Vulnerability-Lookup

RHSA-2024:9546

Vulnerability from csaf_redhat - Published: 2024-11-13 15:59 - Updated: 2026-08-04 18:07

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amdgpu: use-after-free vulnerability (CVE-2024-26656) * kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (CVE-2024-26772) * kernel: net: bridge: switchdev: Skip MDB replays of deferred events on offload (CVE-2024-26837) * kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (CVE-2024-26906) * kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (CVE-2024-26870) * kernel: nouveau: fix instmem race condition around ptr stores (CVE-2024-26984) * kernel: drm/client: Fully protect modes[] with dev->mode_config.mutex (CVE-2024-35950) * kernel: spi: Fix null dereference on suspend (CVE-2023-52749) * kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (CVE-2024-38596) * kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CVE-2024-38564) * kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (CVE-2024-31076) * kernel: drm/i915/dpt: Make DPT object unshrinkable (CVE-2024-40924) * kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (CVE-2024-40956) * kernel: drm/radeon: fix UBSAN warning in kv_dpm.c (CVE-2024-40988) * kernel: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CVE-2024-40901) * kernel: sched/deadline: Fix task_struct reference leak (CVE-2024-41023) * kernel: drm/radeon: check bo_va->bo is non-NULL before using it (CVE-2024-41060) * kernel: ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066) * kernel: mptcp: pm: Fix uaf in __timer_delete_sync (CVE-2024-46858) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-52749

In the Linux kernel, the following vulnerability has been resolved: spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes. Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL) Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-devel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-doc-0:5.14.0-427.44.1.el9_4.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.44.1.el9_4.src	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-427.44.1.el9_4.noarch	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-uki-virt-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.aarch64	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.ppc64le	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.s390x	—	Vendor Fix fix
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-kvm-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: NFV-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-devel-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix
Unresolved product id: RT-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.44.1.el9_4.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2024-26656

A failure flaw was found in the Linux kernel’s AMDGPU driver in how a user sends ioctl with an invalid address and size when using the AMD GPU. This flaw allows a local user to crash the system.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-26772

A vulnerability was found in the ext4_mb_find_by_goal() function in the Linux kernel. This issue could lead to memory corruption or crashes due to the allocation of blocks from a group with a corrupted block bitmap.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-229 - Improper Handling of Values

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-26837

A flaw was found in the Linux kernel. A race condition in network bridge management could lead to a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-26870

A flaw was found in the Linux kernel. A system error can be reliably replicated with specific filesystem settings, allowing an attacker to cause a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-26906

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() The Linux kernel CVE team has assigned CVE-2024-26906 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024041746-CVE-2024-26906-bb35@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-26984

A flaw was found in the nouveau module in the Linux kernel. In some conditions, a race condition can cause a NULL pointer dereference, resulting in a denial of service.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-31076

In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instead, the change is deferred until the next instance of the interrupt being triggered on the original CPU. When the interrupt next triggers on the original CPU, the new affinity is enforced within __irq_move_irq(). A vector is allocated from the new CPU, but the old vector on the original CPU remains and is not immediately reclaimed. Instead, apicd->move_in_progress is flagged, and the reclaiming process is delayed until the next trigger of the interrupt on the new CPU. Upon the subsequent triggering of the interrupt on the new CPU, irq_complete_move() adds a task to the old CPU's vector_cleanup list if it remains online. Subsequently, the timer on the old CPU iterates over its vector_cleanup list, reclaiming old vectors. However, a rare scenario arises if the old CPU is outgoing before the interrupt triggers again on the new CPU. In that case irq_force_complete_move() is not invoked on the outgoing CPU to reclaim the old apicd->prev_vector because the interrupt isn't currently affine to the outgoing CPU, and irq_needs_fixup() returns false. Even though __vector_schedule_cleanup() is later called on the new CPU, it doesn't reclaim apicd->prev_vector; instead, it simply resets both apicd->move_in_progress and apicd->prev_vector to 0. As a result, the vector remains unreclaimed in vector_matrix, leading to a CPU vector leak. To address this issue, move the invocation of irq_force_complete_move() before the irq_needs_fixup() call to reclaim apicd->prev_vector, if the interrupt is currently or used to be affine to the outgoing CPU. Additionally, reclaim the vector in __vector_schedule_cleanup() as well, following a warning message, although theoretically it should never see apicd->move_in_progress with apicd->prev_cpu pointing to an offline CPU.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-35814

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling The Linux kernel CVE team has assigned CVE-2024-35814 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051742-CVE-2024-35814-98c7@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-35950

A flaw in the Linux kernel's Direct Rendering Manager (DRM) client could cause system instability. The problem occurs because the modes[] array, used to store display mode pointers, wasn’t adequately protected by a mutex lock. This allows the array to reference memory that has already been freed or reused, leading to potential crashes or unpredictable behavior.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-38564

In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE bpf_prog_attach uses attach_type_to_prog_type to enforce proper attach type for BPF_PROG_TYPE_CGROUP_SKB. link_create uses bpf_prog_get and relies on bpf_prog_attach_check_attach_type to properly verify prog_type <> attach_type association. Add missing attach_type enforcement for the link_create case. Otherwise, it's currently possible to attach cgroup_skb prog types to other cgroup hooks.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-665 - Improper Initialization

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-38596

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg A data-race condition has been identified in af_unix. In one data path, the write function unix_release_sock() atomically writes to sk->sk_shutdown using WRITE_ONCE. However, on the reader side, unix_stream_sendmsg() does not read it atomically. Consequently, this issue is causing the following KCSAN splat to occur: BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28: unix_release_sock (net/unix/af_unix.c:640) unix_release (net/unix/af_unix.c:1050) sock_close (net/socket.c:659 net/socket.c:1421) __fput (fs/file_table.c:422) __fput_sync (fs/file_table.c:508) __se_sys_close (fs/open.c:1559 fs/open.c:1541) __x64_sys_close (fs/open.c:1541) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14: unix_stream_sendmsg (net/unix/af_unix.c:2273) __sock_sendmsg (net/socket.c:730 net/socket.c:745) ____sys_sendmsg (net/socket.c:2584) __sys_sendmmsg (net/socket.c:2638 net/socket.c:2724) __x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750) x64_sys_call (arch/x86/entry/syscall_64.c:33) do_syscall_64 (arch/x86/entry/common.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) value changed: 0x01 -> 0x03 The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7"). Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.") addressed a comparable issue in the past regarding sk->sk_shutdown. However, it overlooked resolving this particular data path. This patch only offending unix_stream_sendmsg() function, since the other reads seem to be protected by unix_state_lock() as discussed in

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-40901

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions operate on long values, and when testing or setting a single word, they can exceed the word boundary. KASAN detects this issue and produces a dump: BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965 For full log, please look at [1]. Make the allocation at least the size of sizeof(unsigned long) so that set_bit() and test_bit() have sufficient room for read/write operations without overwriting unallocated memory. [1] Link: https://lore.kernel.org/all/ZkNcALr3W3KGYYJG@gmail.com/

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-40924

In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Make DPT object unshrinkable In some scenarios, the DPT object gets shrunk but the actual framebuffer did not and thus its still there on the DPT's vm->bound_list. Then it tries to rewrite the PTEs via a stale CPU mapping. This causes panic. [vsyrjala: Add TODO comment] (cherry picked from commit 51064d471c53dcc8eddd2333c3f1c1d9131ba36c)

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-40956

A vulnerability was found in the Linux kernel's DMA engine component in the irq_process_work_list() function. A possible use-after-free condition can occur during list iteration, which is because a descriptor may be freed while another thread is reusing it, potentially leading to access to freed memory.

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-40988

A vulnerability was found in the Linux kernel's DRM/Radeon driver, specifically in the sumo_vid_mapping_entry within the kv_dpm.c file. Insufficient bounds checking can lead to memory corruption.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-41023

A vulnerability was found in the Linux kernel's deadline scheduler in the enqueue_task_dl() function, where the reference count is improperly decremented in certain situations, potentially causing a memory leak. This issue can lead to memory exhaustion over time.

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

CWE-401 - Missing Release of Memory after Effective Lifetime

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-41060

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

CVE-2024-41066

In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consumer_index] = IBMVNIC_INVALID_MAP; consumer_index ++; Where variable data looks like this: free_map == [4, IBMVNIC_INVALID_MAP, IBMVNIC_INVALID_MAP, 0, 3] consumer_index^ tx_buff == [skb=null, skb=<ptr>, skb=<ptr>, skb=null, skb=null] The driver has checks to ensure that free_map[consumer_index] pointed to a valid index but there was no check to ensure that this index pointed to an unused/null skb address. So, if, by some chance, our free_map and tx_buff lists become out of sync then we were previously risking an skb memory leak. This could then cause tcp congestion control to stop sending packets, eventually leading to ETIMEDOUT. Therefore, add a conditional to ensure that the skb address is null. If not then warn the user (because this is still a bug that should be patched) and free the old pointer to prevent memleak/tcp problems.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Low

CVE-2024-46858

A use-after-free flaw was found in the Linux kernel’s Multipath TCP (MPTCP) subsystem. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52749

Threats

Impact Moderate

References

122 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:9546	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2272692	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273242	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275580	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275635	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275711	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278333	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281942	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282679	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293371	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293684	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297508	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297540	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297572	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297706	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300381	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300442	external
https://bugzilla.redhat.com/show_bug.cgi?id=2315210	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-52749	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282679	external
https://www.cve.org/CVERecord?id=CVE-2023-52749	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52749	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26656	self
https://bugzilla.redhat.com/show_bug.cgi?id=2272692	external
https://www.cve.org/CVERecord?id=CVE-2024-26656	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26656	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26772	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273242	external
https://www.cve.org/CVERecord?id=CVE-2024-26772	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26772	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26837	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275580	external
https://www.cve.org/CVERecord?id=CVE-2024-26837	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26837	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26870	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275711	external
https://www.cve.org/CVERecord?id=CVE-2024-26870	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26870	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26906	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275635	external
https://www.cve.org/CVERecord?id=CVE-2024-26906	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26906	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26984	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278333	external
https://www.cve.org/CVERecord?id=CVE-2024-26984	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26984	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-31076	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293684	external
https://www.cve.org/CVERecord?id=CVE-2024-31076	external
https://nvd.nist.gov/vuln/detail/CVE-2024-31076	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-35814	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281207	external
https://www.cve.org/CVERecord?id=CVE-2024-35814	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35814	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35950	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281942	external
https://www.cve.org/CVERecord?id=CVE-2024-35950	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35950	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-38564	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293429	external
https://www.cve.org/CVERecord?id=CVE-2024-38564	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38564	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38596	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293371	external
https://www.cve.org/CVERecord?id=CVE-2024-38596	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38596	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-40901	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297706	external
https://www.cve.org/CVERecord?id=CVE-2024-40901	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40901	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40924	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297508	external
https://www.cve.org/CVERecord?id=CVE-2024-40924	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40924	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40956	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297540	external
https://www.cve.org/CVERecord?id=CVE-2024-40956	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40956	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40988	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297572	external
https://www.cve.org/CVERecord?id=CVE-2024-40988	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40988	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41023	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300381	external
https://www.cve.org/CVERecord?id=CVE-2024-41023	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41023	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41060	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300434	external
https://www.cve.org/CVERecord?id=CVE-2024-41060	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41060	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41066	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300442	external
https://www.cve.org/CVERecord?id=CVE-2024-41066	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41066	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-46858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2315210	external
https://www.cve.org/CVERecord?id=CVE-2024-46858	external
https://nvd.nist.gov/vuln/detail/CVE-2024-46858	external
https://lore.kernel.org/linux-cve-announce/202409…	external

JSON

To clipboard

Loading 1.8 MB of JSON…

BDU:2026-03638

Vulnerability from fstec - Published: 30.04.2024

Title

Уязвимость функции bpf_prog_attach_check_attach_type() модуля kernel/bpf/syscall.c поддержки интерпретатора BPF ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Description

Уязвимость функции bpf_prog_attach_check_attach_type() модуля kernel/bpf/syscall.c поддержки интерпретатора BPF ядра операционной системы Linux связана с некорректной инициализацией ресурса. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity


                    
                      AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Vendor

Red Hat, Inc., Canonical Ltd., Сообщество свободного программного обеспечения

Software Name

Red Hat Enterprise Linux, Ubuntu, Linux

Software Version

8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.8 Extended Update Support (Red Hat Enterprise Linux), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), от 6.7 до 6.8.11 включительно (Linux), от 6.9 до 6.9.2 включительно (Linux), 9.4 Extended Update Support (Red Hat Enterprise Linux), от 5.7 до 6.6.32 включительно (Linux)

Possible Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Linux: https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172 https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d https://git.kernel.org/linus/543576ec15b17c0c93301ac8297333c7b6e84ac7 Для программных продуктов Red Hat Inc.: https://access.redhat.com/security/cve/cve-2024-38564 Для программных продуктов Ubuntu: https://ubuntu.com/security/CVE-2024-38564

Reference

https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd https://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172 https://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d https://www.cve.org/CVERecord?id=CVE-2024-38564 https://lore.kernel.org/linux-cve-announce/2024061955-CVE-2024-38564-b069@gregkh/ https://git.kernel.org/linus/543576ec15b17c0c93301ac8297333c7b6e84ac7 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.33 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.12 https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.3 https://access.redhat.com/security/cve/cve-2024-38564 https://ubuntu.com/security/CVE-2024-38564

CWE

CWE-665

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Red Hat, Inc., Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "8 (Red Hat Enterprise Linux), 20.04 LTS (Ubuntu), 22.04 LTS (Ubuntu), 9 (Red Hat Enterprise Linux), 8.8 Extended Update Support (Red Hat Enterprise Linux), 9.2 Extended Update Support (Red Hat Enterprise Linux), 24.04 LTS (Ubuntu), 8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux), 8.6 Telecommunications Update Service (Red Hat Enterprise Linux), 8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux), \u043e\u0442 6.7 \u0434\u043e 6.8.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 6.9 \u0434\u043e 6.9.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), 9.4 Extended Update Support (Red Hat Enterprise Linux), \u043e\u0442 5.7 \u0434\u043e 6.6.32 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd\nhttps://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172\nhttps://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d\nhttps://git.kernel.org/linus/543576ec15b17c0c93301ac8297333c7b6e84ac7\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Red Hat Inc.:\nhttps://access.redhat.com/security/cve/cve-2024-38564\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2024-38564",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "30.04.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "25.03.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "25.03.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-03638",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-38564, RHSA-2024:10262, RHSA-2024:10281, RHSA-2024:10282, RHSA-2024:10945, RHSA-2024:10946, RHSA-2024:11486, RHSA-2024:6297, RHSA-2024:9546",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Red Hat Enterprise Linux, Ubuntu, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Red Hat, Inc. Red Hat Enterprise Linux 8 , Canonical Ltd. Ubuntu 20.04 LTS , Canonical Ltd. Ubuntu 22.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 9 , Red Hat, Inc. Red Hat Enterprise Linux 8.8 Extended Update Support , Red Hat, Inc. Red Hat Enterprise Linux 9.2 Extended Update Support , Canonical Ltd. Ubuntu 24.04 LTS , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service , Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.7 \u0434\u043e 6.8.11 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.9 \u0434\u043e 6.9.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , Red Hat, Inc. Red Hat Enterprise Linux 9.4 Extended Update Support , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.7 \u0434\u043e 6.6.32 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 bpf_prog_attach_check_attach_type() \u043c\u043e\u0434\u0443\u043b\u044f kernel/bpf/syscall.c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 BPF \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0432\u0435\u0440\u043d\u0430\u044f \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f (CWE-665)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 bpf_prog_attach_check_attach_type() \u043c\u043e\u0434\u0443\u043b\u044f kernel/bpf/syscall.c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 BPF \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://git.kernel.org/stable/c/67929e973f5a347f05fef064fea4ae79e7cdb5fd\nhttps://git.kernel.org/stable/c/b34bbc76651065a5eafad8ddff1eb8d1f8473172\nhttps://git.kernel.org/stable/c/6675c541f540a29487a802d3135280b69b9f568d\nhttps://www.cve.org/CVERecord?id=CVE-2024-38564\nhttps://lore.kernel.org/linux-cve-announce/2024061955-CVE-2024-38564-b069@gregkh/\nhttps://git.kernel.org/linus/543576ec15b17c0c93301ac8297333c7b6e84ac7\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.33\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.12\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.3\nhttps://access.redhat.com/security/cve/cve-2024-38564\nhttps://ubuntu.com/security/CVE-2024-38564",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-665",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2023-52749 (GCVE-0-2023-52749)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:30 – Updated: 2026-05-11 19:32

Title

spi: Fix null dereference on suspend

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:36 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/4ec4508db97502a12…
https://git.kernel.org/stable/c/96474ea47dc67b070…
https://git.kernel.org/stable/c/bef4a48f4ef798c4f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < 4ec4508db97502a12daee88c74782e8d35ced068 (git) Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < 96474ea47dc67b0704392d59192b233c8197db0e (git) Affected: ae7d2346dc89ae89a6e0aabe6037591a11e593c0 , < bef4a48f4ef798c4feddf045d49e53c8a97d5e37 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.66 , ≤ 6.1.* (semver) Unaffected: 6.6.3 , ≤ 6.6.* (semver) Unaffected: 6.7 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52749",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:36:59.089454Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:37:26.791Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.612Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4ec4508db97502a12daee88c74782e8d35ced068"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/96474ea47dc67b0704392d59192b233c8197db0e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bef4a48f4ef798c4feddf045d49e53c8a97d5e37"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c",
            "include/linux/spi/spi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4ec4508db97502a12daee88c74782e8d35ced068",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            },
            {
              "lessThan": "96474ea47dc67b0704392d59192b233c8197db0e",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            },
            {
              "lessThan": "bef4a48f4ef798c4feddf045d49e53c8a97d5e37",
              "status": "affected",
              "version": "ae7d2346dc89ae89a6e0aabe6037591a11e593c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi.c",
            "include/linux/spi/spi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.66",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Fix null dereference on suspend\n\nA race condition exists where a synchronous (noqueue) transfer can be\nactive during a system suspend. This can cause a null pointer\ndereference exception to occur when the system resumes.\n\nExample order of events leading to the exception:\n1. spi_sync() calls __spi_transfer_message_noqueue() which sets\n   ctlr-\u003ecur_msg\n2. Spi transfer begins via spi_transfer_one_message()\n3. System is suspended interrupting the transfer context\n4. System is resumed\n6. spi_controller_resume() calls spi_start_queue() which resets cur_msg\n   to NULL\n7. Spi transfer context resumes and spi_finalize_current_message() is\n   called which dereferences cur_msg (which is now NULL)\n\nWait for synchronous transfers to complete before suspending by\nacquiring the bus mutex and setting/checking a suspend flag."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:32:27.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4ec4508db97502a12daee88c74782e8d35ced068"
        },
        {
          "url": "https://git.kernel.org/stable/c/96474ea47dc67b0704392d59192b233c8197db0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bef4a48f4ef798c4feddf045d49e53c8a97d5e37"
        }
      ],
      "title": "spi: Fix null dereference on suspend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52749",
    "datePublished": "2024-05-21T15:30:38.904Z",
    "dateReserved": "2024-05-21T15:19:24.234Z",
    "dateUpdated": "2026-05-11T19:32:27.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26656 (GCVE-0-2024-26656)

Vulnerability from cvelistv5 – Published: 2024-04-02 06:08 – Updated: 2026-08-05 11:26

Title

drm/amdgpu: fix use-after-free bug

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>. For example the following code: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret; arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); } Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled: [ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-02 14:54 UTC

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/2e13f88e01ae7e28a…
https://git.kernel.org/stable/c/e87e08c94c9541b4e…
https://git.kernel.org/stable/c/af054a5fb24a144f9…
https://git.kernel.org/stable/c/22f665ecfd1225afa…
https://git.kernel.org/stable/c/22207fd5c80177b86…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 2e13f88e01ae7e28a7e831bf5c2409c4748e0a60 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < e87e08c94c9541b4e18c4c13f2f605935f512605 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < af054a5fb24a144f99895afce9519d709891894c (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 22f665ecfd1225afa1309ace623157d12bb9bb0c (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 22207fd5c80177b860279653d017474b2812af5e (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.132 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26656",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-02T14:54:50.822759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:21:23.249Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:29:28.444Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2e13f88e01ae7e28a7e831bf5c2409c4748e0a60",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "e87e08c94c9541b4e18c4c13f2f605935f512605",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "af054a5fb24a144f99895afce9519d709891894c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "22f665ecfd1225afa1309ace623157d12bb9bb0c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "22207fd5c80177b860279653d017474b2812af5e",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix use-after-free bug\n\nThe bug can be triggered by sending a single amdgpu_gem_userptr_ioctl\nto the AMDGPU DRM driver on any ASICs with an invalid address and size.\nThe bug was reported by Joonkyo Jung \u003cjoonkyoj@yonsei.ac.kr\u003e.\nFor example the following code:\n\nstatic void Syzkaller1(int fd)\n{\n\tstruct drm_amdgpu_gem_userptr arg;\n\tint ret;\n\n\targ.addr = 0xffffffffffff0000;\n\targ.size = 0x80000000; /*2 Gb*/\n\targ.flags = 0x7;\n\tret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, \u0026arg);\n}\n\nDue to the address and size are not valid there is a failure in\namdgpu_hmm_register-\u003emmu_interval_notifier_insert-\u003e__mmu_interval_notifier_insert-\u003e\ncheck_shl_overflow, but we even the amdgpu_hmm_register failure we still call\namdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.\nThe following stack is below when the issue is reproduced when Kazan is enabled:\n\n[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020\n[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340\n[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff \u003c0f\u003e 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80\n[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246\n[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b\n[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260\n[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25\n[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00\n[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260\n[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000\n[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0\n[  +0.000010] Call Trace:\n[  +0.000006]  \u003cTASK\u003e\n[  +0.000007]  ? show_regs+0x6a/0x80\n[  +0.000018]  ? __warn+0xa5/0x1b0\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000018]  ? report_bug+0x24a/0x290\n[  +0.000022]  ? handle_bug+0x46/0x90\n[  +0.000015]  ? exc_invalid_op+0x19/0x50\n[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20\n[  +0.000017]  ? kasan_save_stack+0x26/0x50\n[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340\n[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340\n[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10\n[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0\n[  +0.000018]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? __kasan_check_read+0x11/0x20\n[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]\n[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]\n[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]\n[  +0.004291]  ? do_syscall_64+0x5f/0xe0\n[  +0.000023]  ? srso_return_thunk+0x5/0x5f\n[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]\n[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]\n[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004270]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20\n[  +0.000015]  ? srso_return_thunk+0x5/0x5f\n[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0\n[  +0.000020]  ? srso_return_thunk+0x5/0x5f\n[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20\n[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]\n[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]\n[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]\n[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]\n[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [d\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via `DRM_IOCTL_AMDGPU_GEM_USERPTR` on a local AMD GPU device node (`/dev/dri/renderD*` or `card*`); there is no remote or adjacent-network path to `amdgpu_gem_userptr_ioctl()`.\nAC:L - A single ioctl with a fully attacker-chosen `addr`/`size` (e.g. 0xffffffffffff0000 / 0x80000000) deterministically overflows the interval-tree range check and reaches the unbalanced `mmdrop()`; there is no race and no dependence on memory layout.\nPR:L - The ioctl is flagged `DRM_RENDER_ALLOW`, so `drm_ioctl_permit()` waives `DRM_AUTH` for render clients \u2014 any unprivileged local user or sandboxed app with an open render node (standard for desktop sessions, Android apps, and GPU-enabled containers) qualifies, with no capability check anywhere on the path.\nUI:N - The attacker performs the entire sequence itself by opening the render node and issuing the ioctl; no victim action or cooperation is required.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 the calling process\u0027s `mm_struct` and mmu-notifier tree \u2014 with no crossing of a VM, IOMMU, or hypervisor boundary.\nC:H - The unbalanced `mmdrop()` frees the live `mm_struct` and its PGD while still in use; reclaiming those objects yields page-table control and therefore arbitrary kernel and cross-process memory disclosure.\nI:H - The same use-after-free plus the `interval_tree_remove()` of a never-inserted node give heap-spray-controlled write primitives \u2014 freeing an in-use PGD allows forging page-table entries for arbitrary memory modification and privilege escalation.\nA:H - The path hits a `WARN_ON` (immediate panic under `panic_on_warn`), corrupts the mm\u0027s notifier interval tree, and tears down the running process\u0027s page tables, reliably crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:34.438Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2e13f88e01ae7e28a7e831bf5c2409c4748e0a60"
        },
        {
          "url": "https://git.kernel.org/stable/c/e87e08c94c9541b4e18c4c13f2f605935f512605"
        },
        {
          "url": "https://git.kernel.org/stable/c/af054a5fb24a144f99895afce9519d709891894c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22f665ecfd1225afa1309ace623157d12bb9bb0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/22207fd5c80177b860279653d017474b2812af5e"
        }
      ],
      "title": "drm/amdgpu: fix use-after-free bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26656",
    "datePublished": "2024-04-02T06:08:43.558Z",
    "dateReserved": "2024-02-19T14:20:24.145Z",
    "dateUpdated": "2026-08-05T11:26:34.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26772 (GCVE-0-2024-26772)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:27

Title

ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()

Summary

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-03 19:16 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8…
https://git.kernel.org/stable/c/6b92b1bc16d691c95…
https://git.kernel.org/stable/c/ffeb72a80a82aba59…
https://git.kernel.org/stable/c/8de8305a25bfda607…
https://git.kernel.org/stable/c/d639102f4cbd4cb65…
https://git.kernel.org/stable/c/d3bbe77a76bc52e9d…
https://git.kernel.org/stable/c/21dbe20589c7f48e9…
https://git.kernel.org/stable/c/832698373a2595094…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43 (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 6b92b1bc16d691c95b152c6dbf027ad64315668d (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < ffeb72a80a82aba59a6774b0611f792e0ed3b0b7 (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 8de8305a25bfda607fc13475ebe84b978c96d7ff (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < d639102f4cbd4cb65d1225dba3b9265596aab586 (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < d3bbe77a76bc52e9d4d0a120f1509be36e25c916 (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 21dbe20589c7f48e9c5d336ce6402bcebfa6d76a (git) Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 832698373a25950942c04a512daa652c18a9b513 (git)
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 4.19.308 , ≤ 4.19.* (semver) Unaffected: 5.4.270 , ≤ 5.4.* (semver) Unaffected: 5.10.211 , ≤ 5.10.* (semver) Unaffected: 5.15.150 , ≤ 5.15.* (semver) Unaffected: 6.1.80 , ≤ 6.1.* (semver) Unaffected: 6.6.19 , ≤ 6.6.* (semver) Unaffected: 6.7.7 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26772",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T19:16:02.816411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-01T15:30:43.236Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.428Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b92b1bc16d691c95b152c6dbf027ad64315668d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ffeb72a80a82aba59a6774b0611f792e0ed3b0b7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8de8305a25bfda607fc13475ebe84b978c96d7ff"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d639102f4cbd4cb65d1225dba3b9265596aab586"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d3bbe77a76bc52e9d4d0a120f1509be36e25c916"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21dbe20589c7f48e9c5d336ce6402bcebfa6d76a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/832698373a25950942c04a512daa652c18a9b513"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "6b92b1bc16d691c95b152c6dbf027ad64315668d",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "ffeb72a80a82aba59a6774b0611f792e0ed3b0b7",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "8de8305a25bfda607fc13475ebe84b978c96d7ff",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "d639102f4cbd4cb65d1225dba3b9265596aab586",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "d3bbe77a76bc52e9d4d0a120f1509be36e25c916",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "21dbe20589c7f48e9c5d336ce6402bcebfa6d76a",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "832698373a25950942c04a512daa652c18a9b513",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.308",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.270",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.211",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()\n\nPlaces the logic for checking if the group\u0027s block bitmap is corrupt under\nthe protection of the group lock to avoid allocating blocks from the group\nwith a corrupted block bitmap."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the ext4 block allocator, reached from local filesystem syscalls (write/fallocate/truncate) on a mounted ext4 volume. No network protocol handler is involved.\nAC:L - The attacker controls both sides of the race \u2014 one thread frees or scans blocks in a group to trigger corruption detection under the group lock while another thread issues a goal-hinted allocation into the same group, and the racing thread spins on ext4_lock_group() for the whole (long) critical section of the corruption detector, so the window is easily won and retried indefinitely.\nPR:L - Only an ordinary unprivileged local account is needed \u2014 any writable directory on an ext4 filesystem (e.g. /tmp or a home directory) lets the attacker drive both the allocation and the block-freeing paths. No capability or userns trick is required.\nUI:N - Exploitation happens through the attacker\u0027s own concurrent file I/O on an already-mounted filesystem; no victim action such as mounting an image or opening a file is required.\nS:U - The impact is confined to the kernel/OS security authority \u2014 filesystem metadata corruption and kernel crashes \u2014 with no crossing into a hypervisor, IOMMU, or other separate security scope.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands out blocks that are still in use by other inodes, so the attacker\u0027s file can be read back containing another user\u0027s on-disk data \u2014 an unbounded disclosure of arbitrary filesystem content.\nI:H - The same double-allocation lets the attacker\u0027s writes overwrite other users\u0027 file data and ext4 metadata, and the double `percpu_counter_sub` on s_freeclusters_counter corrupts global free-space accounting, giving arbitrary on-disk data modification.\nA:H - The path reaches the divide-by-zero in mb_update_avg_fragment_size() and multiple BUG_ON()s in mb_mark_used() on an inconsistent buddy, and ext4_mb_mark_diskspace_used()\u0027s \"overlap fs metadata\" ext4_error() forces the filesystem read-only (or panics with errors=panic), plus free-cluster underflow causes filesystem-wide ENOSPC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:09.780Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b92b1bc16d691c95b152c6dbf027ad64315668d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffeb72a80a82aba59a6774b0611f792e0ed3b0b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8de8305a25bfda607fc13475ebe84b978c96d7ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/d639102f4cbd4cb65d1225dba3b9265596aab586"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3bbe77a76bc52e9d4d0a120f1509be36e25c916"
        },
        {
          "url": "https://git.kernel.org/stable/c/21dbe20589c7f48e9c5d336ce6402bcebfa6d76a"
        },
        {
          "url": "https://git.kernel.org/stable/c/832698373a25950942c04a512daa652c18a9b513"
        }
      ],
      "title": "ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26772",
    "datePublished": "2024-04-03T17:00:58.733Z",
    "dateReserved": "2024-02-19T14:20:24.176Z",
    "dateUpdated": "2026-08-05T11:27:09.780Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26837 (GCVE-0-2024-26837)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:10 – Updated: 2026-05-11 20:05

Title

net: bridge: switchdev: Skip MDB replays of deferred events on offload

Summary

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping logic or from user configuration. While new memberships are immediately visible to walkers of br->mdb_list, the notification of their existence to switchdev event subscribers is deferred until a later point in time. So if a replay list was generated during a time that overlapped with such a window, it would also contain a replay of the not-yet-delivered event. The driver would thus receive two copies of what the bridge internally considered to be one single event. On destruction of the bridge, only a single membership deletion event was therefore sent. As a consequence of this, drivers which reference count memberships (at least DSA), would be left with orphan groups in their hardware database when the bridge was destroyed. This is only an issue when replaying additions. While deletion events may still be pending on the deferred queue, they will already have been removed from br->mdb_list, so no duplicates can be generated in that scenario. To a user this meant that old group memberships, from a bridge in which a port was previously attached, could be reanimated (in hardware) when the port joined a new bridge, without the new bridge's knowledge. For example, on an mv88e6xxx system, create a snooping bridge and immediately add a port to it: root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 && \ > ip link set dev x3 up master br0 And then destroy the bridge: root@infix-06-0b-00:~$ ip link del dev br0 root@infix-06-0b-00:~$ mvls atu ADDRESS FID STATE Q F 0 1 2 3 4 5 6 7 8 9 a DEV:0 Marvell 88E6393X 33:33:00:00:00:6a 1 static - - 0 . . . . . . . . . . 33:33:ff:87:e4:3f 1 static - - 0 . . . . . . . . . . ff:ff:ff:ff:ff:ff 1 static - - 0 1 2 3 4 5 6 7 8 9 a root@infix-06-0b-00:~$ The two IPv6 groups remain in the hardware database because the port (x3) is notified of the host's membership twice: once via the original event and once via a replay. Since only a single delete notification is sent, the count remains at 1 when the bridge is destroyed. Then add the same port (or another port belonging to the same hardware domain) to a new bridge, this time with snooping disabled: root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 && \ > ip link set dev x3 up master br1 All multicast, including the two IPv6 groups from br0, should now be flooded, according to the policy of br1. But instead the old memberships are still active in the hardware database, causing the switch to only forward traffic to those groups towards the CPU (port 0). Eliminate the race in two steps: 1. Grab the write-side lock of the MDB while generating the replay list. This prevents new memberships from showing up while we are generating the replay list. But it leaves the scenario in which a deferred event was already generated, but not delivered, before we grabbed the lock. Therefore: 2. Make sure that no deferred version of a replay event is already enqueued to the switchdev deferred queue, before adding it to the replay list, when replaying additions.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-28 19:58 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/2d5b4b3376fa146a2…
https://git.kernel.org/stable/c/603be95437e7fd85b…
https://git.kernel.org/stable/c/e0b4c5b1d760008f1…
https://git.kernel.org/stable/c/dc489f86257cab505…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4f2673b3a2b6246729a1ff13b8945a040839dbd3 , < 2d5b4b3376fa146a23917b8577064906d643925f (git) Affected: 4f2673b3a2b6246729a1ff13b8945a040839dbd3 , < 603be95437e7fd85ba694e75918067fb9e7754db (git) Affected: 4f2673b3a2b6246729a1ff13b8945a040839dbd3 , < e0b4c5b1d760008f1dd18c07c35af0442e54f9c8 (git) Affected: 4f2673b3a2b6246729a1ff13b8945a040839dbd3 , < dc489f86257cab5056e747344f17a164f63bff4b (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 6.1.80 , ≤ 6.1.* (semver) Unaffected: 6.6.19 , ≤ 6.6.* (semver) Unaffected: 6.7.7 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26837",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:58:57.584578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:06.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d5b4b3376fa146a23917b8577064906d643925f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/603be95437e7fd85ba694e75918067fb9e7754db"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e0b4c5b1d760008f1dd18c07c35af0442e54f9c8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc489f86257cab5056e747344f17a164f63bff4b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/switchdev.h",
            "net/bridge/br_switchdev.c",
            "net/switchdev/switchdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d5b4b3376fa146a23917b8577064906d643925f",
              "status": "affected",
              "version": "4f2673b3a2b6246729a1ff13b8945a040839dbd3",
              "versionType": "git"
            },
            {
              "lessThan": "603be95437e7fd85ba694e75918067fb9e7754db",
              "status": "affected",
              "version": "4f2673b3a2b6246729a1ff13b8945a040839dbd3",
              "versionType": "git"
            },
            {
              "lessThan": "e0b4c5b1d760008f1dd18c07c35af0442e54f9c8",
              "status": "affected",
              "version": "4f2673b3a2b6246729a1ff13b8945a040839dbd3",
              "versionType": "git"
            },
            {
              "lessThan": "dc489f86257cab5056e747344f17a164f63bff4b",
              "status": "affected",
              "version": "4f2673b3a2b6246729a1ff13b8945a040839dbd3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/switchdev.h",
            "net/bridge/br_switchdev.c",
            "net/switchdev/switchdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: switchdev: Skip MDB replays of deferred events on offload\n\nBefore this change, generation of the list of MDB events to replay\nwould race against the creation of new group memberships, either from\nthe IGMP/MLD snooping logic or from user configuration.\n\nWhile new memberships are immediately visible to walkers of\nbr-\u003emdb_list, the notification of their existence to switchdev event\nsubscribers is deferred until a later point in time. So if a replay\nlist was generated during a time that overlapped with such a window,\nit would also contain a replay of the not-yet-delivered event.\n\nThe driver would thus receive two copies of what the bridge internally\nconsidered to be one single event. On destruction of the bridge, only\na single membership deletion event was therefore sent. As a\nconsequence of this, drivers which reference count memberships (at\nleast DSA), would be left with orphan groups in their hardware\ndatabase when the bridge was destroyed.\n\nThis is only an issue when replaying additions. While deletion events\nmay still be pending on the deferred queue, they will already have\nbeen removed from br-\u003emdb_list, so no duplicates can be generated in\nthat scenario.\n\nTo a user this meant that old group memberships, from a bridge in\nwhich a port was previously attached, could be reanimated (in\nhardware) when the port joined a new bridge, without the new bridge\u0027s\nknowledge.\n\nFor example, on an mv88e6xxx system, create a snooping bridge and\nimmediately add a port to it:\n\n    root@infix-06-0b-00:~$ ip link add dev br0 up type bridge mcast_snooping 1 \u0026\u0026 \\\n    \u003e ip link set dev x3 up master br0\n\nAnd then destroy the bridge:\n\n    root@infix-06-0b-00:~$ ip link del dev br0\n    root@infix-06-0b-00:~$ mvls atu\n    ADDRESS             FID  STATE      Q  F  0  1  2  3  4  5  6  7  8  9  a\n    DEV:0 Marvell 88E6393X\n    33:33:00:00:00:6a     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .\n    33:33:ff:87:e4:3f     1  static     -  -  0  .  .  .  .  .  .  .  .  .  .\n    ff:ff:ff:ff:ff:ff     1  static     -  -  0  1  2  3  4  5  6  7  8  9  a\n    root@infix-06-0b-00:~$\n\nThe two IPv6 groups remain in the hardware database because the\nport (x3) is notified of the host\u0027s membership twice: once via the\noriginal event and once via a replay. Since only a single delete\nnotification is sent, the count remains at 1 when the bridge is\ndestroyed.\n\nThen add the same port (or another port belonging to the same hardware\ndomain) to a new bridge, this time with snooping disabled:\n\n    root@infix-06-0b-00:~$ ip link add dev br1 up type bridge mcast_snooping 0 \u0026\u0026 \\\n    \u003e ip link set dev x3 up master br1\n\nAll multicast, including the two IPv6 groups from br0, should now be\nflooded, according to the policy of br1. But instead the old\nmemberships are still active in the hardware database, causing the\nswitch to only forward traffic to those groups towards the CPU (port\n0).\n\nEliminate the race in two steps:\n\n1. Grab the write-side lock of the MDB while generating the replay\n   list.\n\nThis prevents new memberships from showing up while we are generating\nthe replay list. But it leaves the scenario in which a deferred event\nwas already generated, but not delivered, before we grabbed the\nlock. Therefore:\n\n2. Make sure that no deferred version of a replay event is already\n   enqueued to the switchdev deferred queue, before adding it to the\n   replay list, when replaying additions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:05:05.833Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d5b4b3376fa146a23917b8577064906d643925f"
        },
        {
          "url": "https://git.kernel.org/stable/c/603be95437e7fd85ba694e75918067fb9e7754db"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0b4c5b1d760008f1dd18c07c35af0442e54f9c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc489f86257cab5056e747344f17a164f63bff4b"
        }
      ],
      "title": "net: bridge: switchdev: Skip MDB replays of deferred events on offload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26837",
    "datePublished": "2024-04-17T10:10:04.164Z",
    "dateReserved": "2024-02-19T14:20:24.182Z",
    "dateUpdated": "2026-05-11T20:05:05.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26870 (GCVE-0-2024-26870)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-08-05 11:28

Title

NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102

Summary

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_label() consumes exactly all the bytes then size is 0 when calling nfs4_listxattr_nfs4_user() which then triggers the following kernel BUG: [ 99.403778] kernel BUG at mm/usercopy.c:102! [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1 [ 99.415827] Call trace: [ 99.415985] usercopy_abort+0x70/0xa0 [ 99.416227] __check_heap_object+0x134/0x158 [ 99.416505] check_heap_object+0x150/0x188 [ 99.416696] __check_object_size.part.0+0x78/0x168 [ 99.416886] __check_object_size+0x28/0x40 [ 99.417078] listxattr+0x8c/0x120 [ 99.417252] path_listxattr+0x78/0xe0 [ 99.417476] __arm64_sys_listxattr+0x28/0x40 [ 99.417723] invoke_syscall+0x78/0x100 [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0 [ 99.418186] do_el0_svc+0x24/0x38 [ 99.418376] el0_svc+0x3c/0x110 [ 99.418554] el0t_64_sync_handler+0x120/0x130 [ 99.418788] el0t_64_sync+0x194/0x198 [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000) Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl', thus calling lisxattr() with size = 16 will trigger the bug. Add check on nfs4_listxattr() to return ERANGE error when it is called with size > 0 and the return value is greater than size.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-28 19:56 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/4403438eaca6e91f0…
https://git.kernel.org/stable/c/9d52865ff28245fc2…
https://git.kernel.org/stable/c/06e828b3f1b206de0…
https://git.kernel.org/stable/c/79cdcc765969d23f4…
https://git.kernel.org/stable/c/80365c9f96015bbf0…
https://git.kernel.org/stable/c/23bfecb4d852751d5…
https://git.kernel.org/stable/c/251a658bbfceafb4d…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 012a211abd5db098094ce429de5f046368391e68 , < 4403438eaca6e91f02d272211c4d6b045092396b (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 9d52865ff28245fc2134da9f99baff603a24407a (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 06e828b3f1b206de08ef520fc46a40b22e1869cb (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 79cdcc765969d23f4e3d6ea115660c3333498768 (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 80365c9f96015bbf048fdd6c8705d3f8770132bf (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 23bfecb4d852751d5e403557dd500bb563313baf (git) Affected: 012a211abd5db098094ce429de5f046368391e68 , < 251a658bbfceafb4d58c76b77682c8bf7bcfad65 (git)
Linux	Linux	Affected: 5.9 Unaffected: 0 , < 5.9 (semver) Unaffected: 5.10.214 , ≤ 5.10.* (semver) Unaffected: 5.15.153 , ≤ 5.15.* (semver) Unaffected: 6.1.83 , ≤ 6.1.* (semver) Unaffected: 6.6.23 , ≤ 6.6.* (semver) Unaffected: 6.7.11 , ≤ 6.7.* (semver) Unaffected: 6.8.2 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:56:13.503124Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:37.605Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:04.235Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:49:46.342Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4403438eaca6e91f02d272211c4d6b045092396b",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "9d52865ff28245fc2134da9f99baff603a24407a",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "06e828b3f1b206de08ef520fc46a40b22e1869cb",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "79cdcc765969d23f4e3d6ea115660c3333498768",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "80365c9f96015bbf048fdd6c8705d3f8770132bf",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "23bfecb4d852751d5e403557dd500bb563313baf",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            },
            {
              "lessThan": "251a658bbfceafb4d58c76b77682c8bf7bcfad65",
              "status": "affected",
              "version": "012a211abd5db098094ce429de5f046368391e68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/nfs4proc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102\n\nA call to listxattr() with a buffer size = 0 returns the actual\nsize of the buffer needed for a subsequent call. When size \u003e 0,\nnfs4_listxattr() does not return an error because either\ngeneric_listxattr() or nfs4_listxattr_nfs4_label() consumes\nexactly all the bytes then size is 0 when calling\nnfs4_listxattr_nfs4_user() which then triggers the following\nkernel BUG:\n\n  [   99.403778] kernel BUG at mm/usercopy.c:102!\n  [   99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n  [   99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1\n  [   99.415827] Call trace:\n  [   99.415985]  usercopy_abort+0x70/0xa0\n  [   99.416227]  __check_heap_object+0x134/0x158\n  [   99.416505]  check_heap_object+0x150/0x188\n  [   99.416696]  __check_object_size.part.0+0x78/0x168\n  [   99.416886]  __check_object_size+0x28/0x40\n  [   99.417078]  listxattr+0x8c/0x120\n  [   99.417252]  path_listxattr+0x78/0xe0\n  [   99.417476]  __arm64_sys_listxattr+0x28/0x40\n  [   99.417723]  invoke_syscall+0x78/0x100\n  [   99.417929]  el0_svc_common.constprop.0+0x48/0xf0\n  [   99.418186]  do_el0_svc+0x24/0x38\n  [   99.418376]  el0_svc+0x3c/0x110\n  [   99.418554]  el0t_64_sync_handler+0x120/0x130\n  [   99.418788]  el0t_64_sync+0x194/0x198\n  [   99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000)\n\nIssue is reproduced when generic_listxattr() returns \u0027system.nfs4_acl\u0027,\nthus calling lisxattr() with size = 16 will trigger the bug.\n\nAdd check on nfs4_listxattr() to return ERANGE error when it is\ncalled with size \u003e 0 and the return value is greater than size."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by a local `listxattr(2)`/`llistxattr(2)`/`flistxattr(2)` syscall on a file residing on an NFSv4 mount; no network peer can initiate it on its own. Although the overflow content is supplied by the NFS server over the wire, a local syscall is required to reach the code, so the attack vector is Local.\nAC:L - Triggering is fully deterministic \u2014 the attacker probes with `size = 0`, then calls `listxattr()` with a size exactly equal to the generic handler list (16 bytes for `\"system.nfs4_acl\\0\"`), with no race to win and no memory-layout condition outside their control. The required config (CONFIG_NFS_V4_2, CONFIG_NFS_V4_SECURITY_LABEL, CONFIG_HARDENED_USERCOPY) is enabled by default on mainstream distributions, as demonstrated by the reporter reproducing on a stock Fedora 40 kernel.\nPR:L - Any unprivileged local user with ordinary access to a file on an existing NFSv4.2 mount can call `listxattr()` and set the `user.*` xattrs that become the overflow payload; no capabilities are needed. NFS-mounted home directories on shared/multi-user hosts make this a standard unprivileged-user reach.\nUI:N - The attacker performs every step \u2014 setting the xattrs and issuing the sized `listxattr()` call \u2014 with no action by any other user. The pre-existing NFS mount is an environmental property of the deployment, not an interaction the attacker must induce.\nS:U - The over-read, the leaked data, and the heap overflow all occur within the kernel\u0027s own memory and are delivered to the attacker\u0027s own process. No VM, IOMMU, or other security-authority boundary is crossed.\nC:H - When hardened usercopy is not enforcing, `copy_to_user()` transfers up to XATTR_LIST_MAX (64 KB) of kernel heap memory past a 16-byte kmalloc object directly into the attacker\u0027s buffer, with the over-read length controlled by how many `user.*` xattrs the attacker attaches to the file. This is a large, attacker-sized disclosure of adjacent slab contents including potential pointers and other tasks\u0027 data.\nI:H - The `size_t` underflow hands `nfs4_listxattr_nfs4_user()` a past-the-end pointer with an effectively unbounded length, and `decode_listxattrs()` then memcpy()s `user.\u003cattacker-chosen-name\u003e\\0` records past the end of a kmalloc-16 object in a loop until EOF. This is a heap buffer overflow with attacker-controlled content, length, and destination slab, which is a strong primitive for adjacent-object corruption and control-flow hijacking.\nA:H - The reported and reproducible outcome is `usercopy_abort()` calling `BUG()` at mm/usercopy.c:102 \u2014 a kernel oops that is a full panic on systems with `panic_on_oops` (common on embedded, automotive, and hardened deployments), repeatable at will by any local user. The heap overflow path additionally corrupts slab metadata and adjacent objects, causing further crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:01.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4403438eaca6e91f02d272211c4d6b045092396b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d52865ff28245fc2134da9f99baff603a24407a"
        },
        {
          "url": "https://git.kernel.org/stable/c/06e828b3f1b206de08ef520fc46a40b22e1869cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/79cdcc765969d23f4e3d6ea115660c3333498768"
        },
        {
          "url": "https://git.kernel.org/stable/c/80365c9f96015bbf048fdd6c8705d3f8770132bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/23bfecb4d852751d5e403557dd500bb563313baf"
        },
        {
          "url": "https://git.kernel.org/stable/c/251a658bbfceafb4d58c76b77682c8bf7bcfad65"
        }
      ],
      "title": "NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26870",
    "datePublished": "2024-04-17T10:27:30.756Z",
    "dateReserved": "2024-02-19T14:20:24.184Z",
    "dateUpdated": "2026-08-05T11:28:01.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26906 (GCVE-0-2024-26906)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-05-12 11:50

Title

x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 ...... Call Trace: <TASK> ? copy_from_kernel_nofault+0x6f/0x110 bpf_probe_read_kernel+0x1d/0x50 bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d trace_call_bpf+0xc5/0x1c0 perf_call_bpf_enter.isra.0+0x69/0xb0 perf_syscall_enter+0x13e/0x200 syscall_trace_enter+0x188/0x1c0 do_syscall_64+0xb5/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]--- The oops is triggered when: 1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall page and invokes copy_from_kernel_nofault() which in turn calls __get_user_asm(). 2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly. 3) handle_page_fault() considers the vsyscall page address as a user space address instead of a kernel space address. This results in the fix-up setup by bpf not being applied and a page_fault_oops() is invoked due to SMAP. Considering handle_page_fault() has already considered the vsyscall page address as a userspace address, fix the problem by disallowing vsyscall page read for copy_from_kernel_nofault().

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:47 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/6e4694e65b6db4c3d…
https://git.kernel.org/stable/c/e8a67fe34b76a4932…
https://git.kernel.org/stable/c/f175de546a3eb7761…
https://git.kernel.org/stable/c/57f78c46f08198e1b…
https://git.kernel.org/stable/c/29bd6f86904682ada…
https://git.kernel.org/stable/c/32019c659ecfe1d92…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < 6e4694e65b6db4c3de125115dd4f55848cc48381 (git) Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < e8a67fe34b76a49320b33032228a794f40b0316b (git) Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < f175de546a3eb77614d94d4c02550181c0a8493e (git) Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < 57f78c46f08198e1be08ffe99c4c1ccc12855bf5 (git) Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < 29bd6f86904682adafe9affbc7f79b14defcaff8 (git) Affected: 75a1a607bb7e6d918be3aca11ec2214a275392f4 , < 32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.214 , ≤ 5.10.* (semver) Unaffected: 5.15.153 , ≤ 5.15.* (semver) Unaffected: 6.1.83 , ≤ 6.1.* (semver) Unaffected: 6.6.23 , ≤ 6.6.* (semver) Unaffected: 6.7.11 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26906",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:47:59.842385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:22.186Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:50:31.220Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/maccess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e4694e65b6db4c3de125115dd4f55848cc48381",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            },
            {
              "lessThan": "e8a67fe34b76a49320b33032228a794f40b0316b",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            },
            {
              "lessThan": "f175de546a3eb77614d94d4c02550181c0a8493e",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            },
            {
              "lessThan": "57f78c46f08198e1be08ffe99c4c1ccc12855bf5",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            },
            {
              "lessThan": "29bd6f86904682adafe9affbc7f79b14defcaff8",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            },
            {
              "lessThan": "32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58",
              "status": "affected",
              "version": "75a1a607bb7e6d918be3aca11ec2214a275392f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/maccess.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.214",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.214",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.153",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.83",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()\n\nWhen trying to use copy_from_kernel_nofault() to read vsyscall page\nthrough a bpf program, the following oops was reported:\n\n  BUG: unable to handle page fault for address: ffffffffff600000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0\n  Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......\n  RIP: 0010:copy_from_kernel_nofault+0x6f/0x110\n  ......\n  Call Trace:\n   \u003cTASK\u003e\n   ? copy_from_kernel_nofault+0x6f/0x110\n   bpf_probe_read_kernel+0x1d/0x50\n   bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d\n   trace_call_bpf+0xc5/0x1c0\n   perf_call_bpf_enter.isra.0+0x69/0xb0\n   perf_syscall_enter+0x13e/0x200\n   syscall_trace_enter+0x188/0x1c0\n   do_syscall_64+0xb5/0xe0\n   entry_SYSCALL_64_after_hwframe+0x6e/0x76\n   \u003c/TASK\u003e\n  ......\n  ---[ end trace 0000000000000000 ]---\n\nThe oops is triggered when:\n\n1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall\npage and invokes copy_from_kernel_nofault() which in turn calls\n__get_user_asm().\n\n2) Because the vsyscall page address is not readable from kernel space,\na page fault exception is triggered accordingly.\n\n3) handle_page_fault() considers the vsyscall page address as a user\nspace address instead of a kernel space address. This results in the\nfix-up setup by bpf not being applied and a page_fault_oops() is invoked\ndue to SMAP.\n\nConsidering handle_page_fault() has already considered the vsyscall page\naddress as a userspace address, fix the problem by disallowing vsyscall\npage read for copy_from_kernel_nofault()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:06:40.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e4694e65b6db4c3de125115dd4f55848cc48381"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8a67fe34b76a49320b33032228a794f40b0316b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f175de546a3eb77614d94d4c02550181c0a8493e"
        },
        {
          "url": "https://git.kernel.org/stable/c/57f78c46f08198e1be08ffe99c4c1ccc12855bf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/29bd6f86904682adafe9affbc7f79b14defcaff8"
        },
        {
          "url": "https://git.kernel.org/stable/c/32019c659ecfe1d92e3bf9fcdfbb11a7c70acd58"
        }
      ],
      "title": "x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26906",
    "datePublished": "2024-04-17T10:27:53.573Z",
    "dateReserved": "2024-02-19T14:20:24.187Z",
    "dateUpdated": "2026-05-12T11:50:31.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26984 (GCVE-0-2024-26984)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:27 – Updated: 2026-05-11 20:08

Title

nouveau: fix instmem race condition around ptr stores

Summary

In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau] Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm. Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap. If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read. v2: use paired smp_rmb/smp_wmb.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-05 20:59 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux mitre root

References

13 references

URL	Tags
https://git.kernel.org/stable/c/bba8ec5e9b16649d8…
https://git.kernel.org/stable/c/1bc4825d4c3ec6abe…
https://git.kernel.org/stable/c/13d76b2f443dc3718…
https://git.kernel.org/stable/c/3ab056814cd8ab847…
https://git.kernel.org/stable/c/ad74d208f213c06d8…
https://git.kernel.org/stable/c/a019b44b1bc6ed224…
https://git.kernel.org/stable/c/21ca9539f09360fd8…
https://git.kernel.org/stable/c/fff1386cc889d8fb4…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

20 products

Vendor	Product	Version
Linux	Linux	Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < 1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < 13d76b2f443dc371842916dd8768009ff1594716 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < 3ab056814cd8ab84744c9a19ef51360b2271c572 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < ad74d208f213c06d860916ad40f609ade8c13039 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < a019b44b1bc6ed224c46fb5f88a8a10dd116e525 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < 21ca9539f09360fd83654f78f2c361f2f5ddcb52 (git) Affected: be55287aa5ba6895e9d4d3ed2f08a1be7a065957 , < fff1386cc889d8fb4089d285f883f8cba62d82ce (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 4.19.313 , ≤ 4.19.* (semver) Unaffected: 5.4.275 , ≤ 5.4.* (semver) Unaffected: 5.10.216 , ≤ 5.10.* (semver) Unaffected: 5.15.157 , ≤ 5.15.* (semver) Unaffected: 6.1.88 , ≤ 6.1.* (semver) Unaffected: 6.6.29 , ≤ 6.6.* (semver) Unaffected: 6.8.8 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: be55287aa5ba , < bba8ec5e9b16 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < 1bc4825d4c3e (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < 13d76b2f443d (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < 3ab056814cd8 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < ad74d208f213 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < a019b44b1bc6 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < 21ca9539f093 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: be55287aa5ba , < fff1386cc889 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 4.19.313 , < 4.20 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.4.275 , < 5.5 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 5.15.157 , < 5.16 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.1.88 , < 6.2 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.6.29 , < 6.7 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.8.8 , < 6.9 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.9 cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 0 , < 4.15 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 4.15 cpe:2.3:o:linux:linux_kernel:4.15:::::::*
linux	linux_kernel	Unaffected: 5.10.216 , < 5.11 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "bba8ec5e9b16",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "1bc4825d4c3e",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "13d76b2f443d",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3ab056814cd8",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "ad74d208f213",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "a019b44b1bc6",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "21ca9539f093",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "fff1386cc889",
                "status": "affected",
                "version": "be55287aa5ba",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "4.20",
                "status": "unaffected",
                "version": "4.19.313",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.5",
                "status": "unaffected",
                "version": "5.4.275",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.16",
                "status": "unaffected",
                "version": "5.15.157",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.2",
                "status": "unaffected",
                "version": "6.1.88",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.7",
                "status": "unaffected",
                "version": "6.6.29",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.9",
                "status": "unaffected",
                "version": "6.8.8",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "4.15",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.15:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.15"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.11",
                "status": "unaffected",
                "version": "5.10.216",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-05T20:59:23.585345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-05T20:59:40.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:15:10.866Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13d76b2f443dc371842916dd8768009ff1594716"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "13d76b2f443dc371842916dd8768009ff1594716",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "3ab056814cd8ab84744c9a19ef51360b2271c572",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "ad74d208f213c06d860916ad40f609ade8c13039",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "a019b44b1bc6ed224c46fb5f88a8a10dd116e525",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "21ca9539f09360fd83654f78f2c361f2f5ddcb52",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            },
            {
              "lessThan": "fff1386cc889d8fb4089d285f883f8cba62d82ce",
              "status": "affected",
              "version": "be55287aa5ba6895e9d4d3ed2f08a1be7a065957",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.313",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.157",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.88",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.29",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.8",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau: fix instmem race condition around ptr stores\n\nRunning a lot of VK CTS in parallel against nouveau, once every\nfew hours you might see something like this crash.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000008\nPGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0\nOops: 0000 [#1] PREEMPT SMP PTI\nCPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27\nHardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021\nRIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]\nCode: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee \u003c48\u003e 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1\nRSP: 0000:ffffac20c5857838 EFLAGS: 00010202\nRAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001\nRDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180\nRBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10\nR10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c\nR13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c\nFS:  00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\n...\n\n ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau]\n ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau]\n nvkm_vmm_iter+0x351/0xa20 [nouveau]\n ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n ? __lock_acquire+0x3ed/0x2170\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau]\n ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau]\n ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau]\n nvkm_vmm_map_locked+0x224/0x3a0 [nouveau]\n\nAdding any sort of useful debug usually makes it go away, so I hand\nwrote the function in a line, and debugged the asm.\n\nEvery so often pt-\u003ememory-\u003eptrs is NULL. This ptrs ptr is set in\nthe nv50_instobj_acquire called from nvkm_kmap.\n\nIf Thread A and Thread B both get to nv50_instobj_acquire around\nthe same time, and Thread A hits the refcount_set line, and in\nlockstep thread B succeeds at refcount_inc_not_zero, there is a\nchance the ptrs value won\u0027t have been stored since refcount_set\nis unordered. Force a memory barrier here, I picked smp_mb, since\nwe want it on all CPUs and it\u0027s write followed by a read.\n\nv2: use paired smp_rmb/smp_wmb."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:08:09.697Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bc4825d4c3ec6abe43cf06c3c39d664d044cbf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/13d76b2f443dc371842916dd8768009ff1594716"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ab056814cd8ab84744c9a19ef51360b2271c572"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad74d208f213c06d860916ad40f609ade8c13039"
        },
        {
          "url": "https://git.kernel.org/stable/c/a019b44b1bc6ed224c46fb5f88a8a10dd116e525"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ca9539f09360fd83654f78f2c361f2f5ddcb52"
        },
        {
          "url": "https://git.kernel.org/stable/c/fff1386cc889d8fb4089d285f883f8cba62d82ce"
        }
      ],
      "title": "nouveau: fix instmem race condition around ptr stores",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26984",
    "datePublished": "2024-05-01T05:27:20.506Z",
    "dateReserved": "2024-02-19T14:20:24.204Z",
    "dateUpdated": "2026-05-11T20:08:09.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-31076 (GCVE-0-2024-31076)

Vulnerability from cvelistv5 – Published: 2024-06-21 10:18 – Updated: 2026-05-11 20:10

Title

genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:09 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/a40209d355afe4ed6…
https://git.kernel.org/stable/c/f5f4675960609d8c5…
https://git.kernel.org/stable/c/6752dfcfff3ac3e16…
https://git.kernel.org/stable/c/9eeda3e0071a329af…
https://git.kernel.org/stable/c/e9c96d01d520498b1…
https://git.kernel.org/stable/c/59f86a2908380d09c…
https://git.kernel.org/stable/c/ebfb16fc057a016ab…
https://git.kernel.org/stable/c/a6c11c0a5235fb144…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < a40209d355afe4ed6d533507838c9e5cd70a76d8 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < f5f4675960609d8c5ee95f027fbf6ce380f98372 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < 6752dfcfff3ac3e16625ebd3f0ad9630900e7e76 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < 9eeda3e0071a329af1eba15f4e57dc39576bb420 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < e9c96d01d520498b169ce734a8ad1142bef86a30 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < 59f86a2908380d09cdc726461c0fbb8d8579c99f (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < ebfb16fc057a016abb46a9720a54abf0d4f6abe1 (git) Affected: f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b , < a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32 (git)
Linux	Linux	Affected: 4.13 Unaffected: 0 , < 4.13 (semver) Unaffected: 4.19.316 , ≤ 4.19.* (semver) Unaffected: 5.4.278 , ≤ 5.4.* (semver) Unaffected: 5.10.219 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.9.4 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:00.420Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a40209d355afe4ed6d533507838c9e5cd70a76d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f5f4675960609d8c5ee95f027fbf6ce380f98372"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6752dfcfff3ac3e16625ebd3f0ad9630900e7e76"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9eeda3e0071a329af1eba15f4e57dc39576bb420"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e9c96d01d520498b169ce734a8ad1142bef86a30"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/59f86a2908380d09cdc726461c0fbb8d8579c99f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ebfb16fc057a016abb46a9720a54abf0d4f6abe1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31076",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:09:53.896904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:46.615Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/apic/vector.c",
            "kernel/irq/cpuhotplug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a40209d355afe4ed6d533507838c9e5cd70a76d8",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "f5f4675960609d8c5ee95f027fbf6ce380f98372",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "6752dfcfff3ac3e16625ebd3f0ad9630900e7e76",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "9eeda3e0071a329af1eba15f4e57dc39576bb420",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "e9c96d01d520498b169ce734a8ad1142bef86a30",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "59f86a2908380d09cdc726461c0fbb8d8579c99f",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "ebfb16fc057a016abb46a9720a54abf0d4f6abe1",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            },
            {
              "lessThan": "a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32",
              "status": "affected",
              "version": "f0383c24b4855f6a4b5a358c7b2d2c16e0437e9b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/apic/vector.c",
            "kernel/irq/cpuhotplug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline\n\nThe absence of IRQD_MOVE_PCNTXT prevents immediate effectiveness of\ninterrupt affinity reconfiguration via procfs. Instead, the change is\ndeferred until the next instance of the interrupt being triggered on the\noriginal CPU.\n\nWhen the interrupt next triggers on the original CPU, the new affinity is\nenforced within __irq_move_irq(). A vector is allocated from the new CPU,\nbut the old vector on the original CPU remains and is not immediately\nreclaimed. Instead, apicd-\u003emove_in_progress is flagged, and the reclaiming\nprocess is delayed until the next trigger of the interrupt on the new CPU.\n\nUpon the subsequent triggering of the interrupt on the new CPU,\nirq_complete_move() adds a task to the old CPU\u0027s vector_cleanup list if it\nremains online. Subsequently, the timer on the old CPU iterates over its\nvector_cleanup list, reclaiming old vectors.\n\nHowever, a rare scenario arises if the old CPU is outgoing before the\ninterrupt triggers again on the new CPU.\n\nIn that case irq_force_complete_move() is not invoked on the outgoing CPU\nto reclaim the old apicd-\u003eprev_vector because the interrupt isn\u0027t currently\naffine to the outgoing CPU, and irq_needs_fixup() returns false. Even\nthough __vector_schedule_cleanup() is later called on the new CPU, it\ndoesn\u0027t reclaim apicd-\u003eprev_vector; instead, it simply resets both\napicd-\u003emove_in_progress and apicd-\u003eprev_vector to 0.\n\nAs a result, the vector remains unreclaimed in vector_matrix, leading to a\nCPU vector leak.\n\nTo address this issue, move the invocation of irq_force_complete_move()\nbefore the irq_needs_fixup() call to reclaim apicd-\u003eprev_vector, if the\ninterrupt is currently or used to be affine to the outgoing CPU.\n\nAdditionally, reclaim the vector in __vector_schedule_cleanup() as well,\nfollowing a warning message, although theoretically it should never see\napicd-\u003emove_in_progress with apicd-\u003eprev_cpu pointing to an offline CPU."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:10:48.791Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a40209d355afe4ed6d533507838c9e5cd70a76d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5f4675960609d8c5ee95f027fbf6ce380f98372"
        },
        {
          "url": "https://git.kernel.org/stable/c/6752dfcfff3ac3e16625ebd3f0ad9630900e7e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eeda3e0071a329af1eba15f4e57dc39576bb420"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9c96d01d520498b169ce734a8ad1142bef86a30"
        },
        {
          "url": "https://git.kernel.org/stable/c/59f86a2908380d09cdc726461c0fbb8d8579c99f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebfb16fc057a016abb46a9720a54abf0d4f6abe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32"
        }
      ],
      "title": "genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-31076",
    "datePublished": "2024-06-21T10:18:04.335Z",
    "dateReserved": "2024-06-21T10:13:16.276Z",
    "dateUpdated": "2026-05-11T20:10:48.791Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35814 (GCVE-0-2024-35814)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30

Title

swiotlb: Fix double-allocation of slots due to broken alignment handling

Summary

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-05 20:30 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-1055 - Multiple Inheritance from Concrete Classes

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3e7acd6e25ba77dde…
https://git.kernel.org/stable/c/c88668aa6c1da240e…
https://git.kernel.org/stable/c/777391743771040e1…
https://git.kernel.org/stable/c/04867a7a33324c9c5…

Impacted products

12 products

Vendor	Product	Version
Linux	Linux	Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 3e7acd6e25ba77dde48c3b721c54c89cd6a10534 (git) Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < c88668aa6c1da240ea3eb4d128b7906e740d3cb8 (git) Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 777391743771040e12cc40d3d0d178f70c616491 (git) Affected: 0eee5ae1025699ea93d44fdb6ef2365505082103 , < 04867a7a33324c9c562ee7949dbcaab7aaad1fb4 (git)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 0eee5ae10256 , < 3e7acd6e25ba (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 0eee5ae10256 , < c88668aa6c1d (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 0eee5ae10256 , < 777391743771 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 0eee5ae10256 , < 04867a7a3332 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 6.3 cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 0 , < 6.3 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.6.24 , < 6.6.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.7.12 , ≤ 6.7.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.8.3 , ≤ 6.8.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.9 cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "3e7acd6e25ba",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "c88668aa6c1d",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "777391743771",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "04867a7a3332",
                "status": "affected",
                "version": "0eee5ae10256",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.3"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.3",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.6.*",
                "status": "unaffected",
                "version": "6.6.24",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.7.*",
                "status": "unaffected",
                "version": "6.7.12",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.8.*",
                "status": "unaffected",
                "version": "6.8.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.9"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35814",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T20:30:30.911861Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-1055",
                "description": "CWE-1055 Multiple Inheritance from Concrete Classes",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T20:30:38.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.615Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3e7acd6e25ba77dde48c3b721c54c89cd6a10534",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "c88668aa6c1da240ea3eb4d128b7906e740d3cb8",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "777391743771040e12cc40d3d0d178f70c616491",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            },
            {
              "lessThan": "04867a7a33324c9c562ee7949dbcaab7aaad1fb4",
              "status": "affected",
              "version": "0eee5ae1025699ea93d44fdb6ef2365505082103",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/dma/swiotlb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nswiotlb: Fix double-allocation of slots due to broken alignment handling\n\nCommit bbb73a103fbb (\"swiotlb: fix a braino in the alignment check fix\"),\nwhich was a fix for commit 0eee5ae10256 (\"swiotlb: fix slot alignment\nchecks\"), causes a functional regression with vsock in a virtual machine\nusing bouncing via a restricted DMA SWIOTLB pool.\n\nWhen virtio allocates the virtqueues for the vsock device using\ndma_alloc_coherent(), the SWIOTLB search can return page-unaligned\nallocations if \u0027area-\u003eindex\u0027 was left unaligned by a previous allocation\nfrom the buffer:\n\n # Final address in brackets is the SWIOTLB address returned to the caller\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800)\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800)\n | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800)\n\nThis ends badly (typically buffer corruption and/or a hang) because\nswiotlb_alloc() is expecting a page-aligned allocation and so blindly\nreturns a pointer to the \u0027struct page\u0027 corresponding to the allocation,\ntherefore double-allocating the first half (2KiB slot) of the 4KiB page.\n\nFix the problem by treating the allocation alignment separately to any\nadditional alignment requirements from the device, using the maximum\nof the two as the stride to search the buffer slots and taking care\nto ensure a minimum of page-alignment for buffers larger than a page.\n\nThis also resolves swiotlb allocation failures occuring due to the\ninclusion of ~PAGE_MASK in \u0027iotlb_align_mask\u0027 for large allocations and\nresulting in alignment requirements exceeding swiotlb_max_mapping_size()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in the core DMA bounce-buffer allocator (`kernel/dma/swiotlb.c`) and is driven by local DMA activity \u2014 `dma_alloc_coherent()`/`dma_map_page()` issued on behalf of a local process doing device or block/network I/O. There is no network-facing protocol handler parsing remote data on the path to `swiotlb_search_pool_area()`.\nAC:L - Triggering is deterministic and race-free: the attacker only needs `area-\u003eindex` left at an odd slot by any prior odd-sized bounce (routine for ordinary I/O) so the stride-2 search returns page-unaligned slots, and for the mapping path merely a buffer whose page offset is \u003e= 2048. Both the restricted-DMA-pool `swiotlb_alloc()` path and the generic `iommu_dma_map_page()`/untrusted-device and arm64 kmalloc-bounce paths are affected, so this is not confined to a rare config.\nPR:L - No capability, admin right, or `CAP_SYS_*` check exists anywhere between userspace and `swiotlb_find_slots()`; any unprivileged process can consume and release swiotlb slots and force coherent DMA allocations through normal file, socket, and device-node I/O. Local access is required, so basic user privileges rather than none.\nUI:N - The attacking process performs the entire allocate/free/map sequence itself. No victim action such as mounting a filesystem, opening a file, or plugging in hardware is required.\nS:U - The corrupted and over-exposed memory is host kernel memory \u2014 swiotlb slots and DMA-coherent buffers \u2014 managed by the same kernel security authority as the vulnerable allocator. Even the granule-misaligned IOMMU mapping stays inside the swiotlb region, so no VM, hypervisor, or sandbox boundary is crossed.\nC:H - `swiotlb_alloc()` returns `pfn_to_page(PFN_DOWN(tlb_addr))` for an unaligned slot, so a caller receives a page whose first 2 KiB is another live allocation\u0027s DMA data, and the mis-rounded `swiotlb_free()` recycles in-use slots so in-flight device DMA lands in memory handed to a different owner. On the `iommu_dma_map_page()` path `__iommu_dma_map()` maps `phys - iova_off`, granting a device \u2014 including an untrusted external PCIe/Thunderbolt device \u2014 DMA read visibility into an adjacent bounce buffer holding unrelated in-flight I/O.\nI:H - Two independent `dma_alloc_coherent()` consumers end up writing the same physical page, so device DMA and driver writes clobber the other allocation\u0027s contents \u2014 including virtio virtqueue descriptor tables holding physical addresses and lengths, which is a controllable kernel memory corruption primitive. The same misaligned IOMMU window is mapped writable for `DMA_FROM_DEVICE`/`DMA_BIDIRECTIONAL`, letting a device write outside its intended buffer.\nA:H - The commit message states the double-allocation \"ends badly (typically buffer corruption and/or a hang)\", and corrupted virtqueue rings or DMA descriptors readily produce oops/panic. Additionally, the bogus `~PAGE_MASK` alignment requirement exceeds `swiotlb_max_mapping_size()` and causes persistent \"swiotlb buffer is full\" mapping failures, breaking device I/O."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:08.016Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3e7acd6e25ba77dde48c3b721c54c89cd6a10534"
        },
        {
          "url": "https://git.kernel.org/stable/c/c88668aa6c1da240ea3eb4d128b7906e740d3cb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/777391743771040e12cc40d3d0d178f70c616491"
        },
        {
          "url": "https://git.kernel.org/stable/c/04867a7a33324c9c562ee7949dbcaab7aaad1fb4"
        }
      ],
      "title": "swiotlb: Fix double-allocation of slots due to broken alignment handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35814",
    "datePublished": "2024-05-17T13:23:19.590Z",
    "dateReserved": "2024-05-17T12:19:12.343Z",
    "dateUpdated": "2026-08-05T11:30:08.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:9546

BDU:2026-03638

CVE-2023-52749 (GCVE-0-2023-52749)

CVE-2024-26656 (GCVE-0-2024-26656)

CVE-2024-26772 (GCVE-0-2024-26772)

CVE-2024-26837 (GCVE-0-2024-26837)

CVE-2024-26870 (GCVE-0-2024-26870)

CVE-2024-26906 (GCVE-0-2024-26906)

CVE-2024-26984 (GCVE-0-2024-26984)

CVE-2024-31076 (GCVE-0-2024-31076)

CVE-2024-35814 (GCVE-0-2024-35814)

Tags

Sightings

Nomenclature

Related by attack behaviour