No CVSS data available.

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/05785ba834f23272f…
https://git.kernel.org/stable/c/dd1241e00addbf0b9…
https://git.kernel.org/stable/c/b8d1d163604bd1e60…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fb209bd891645bb87b9618b724f0b4928e0df3de , < 05785ba834f23272f9d23427ae4a80ac505a5296 (git) Affected: fb209bd891645bb87b9618b724f0b4928e0df3de , < dd1241e00addbf0b95f6cd6ce32152692820657e (git) Affected: fb209bd891645bb87b9618b724f0b4928e0df3de , < b8d1d163604bd1e600b062fb00de5dc42baa355f (git)
Linux	Linux	Affected: 3.3 Unaffected: 0 , < 3.3 (semver) Unaffected: 5.19.17 , ≤ 5.19.* (semver) Unaffected: 6.0.3 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "Documentation/admin-guide/kernel-parameters.txt",
            "arch/x86/Kconfig",
            "arch/x86/include/asm/cpu.h",
            "arch/x86/include/asm/msr-index.h",
            "arch/x86/kernel/apic/apic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "05785ba834f23272f9d23427ae4a80ac505a5296",
              "status": "affected",
              "version": "fb209bd891645bb87b9618b724f0b4928e0df3de",
              "versionType": "git"
            },
            {
              "lessThan": "dd1241e00addbf0b95f6cd6ce32152692820657e",
              "status": "affected",
              "version": "fb209bd891645bb87b9618b724f0b4928e0df3de",
              "versionType": "git"
            },
            {
              "lessThan": "b8d1d163604bd1e600b062fb00de5dc42baa355f",
              "status": "affected",
              "version": "fb209bd891645bb87b9618b724f0b4928e0df3de",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "Documentation/admin-guide/kernel-parameters.txt",
            "arch/x86/Kconfig",
            "arch/x86/include/asm/cpu.h",
            "arch/x86/include/asm/msr-index.h",
            "arch/x86/kernel/apic/apic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/apic: Don\u0027t disable x2APIC if locked\n\nThe APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC\n(or x2APIC).  X2APIC mode is mostly compatible with legacy APIC, but\nit disables the memory-mapped APIC interface in favor of one that uses\nMSRs.  The APIC mode is controlled by the EXT bit in the APIC MSR.\n\nThe MMIO/xAPIC interface has some problems, most notably the APIC LEAK\n[1].  This bug allows an attacker to use the APIC MMIO interface to\nextract data from the SGX enclave.\n\nIntroduce support for a new feature that will allow the BIOS to lock\nthe APIC in x2APIC mode.  If the APIC is locked in x2APIC mode and the\nkernel tries to disable the APIC or revert to legacy APIC mode a GP\nfault will occur.\n\nIntroduce support for a new MSR (IA32_XAPIC_DISABLE_STATUS) and handle\nthe new locked mode when the LEGACY_XAPIC_DISABLED bit is set by\npreventing the kernel from trying to disable the x2APIC.\n\nOn platforms with the IA32_XAPIC_DISABLE_STATUS MSR, if SGX or TDX are\nenabled the LEGACY_XAPIC_DISABLED will be set by the BIOS.  If\nlegacy APIC is required, then it SGX and TDX need to be disabled in the\nBIOS.\n\n[1]: https://aepicleak.com/aepicleak.pdf"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:24:12.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/05785ba834f23272f9d23427ae4a80ac505a5296"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd1241e00addbf0b95f6cd6ce32152692820657e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8d1d163604bd1e600b062fb00de5dc42baa355f"
        }
      ],
      "title": "x86/apic: Don\u0027t disable x2APIC if locked",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50720",
    "datePublished": "2025-12-24T12:22:43.396Z",
    "dateReserved": "2025-12-24T12:20:40.329Z",
    "dateUpdated": "2026-05-11T19:24:12.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-1252 (GCVE-0-2023-1252)

Vulnerability from cvelistv5 – Published: 2023-03-23 00:00 – Updated: 2025-04-23 16:23

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:28 UTC

CWE

CWE-416

Assigner

redhat redhat root

References

2 references

URL	Tags
https://lore.kernel.org/lkml/20211115165433.44995…
https://security.netapp.com/advisory/ntap-2023050…

Impacted products

1 product

Vendor	Product	Version
n/a	Kernel	Affected: Linux kernel 5.16-rc1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:40:59.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lore.kernel.org/lkml/20211115165433.449951285%40linuxfoundation.org/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230505-0005/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-1252",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:28:47.799798Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:23:30.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kernel",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Linux kernel 5.16-rc1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free flaw was found in the Linux kernel\u2019s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 (\"ovl: fix use after free in struct ovl_aio_req\") not applied yet, the kernel could be affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-05T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://lore.kernel.org/lkml/20211115165433.449951285%40linuxfoundation.org/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230505-0005/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-1252",
    "datePublished": "2023-03-23T00:00:00.000Z",
    "dateReserved": "2023-03-07T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:23:30.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-52489 (GCVE-0-2023-52489)

Vulnerability from cvelistv5 – Published: 2024-02-29 15:52 – Updated: 2026-05-11 19:28

Title

mm/sparsemem: fix race in accessing memory_section->usage

Summary

In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are such that [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL]. Since normal zone start and end pfn contains the device memory PFN's as well, the compaction triggered will try on the device memory PFN's too though they end up in NOP(because pfn_to_online_page() returns NULL for ZONE_DEVICE memory sections). When from other core, the section mappings are being removed for the ZONE_DEVICE region, that the PFN in question belongs to, on which compaction is currently being operated is resulting into the kernel crash with CONFIG_SPASEMEM_VMEMAP enabled. The crash logs can be seen at [1]. compact_zone() memunmap_pages ------------- --------------- __pageblock_pfn_to_page ...... (a)pfn_valid(): valid_section()//return true (b)__remove_pages()-> sparse_remove_section()-> section_deactivate(): [Free the array ms->usage and set ms->usage = NULL] pfn_section_valid() [Access ms->usage which is NULL] NOTE: From the above it can be said that the race is reduced to between the pfn_valid()/pfn_section_valid() and the section deactivate with SPASEMEM_VMEMAP enabled. The commit b943f045a9af("mm/sparse: fix kernel crash with pfn_section_valid check") tried to address the same problem by clearing the SECTION_HAS_MEM_MAP with the expectation of valid_section() returns false thus ms->usage is not accessed. Fix this issue by the below steps: a) Clear SECTION_HAS_MEM_MAP before freeing the ->usage. b) RCU protected read side critical section will either return NULL when SECTION_HAS_MEM_MAP is cleared or can successfully access ->usage. c) Free the ->usage with kfree_rcu() and set ms->usage = NULL. No attempt will be made to access ->usage after this as the SECTION_HAS_MEM_MAP is cleared thus valid_section() return false. Thanks to David/Pavan for their inputs on this patch. [1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/ On Snapdragon SoC, with the mentioned memory configuration of PFN's as [ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of issues daily while testing on a device farm. For this particular issue below is the log. Though the below log is not directly pointing to the pfn_section_valid(){ ms->usage;}, when we loaded this dump on T32 lauterbach tool, it is pointing. [ 540.578056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 540.578068] Mem abort info: [ 540.578070] ESR = 0x0000000096000005 [ 540.578073] EC = 0x25: DABT (current EL), IL = 32 bits [ 540.578077] SET = 0, FnV = 0 [ 540.578080] EA = 0, S1PTW = 0 [ 540.578082] FSC = 0x05: level 1 translation fault [ 540.578085] Data abort info: [ 540.578086] ISV = 0, ISS = 0x00000005 [ 540.578088] CM = 0, WnR = 0 [ 540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--) [ 540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c [ 540.579454] lr : compact_zone+0x994/0x1058 [ 540.579460] sp : ffffffc03579b510 [ 540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c [ 540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640 [ 540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000 [ 540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140 [ 540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff [ 540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001 [ 540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440 [ 540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4 [ 540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000 ---truncated---

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-12 14:56 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/90ad17575d2687428…
https://git.kernel.org/stable/c/b448de2459b6d62a5…
https://git.kernel.org/stable/c/68ed9e33324021e9d…
https://git.kernel.org/stable/c/70064241f2229f7ba…
https://git.kernel.org/stable/c/3a01daace71b52156…
https://git.kernel.org/stable/c/5ec8e8ea8b7783fab…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < 90ad17575d26874287271127d43ef3c2af876cea (git) Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < b448de2459b6d62a53892487ab18b7d823ff0529 (git) Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < 68ed9e33324021e9d6b798e9db00ca3093d2012a (git) Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < 70064241f2229f7ba7b9599a98f68d9142e81a97 (git) Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < 3a01daace71b521563c38bbbf874e14c3e58adb7 (git) Affected: f46edbd1b1516da1fb34c917775168d5df576f78 , < 5ec8e8ea8b7783fab150cf86404fc38cb4db8800 (git)
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.210 , ≤ 5.10.* (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.76 , ≤ 6.1.* (semver) Unaffected: 6.6.15 , ≤ 6.6.* (semver) Unaffected: 6.7.3 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-12T14:56:15.828991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:22:46.560Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:20.387Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/90ad17575d26874287271127d43ef3c2af876cea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b448de2459b6d62a53892487ab18b7d823ff0529"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68ed9e33324021e9d6b798e9db00ca3093d2012a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70064241f2229f7ba7b9599a98f68d9142e81a97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a01daace71b521563c38bbbf874e14c3e58adb7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ec8e8ea8b7783fab150cf86404fc38cb4db8800"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmzone.h",
            "mm/sparse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90ad17575d26874287271127d43ef3c2af876cea",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            },
            {
              "lessThan": "b448de2459b6d62a53892487ab18b7d823ff0529",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            },
            {
              "lessThan": "68ed9e33324021e9d6b798e9db00ca3093d2012a",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            },
            {
              "lessThan": "70064241f2229f7ba7b9599a98f68d9142e81a97",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            },
            {
              "lessThan": "3a01daace71b521563c38bbbf874e14c3e58adb7",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            },
            {
              "lessThan": "5ec8e8ea8b7783fab150cf86404fc38cb4db8800",
              "status": "affected",
              "version": "f46edbd1b1516da1fb34c917775168d5df576f78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmzone.h",
            "mm/sparse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.76",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/sparsemem: fix race in accessing memory_section-\u003eusage\n\nThe below race is observed on a PFN which falls into the device memory\nregion with the system memory configuration where PFN\u0027s are such that\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL].  Since normal zone start and end\npfn contains the device memory PFN\u0027s as well, the compaction triggered\nwill try on the device memory PFN\u0027s too though they end up in NOP(because\npfn_to_online_page() returns NULL for ZONE_DEVICE memory sections).  When\nfrom other core, the section mappings are being removed for the\nZONE_DEVICE region, that the PFN in question belongs to, on which\ncompaction is currently being operated is resulting into the kernel crash\nwith CONFIG_SPASEMEM_VMEMAP enabled.  The crash logs can be seen at [1].\n\ncompact_zone()\t\t\tmemunmap_pages\n-------------\t\t\t---------------\n__pageblock_pfn_to_page\n   ......\n (a)pfn_valid():\n     valid_section()//return true\n\t\t\t      (b)__remove_pages()-\u003e\n\t\t\t\t  sparse_remove_section()-\u003e\n\t\t\t\t    section_deactivate():\n\t\t\t\t    [Free the array ms-\u003eusage and set\n\t\t\t\t     ms-\u003eusage = NULL]\n     pfn_section_valid()\n     [Access ms-\u003eusage which\n     is NULL]\n\nNOTE: From the above it can be said that the race is reduced to between\nthe pfn_valid()/pfn_section_valid() and the section deactivate with\nSPASEMEM_VMEMAP enabled.\n\nThe commit b943f045a9af(\"mm/sparse: fix kernel crash with\npfn_section_valid check\") tried to address the same problem by clearing\nthe SECTION_HAS_MEM_MAP with the expectation of valid_section() returns\nfalse thus ms-\u003eusage is not accessed.\n\nFix this issue by the below steps:\n\na) Clear SECTION_HAS_MEM_MAP before freeing the -\u003eusage.\n\nb) RCU protected read side critical section will either return NULL\n   when SECTION_HAS_MEM_MAP is cleared or can successfully access -\u003eusage.\n\nc) Free the -\u003eusage with kfree_rcu() and set ms-\u003eusage = NULL.  No\n   attempt will be made to access -\u003eusage after this as the\n   SECTION_HAS_MEM_MAP is cleared thus valid_section() return false.\n\nThanks to David/Pavan for their inputs on this patch.\n\n[1] https://lore.kernel.org/linux-mm/994410bb-89aa-d987-1f50-f514903c55aa@quicinc.com/\n\nOn Snapdragon SoC, with the mentioned memory configuration of PFN\u0027s as\n[ZONE_NORMAL ZONE_DEVICE ZONE_NORMAL], we are able to see bunch of\nissues daily while testing on a device farm.\n\nFor this particular issue below is the log.  Though the below log is\nnot directly pointing to the pfn_section_valid(){ ms-\u003eusage;}, when we\nloaded this dump on T32 lauterbach tool, it is pointing.\n\n[  540.578056] Unable to handle kernel NULL pointer dereference at\nvirtual address 0000000000000000\n[  540.578068] Mem abort info:\n[  540.578070]   ESR = 0x0000000096000005\n[  540.578073]   EC = 0x25: DABT (current EL), IL = 32 bits\n[  540.578077]   SET = 0, FnV = 0\n[  540.578080]   EA = 0, S1PTW = 0\n[  540.578082]   FSC = 0x05: level 1 translation fault\n[  540.578085] Data abort info:\n[  540.578086]   ISV = 0, ISS = 0x00000005\n[  540.578088]   CM = 0, WnR = 0\n[  540.579431] pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBSBTYPE=--)\n[  540.579436] pc : __pageblock_pfn_to_page+0x6c/0x14c\n[  540.579454] lr : compact_zone+0x994/0x1058\n[  540.579460] sp : ffffffc03579b510\n[  540.579463] x29: ffffffc03579b510 x28: 0000000000235800 x27:000000000000000c\n[  540.579470] x26: 0000000000235c00 x25: 0000000000000068 x24:ffffffc03579b640\n[  540.579477] x23: 0000000000000001 x22: ffffffc03579b660 x21:0000000000000000\n[  540.579483] x20: 0000000000235bff x19: ffffffdebf7e3940 x18:ffffffdebf66d140\n[  540.579489] x17: 00000000739ba063 x16: 00000000739ba063 x15:00000000009f4bff\n[  540.579495] x14: 0000008000000000 x13: 0000000000000000 x12:0000000000000001\n[  540.579501] x11: 0000000000000000 x10: 0000000000000000 x9 :ffffff897d2cd440\n[  540.579507] x8 : 0000000000000000 x7 : 0000000000000000 x6 :ffffffc03579b5b4\n[  540.579512] x5 : 0000000000027f25 x4 : ffffffc03579b5b8 x3 :0000000000000\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:28:19.292Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90ad17575d26874287271127d43ef3c2af876cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/b448de2459b6d62a53892487ab18b7d823ff0529"
        },
        {
          "url": "https://git.kernel.org/stable/c/68ed9e33324021e9d6b798e9db00ca3093d2012a"
        },
        {
          "url": "https://git.kernel.org/stable/c/70064241f2229f7ba7b9599a98f68d9142e81a97"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a01daace71b521563c38bbbf874e14c3e58adb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ec8e8ea8b7783fab150cf86404fc38cb4db8800"
        }
      ],
      "title": "mm/sparsemem: fix race in accessing memory_section-\u003eusage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52489",
    "datePublished": "2024-02-29T15:52:08.718Z",
    "dateReserved": "2024-02-20T12:30:33.302Z",
    "dateUpdated": "2026-05-11T19:28:19.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-2201 (GCVE-0-2024-2201)

Vulnerability from cvelistv5 – Published: 2024-12-19 20:28 – Updated: 2025-01-09 16:40

Title

CVE-2024-2201

Summary

A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-31 18:51 UTC

CWE

Assigner

certcc mitre root

References

9 references

URL	Tags
https://www.kb.cert.org/vuls/id/155143
https://github.com/vusec/inspectre-gadget?tab=rea…
http://www.openwall.com/lists/oss-security/2024/0…
http://www.openwall.com/lists/oss-security/2024/05/07/7
http://xenbits.xen.org/xsa/advisory-456.html
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://www.intel.com/content/www/us/en/developer…

Impacted products

1 product

Vendor	Product	Version
Xen	Xen	Affected: See advisory "x86: Native Branch History Injection"

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-2201",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-31T18:51:54.984364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T16:40:32.522Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "affected",
              "version": "See advisory \"x86: Native Branch History Injection\""
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1423",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T20:29:32.134Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://www.kb.cert.org/vuls/id/155143"
        },
        {
          "url": "https://github.com/vusec/inspectre-gadget?tab=readme-ov-file"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/09/15"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/05/07/7"
        },
        {
          "url": "http://xenbits.xen.org/xsa/advisory-456.html"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QKNCPX7CJUK4I6BRGABAUQK2DMQZUCA/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5OK6MH75S7YWD34EWW7QIZTS627RIE3/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYAZ7P6YFJ2E3FHKAGIKHWS46KYMMTZH/"
        },
        {
          "url": "https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/branch-history-injection.htm"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CVE-2024-2201",
      "x_generator": {
        "engine": "VINCE 3.0.11",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-2201"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2024-2201",
    "datePublished": "2024-12-19T20:28:31.596Z",
    "dateReserved": "2024-03-05T19:12:39.649Z",
    "dateUpdated": "2025-01-09T16:40:32.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26671 (GCVE-0-2024-26671)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:49 – Updated: 2026-05-11 20:01

Title

blk-mq: fix IO hang from sbitmap wakeup race

Summary

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:53 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/9525b38180e2753f0…
https://git.kernel.org/stable/c/ecd7744a1446eb02c…
https://git.kernel.org/stable/c/7610ba1319253225a…
https://git.kernel.org/stable/c/89e0e66682e1538ae…
https://git.kernel.org/stable/c/1d9c777d3e70bdc57…
https://git.kernel.org/stable/c/6d8b01624a2540336…
https://git.kernel.org/stable/c/f1bc0d8163f8ee84a…
https://git.kernel.org/stable/c/5266caaf5660529e3…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 9525b38180e2753f0daa1a522b7767a2aa969676 (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 7610ba1319253225a9ba8a9d28d472fc883b4e2f (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 89e0e66682e1538aeeaa3109503473663cd24c8b (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 1d9c777d3e70bdc57dddf7a14a80059d65919e56 (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 6d8b01624a2540336a32be91f25187a433af53a0 (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 (git) Affected: da55f2cc78418dee88400aafbbaed19d7ac8188e , < 5266caaf5660529e3da53004b8b7174cab6374ed (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 4.19.307 , ≤ 4.19.* (semver) Unaffected: 5.4.269 , ≤ 5.4.* (semver) Unaffected: 5.10.210 , ≤ 5.10.* (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.77 , ≤ 6.1.* (semver) Unaffected: 6.6.16 , ≤ 6.6.* (semver) Unaffected: 6.7.4 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:12.464Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:32.693372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:37.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9525b38180e2753f0daa1a522b7767a2aa969676",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "7610ba1319253225a9ba8a9d28d472fc883b4e2f",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "89e0e66682e1538aeeaa3109503473663cd24c8b",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "1d9c777d3e70bdc57dddf7a14a80059d65919e56",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "6d8b01624a2540336a32be91f25187a433af53a0",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "f1bc0d8163f8ee84a8d5affdf624cfad657df1d2",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            },
            {
              "lessThan": "5266caaf5660529e3da53004b8b7174cab6374ed",
              "status": "affected",
              "version": "da55f2cc78418dee88400aafbbaed19d7ac8188e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.307",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.269",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.210",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.77",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.16",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.4",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: fix IO hang from sbitmap wakeup race\n\nIn blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered\nwith the following blk_mq_get_driver_tag() in case of getting driver\ntag failure.\n\nThen in __sbitmap_queue_wake_up(), waitqueue_active() may not observe\nthe added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime\nblk_mq_mark_tag_wait() can\u0027t get driver tag successfully.\n\nThis issue can be reproduced by running the following test in loop, and\nfio hang can be observed in \u003c 30min when running it on my test VM\nin laptop.\n\n\tmodprobe -r scsi_debug\n\tmodprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4\n\tdev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`\n\tfio --filename=/dev/\"$dev\" --direct=1 --rw=randrw --bs=4k --iodepth=1 \\\n       \t\t--runtime=100 --numjobs=40 --time_based --name=test \\\n        \t--ioengine=libaio\n\nFix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which\nis just fine in case of running out of tag."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:01:56.325Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10"
        },
        {
          "url": "https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed"
        }
      ],
      "title": "blk-mq: fix IO hang from sbitmap wakeup race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26671",
    "datePublished": "2024-04-02T06:49:13.834Z",
    "dateReserved": "2024-02-19T14:20:24.150Z",
    "dateUpdated": "2026-05-11T20:01:56.325Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26686 (GCVE-0-2024-26686)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:54 – Updated: 2026-05-11 20:02

Title

fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats

Summary

In the Linux kernel, the following vulnerability has been resolved: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats lock_task_sighand() can trigger a hard lockup. If NR_CPUS threads call do_task_stat() at the same time and the process has NR_THREADS, it will spin with irqs disabled O(NR_CPUS * NR_THREADS) time. Change do_task_stat() to use sig->stats_lock to gather the statistics outside of ->siglock protected section, in the likely case this code will run lockless.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-03 18:03 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/4fe85bdaabd63f8f8…
https://git.kernel.org/stable/c/0c35d1914353799c5…
https://git.kernel.org/stable/c/cf4b8c39b9a0bd81c…
https://git.kernel.org/stable/c/3820b0fac7732a653…
https://git.kernel.org/stable/c/27978243f165b44e3…
https://git.kernel.org/stable/c/7601df8031fd67310…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4fe85bdaabd63f8f8579b24a10ed597c9c482164 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0c35d1914353799c54fa1843fe7dea6fcbcdbac5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < cf4b8c39b9a0bd81c47afc7ef62914a62dd5ec4d (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 3820b0fac7732a653bcc6f6ac20c1d72e697f8f6 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 27978243f165b44e342f28f449b91327944ea071 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 7601df8031fd67310af891897ef6cc0df4209305 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 5.10.237 , ≤ 5.10.* (semver) Unaffected: 5.15.181 , ≤ 5.15.* (semver) Unaffected: 6.1.82 , ≤ 6.1.* (semver) Unaffected: 6.6.64 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26686",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T18:03:13.492262Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:23.666Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:30.034Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf4b8c39b9a0bd81c47afc7ef62914a62dd5ec4d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/27978243f165b44e342f28f449b91327944ea071"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7601df8031fd67310af891897ef6cc0df4209305"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fe85bdaabd63f8f8579b24a10ed597c9c482164",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0c35d1914353799c54fa1843fe7dea6fcbcdbac5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cf4b8c39b9a0bd81c47afc7ef62914a62dd5ec4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3820b0fac7732a653bcc6f6ac20c1d72e697f8f6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "27978243f165b44e342f28f449b91327944ea071",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "7601df8031fd67310af891897ef6cc0df4209305",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.237",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.237",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.181",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.82",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.64",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/proc: do_task_stat: use sig-\u003estats_lock to gather the threads/children stats\n\nlock_task_sighand() can trigger a hard lockup.  If NR_CPUS threads call\ndo_task_stat() at the same time and the process has NR_THREADS, it will\nspin with irqs disabled O(NR_CPUS * NR_THREADS) time.\n\nChange do_task_stat() to use sig-\u003estats_lock to gather the statistics\noutside of -\u003esiglock protected section, in the likely case this code will\nrun lockless."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:02:14.338Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fe85bdaabd63f8f8579b24a10ed597c9c482164"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c35d1914353799c54fa1843fe7dea6fcbcdbac5"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf4b8c39b9a0bd81c47afc7ef62914a62dd5ec4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3820b0fac7732a653bcc6f6ac20c1d72e697f8f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/27978243f165b44e342f28f449b91327944ea071"
        },
        {
          "url": "https://git.kernel.org/stable/c/7601df8031fd67310af891897ef6cc0df4209305"
        }
      ],
      "title": "fs/proc: do_task_stat: use sig-\u003estats_lock to gather the threads/children stats",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26686",
    "datePublished": "2024-04-03T14:54:48.530Z",
    "dateReserved": "2024-02-19T14:20:24.154Z",
    "dateUpdated": "2026-05-11T20:02:14.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26826 (GCVE-0-2024-26826)

Vulnerability from cvelistv5 – Published: 2024-04-17 09:43 – Updated: 2026-08-05 11:27

Title

mptcp: fix data re-injection from stale subflow

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring unneeded locks, it first try to check if any unacked data is present at all in the RTX queue, but such check is currently broken, as it uses TCP-specific helper on an MPTCP socket. Funnily enough fuzzers and static checkers are happy, as the accessed memory still belongs to the mptcp_sock struct, and even from a functional perspective the recovery completed successfully, as the short-cut test always failed. A recent unrelated TCP change - commit d5fed5addb2b ("tcp: reorganize tcp_sock fast path variables") - exposed the issue, as the tcp field reorganization makes the mptcp code always skip the re-inection. Fix the issue dropping the bogus call: we are on a slow path, the early optimization proved once again to be evil.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:49 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/6f95120f898b40d13…
https://git.kernel.org/stable/c/6673d9f1c2cd98439…
https://git.kernel.org/stable/c/b609c783c535493aa…
https://git.kernel.org/stable/c/624902eab7abcb873…
https://git.kernel.org/stable/c/b6c620dc43ccb4e80…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd , < 6f95120f898b40d13fd441225ef511307853c9c2 (git) Affected: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd , < 6673d9f1c2cd984390550dbdf7d5ae07b20abbf8 (git) Affected: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd , < b609c783c535493aa3fca22c7e40a120370b1ca5 (git) Affected: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd , < 624902eab7abcb8731b333ec73f206d38d839cd8 (git) Affected: 1e1d9d6f119c55c05e8ea78ed3e49046690abffd , < b6c620dc43ccb4e802894e54b651cf81495e9598 (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.149 , ≤ 5.15.* (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.18 , ≤ 6.6.* (semver) Unaffected: 6.7.6 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:49:00.883183Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:30.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f95120f898b40d13fd441225ef511307853c9c2",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "6673d9f1c2cd984390550dbdf7d5ae07b20abbf8",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "b609c783c535493aa3fca22c7e40a120370b1ca5",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "624902eab7abcb8731b333ec73f206d38d839cd8",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            },
            {
              "lessThan": "b6c620dc43ccb4e802894e54b651cf81495e9598",
              "status": "affected",
              "version": "1e1d9d6f119c55c05e8ea78ed3e49046690abffd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.149",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.18",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix data re-injection from stale subflow\n\nWhen the MPTCP PM detects that a subflow is stale, all the packet\nscheduler must re-inject all the mptcp-level unacked data. To avoid\nacquiring unneeded locks, it first try to check if any unacked data\nis present at all in the RTX queue, but such check is currently\nbroken, as it uses TCP-specific helper on an MPTCP socket.\n\nFunnily enough fuzzers and static checkers are happy, as the accessed\nmemory still belongs to the mptcp_sock struct, and even from a\nfunctional perspective the recovery completed successfully, as\nthe short-cut test always failed.\n\nA recent unrelated TCP change - commit d5fed5addb2b (\"tcp: reorganize\ntcp_sock fast path variables\") - exposed the issue, as the tcp field\nreorganization makes the mptcp code always skip the re-inection.\n\nFix the issue dropping the bogus call: we are on a slow path, the early\noptimization proved once again to be evil."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is only reached from remote-peer-driven MPTCP events \u2014 stale-subflow detection when a peer stops ACKing on a path, and subflow teardown via RST/MP_TCPRST/RM_ADDR. No local access to the target is involved.\nAC:L - A malicious MPTCP peer controls every precondition: it creates the additional subflow via MP_JOIN/ADD_ADDR and then stalls or resets it while the target is sending. There is no race to win and the outcome is deterministic on affected builds.\nPR:N - The attacker is simply the remote end of an MPTCP connection to a listening service and needs no credentials or account on the target host. The stale/close handling runs on any established MPTCP connection.\nUI:N - The condition is driven entirely by the attacker\u0027s own packet behavior on an established connection. No action by a local user or administrator is required.\nS:U - The impact is confined to the MPTCP stack of the same kernel and the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The type-confused read stays within the mptcp_sock allocation and its result only selects a code path; no memory contents are returned to userspace or transmitted to the peer. There is no information disclosure.\nI:N - No memory is written out of bounds and no data in transit is corrupted \u2014 MPTCP DSS sequencing still guarantees in-order delivery, and I confirmed the RTX timer still covers fully-sent dfrags while the push path completes partially-sent ones. Nothing is silently modified.\nA:H - With re-injection disabled, recovery falls back to retransmitting a single head fragment per RTO, so an attacker who blackholes one path can indefinitely stall data transfer on the connection while the receiver is head-of-line blocked and kernel sndbuf memory stays pinned. The attacker sustains and repeats this at will across connections, amounting to a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:40.642Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f95120f898b40d13fd441225ef511307853c9c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6673d9f1c2cd984390550dbdf7d5ae07b20abbf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b609c783c535493aa3fca22c7e40a120370b1ca5"
        },
        {
          "url": "https://git.kernel.org/stable/c/624902eab7abcb8731b333ec73f206d38d839cd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6c620dc43ccb4e802894e54b651cf81495e9598"
        }
      ],
      "title": "mptcp: fix data re-injection from stale subflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26826",
    "datePublished": "2024-04-17T09:43:51.741Z",
    "dateReserved": "2024-02-19T14:20:24.181Z",
    "dateUpdated": "2026-08-05T11:27:40.642Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26961 (GCVE-0-2024-26961)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:19 – Updated: 2026-08-05 11:28

Title

mac802154: fix llsec key resources release in mac802154_llsec_key_del

Summary

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org).

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-28 17:51 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/068ab2759bc0b4daf…
https://git.kernel.org/stable/c/d3d858650933d44ac…
https://git.kernel.org/stable/c/dcd51ab42b7a04315…
https://git.kernel.org/stable/c/20d3e1c8a18474972…
https://git.kernel.org/stable/c/640297c3e897bd7e1…
https://git.kernel.org/stable/c/49c8951680d7b76fc…
https://git.kernel.org/stable/c/e8a1e58345cf40b7b…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < 068ab2759bc0b4daf0b964de61b2731449c86531 (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < d3d858650933d44ac12c1f31337e7110c2071821 (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < dcd51ab42b7a0431575689c5f74b8b6efd45fc2f (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < 20d3e1c8a1847497269f04d874b2a5818ec29e2d (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < 640297c3e897bd7e1481466a6a5cb9560f1edb88 (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < 49c8951680d7b76fceaee89dcfbab1363fb24fd1 (git) Affected: 5d637d5aabd85132bd85779677d8acb708e0ed90 , < e8a1e58345cf40b7b272e08ac7b32328b2543e40 (git)
Linux	Linux	Affected: 3.16 Unaffected: 0 , < 3.16 (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T17:51:17.536237Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:15.130Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.779Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:50:51.260Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg802154.h",
            "net/mac802154/llsec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "068ab2759bc0b4daf0b964de61b2731449c86531",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "d3d858650933d44ac12c1f31337e7110c2071821",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "dcd51ab42b7a0431575689c5f74b8b6efd45fc2f",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "20d3e1c8a1847497269f04d874b2a5818ec29e2d",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "640297c3e897bd7e1481466a6a5cb9560f1edb88",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "49c8951680d7b76fceaee89dcfbab1363fb24fd1",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            },
            {
              "lessThan": "e8a1e58345cf40b7b272e08ac7b32328b2543e40",
              "status": "affected",
              "version": "5d637d5aabd85132bd85779677d8acb708e0ed90",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/cfg802154.h",
            "net/mac802154/llsec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmac802154: fix llsec key resources release in mac802154_llsec_key_del\n\nmac802154_llsec_key_del() can free resources of a key directly without\nfollowing the RCU rules for waiting before the end of a grace period. This\nmay lead to use-after-free in case llsec_lookup_key() is traversing the\nlist of keys in parallel with a key deletion:\n\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0\nModules linked in:\nCPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0x162/0x2a0\nCall Trace:\n \u003cTASK\u003e\n llsec_lookup_key.isra.0+0x890/0x9e0\n mac802154_llsec_encrypt+0x30c/0x9c0\n ieee802154_subif_start_xmit+0x24/0x1e0\n dev_hard_start_xmit+0x13e/0x690\n sch_direct_xmit+0x2ae/0xbc0\n __dev_queue_xmit+0x11dd/0x3c20\n dgram_sendmsg+0x90b/0xd60\n __sys_sendto+0x466/0x4c0\n __x64_sys_sendto+0xe0/0x1c0\n do_syscall_64+0x45/0xf0\n entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nAlso, ieee802154_llsec_key_entry structures are not freed by\nmac802154_llsec_key_del():\n\nunreferenced object 0xffff8880613b6980 (size 64):\n  comm \"iwpan\", pid 2176, jiffies 4294761134 (age 60.475s)\n  hex dump (first 32 bytes):\n    78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x.......\".......\n    00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................\n  backtrace:\n    [\u003cffffffff81dcfa62\u003e] __kmem_cache_alloc_node+0x1e2/0x2d0\n    [\u003cffffffff81c43865\u003e] kmalloc_trace+0x25/0xc0\n    [\u003cffffffff88968b09\u003e] mac802154_llsec_key_add+0xac9/0xcf0\n    [\u003cffffffff8896e41a\u003e] ieee802154_add_llsec_key+0x5a/0x80\n    [\u003cffffffff8892adc6\u003e] nl802154_add_llsec_key+0x426/0x5b0\n    [\u003cffffffff86ff293e\u003e] genl_family_rcv_msg_doit+0x1fe/0x2f0\n    [\u003cffffffff86ff46d1\u003e] genl_rcv_msg+0x531/0x7d0\n    [\u003cffffffff86fee7a9\u003e] netlink_rcv_skb+0x169/0x440\n    [\u003cffffffff86ff1d88\u003e] genl_rcv+0x28/0x40\n    [\u003cffffffff86fec15c\u003e] netlink_unicast+0x53c/0x820\n    [\u003cffffffff86fecd8b\u003e] netlink_sendmsg+0x93b/0xe60\n    [\u003cffffffff86b91b35\u003e] ____sys_sendmsg+0xac5/0xca0\n    [\u003cffffffff86b9c3dd\u003e] ___sys_sendmsg+0x11d/0x1c0\n    [\u003cffffffff86b9c65a\u003e] __sys_sendmsg+0xfa/0x1d0\n    [\u003cffffffff88eadbf5\u003e] do_syscall_64+0x45/0xf0\n    [\u003cffffffff890000ea\u003e] entry_SYSCALL_64_after_hwframe+0x6e/0x76\n\nHandle the proper resource release in the RCU callback function\nmac802154_llsec_key_del_rcu().\n\nNote that if llsec_lookup_key() finds a key, it gets a refcount via\nllsec_key_get() and locally copies key id from key_entry (which is a\nlist element). So it\u0027s safe to call llsec_key_put() and free the list\nentry after the RCU grace period elapses.\n\nFound by Linux Verification Center (linuxtesting.org)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The exploitable racing reader is driven from a local `AF_IEEE802154` datagram socket via `sendmsg()` into `mac802154_llsec_encrypt()`, and the key-deletion side is a local genetlink operation; no remote peer can reach both sides.\nAC:H - The unprivileged attacker controls only the reader side (an unbounded `sendmsg()` loop hitting `llsec_lookup_key()`); the freeing side is a `CAP_NET_ADMIN` key deletion (e.g. llsec key rotation) that the attacker cannot initiate, so the narrow window between `list_del_rcu()` and `kfree_sensitive()` depends on a condition outside their control.\nPR:L - Creating an `AF_IEEE802154` `SOCK_DGRAM` socket and transmitting requires no capability (only `SOCK_RAW` checks `CAP_NET_RAW`), so any unprivileged local user can occupy the RCU read side and take the use-after-free in their own context.\nUI:N - No victim action is required; the attacker simply keeps the transmit path spinning in `llsec_lookup_key()` until a key removal lands.\nS:U - The corruption is confined to kernel heap objects managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Use-after-free on `struct mac802154_llsec_key` lets an attacker reclaim the freed slab object and have the kernel treat attacker-controlled bytes as crypto transform state, yielding kernel memory disclosure primitives.\nI:H - The freed object is immediately written to (`kref_get` increments a refcount inside freed memory) and its `tfm[]`/`tfm0` pointers are dereferenced and called through by `llsec_do_encrypt()`/`llsec_do_decrypt()`, giving a heap-spray-to-control-flow-hijack path.\nA:H - The bug already produces a `refcount_warn_saturate()` splat and dereferences freed crypto transform pointers, reliably oopsing the kernel; the leaked `ieee802154_llsec_key_entry` allocations compound it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:39.786Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88"
        },
        {
          "url": "https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40"
        }
      ],
      "title": "mac802154: fix llsec key resources release in mac802154_llsec_key_del",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26961",
    "datePublished": "2024-05-01T05:19:16.361Z",
    "dateReserved": "2024-02-19T14:20:24.201Z",
    "dateUpdated": "2026-08-05T11:28:39.786Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36889 (GCVE-0-2024-36889)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:28 – Updated: 2026-05-11 20:16

Title

mptcp: ensure snd_nxt is properly initialized on connect

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:29 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/99951b62bf20cec92…
https://git.kernel.org/stable/c/dc941fec0719d0471…
https://git.kernel.org/stable/c/39ca83ed73db9edcc…
https://git.kernel.org/stable/c/aa0c07c1f20e05b30…
https://git.kernel.org/stable/c/592f69b41766d366d…
https://git.kernel.org/stable/c/fb7a0d334894206ae…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < 99951b62bf20cec9247f633a3bea898338b9e5b4 (git) Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < dc941fec0719d0471a5902424d6b2a17df233193 (git) Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < 39ca83ed73db9edcc6d70c0dc7a73085a4725012 (git) Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < aa0c07c1f20e05b30019bff083ec43665536f06f (git) Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < 592f69b41766d366dbb8ff4ef5a67c4396527bbe (git) Affected: 8fd738049ac3d67a937d36577763b47180aae1ad , < fb7a0d334894206ae35f023a82cad5a290fd7386 (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.218 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:29:56.745706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:33:02.390Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.113Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99951b62bf20cec9247f633a3bea898338b9e5b4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc941fec0719d0471a5902424d6b2a17df233193"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39ca83ed73db9edcc6d70c0dc7a73085a4725012"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa0c07c1f20e05b30019bff083ec43665536f06f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/592f69b41766d366dbb8ff4ef5a67c4396527bbe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fb7a0d334894206ae35f023a82cad5a290fd7386"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99951b62bf20cec9247f633a3bea898338b9e5b4",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            },
            {
              "lessThan": "dc941fec0719d0471a5902424d6b2a17df233193",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            },
            {
              "lessThan": "39ca83ed73db9edcc6d70c0dc7a73085a4725012",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            },
            {
              "lessThan": "aa0c07c1f20e05b30019bff083ec43665536f06f",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            },
            {
              "lessThan": "592f69b41766d366dbb8ff4ef5a67c4396527bbe",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            },
            {
              "lessThan": "fb7a0d334894206ae35f023a82cad5a290fd7386",
              "status": "affected",
              "version": "8fd738049ac3d67a937d36577763b47180aae1ad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.218",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: ensure snd_nxt is properly initialized on connect\n\nChristoph reported a splat hinting at a corrupted snd_una:\n\n  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Modules linked in:\n  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n  Workqueue: events mptcp_worker\n  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n  \t8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n  \t\u003c0f\u003e 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\n  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\n  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\n  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\n  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\n  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\n  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\n  Call Trace:\n   \u003cTASK\u003e\n   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\n   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\n   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\n   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254\n   process_scheduled_works kernel/workqueue.c:3335 [inline]\n   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416\n   kthread+0x121/0x170 kernel/kthread.c:388\n   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n   \u003c/TASK\u003e\n\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using \u0027bad\u0027 snd_una values.\n\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\n\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:16:27.021Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99951b62bf20cec9247f633a3bea898338b9e5b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc941fec0719d0471a5902424d6b2a17df233193"
        },
        {
          "url": "https://git.kernel.org/stable/c/39ca83ed73db9edcc6d70c0dc7a73085a4725012"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa0c07c1f20e05b30019bff083ec43665536f06f"
        },
        {
          "url": "https://git.kernel.org/stable/c/592f69b41766d366dbb8ff4ef5a67c4396527bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb7a0d334894206ae35f023a82cad5a290fd7386"
        }
      ],
      "title": "mptcp: ensure snd_nxt is properly initialized on connect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36889",
    "datePublished": "2024-05-30T15:28:56.794Z",
    "dateReserved": "2024-05-30T15:25:07.065Z",
    "dateUpdated": "2026-05-11T20:16:27.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:8613

CVE-2021-47384 (GCVE-0-2021-47384)

CVE-2022-50720 (GCVE-0-2022-50720)

CVE-2023-1252 (GCVE-0-2023-1252)

CVE-2023-52489 (GCVE-0-2023-52489)

CVE-2024-2201 (GCVE-0-2024-2201)

CVE-2024-26671 (GCVE-0-2024-26671)

CVE-2024-26686 (GCVE-0-2024-26686)

CVE-2024-26826 (GCVE-0-2024-26826)

CVE-2024-26961 (GCVE-0-2024-26961)

CVE-2024-36889 (GCVE-0-2024-36889)

Tags

Sightings

Nomenclature

Related by attack behaviour