Vulnerability-Lookup

RHSA-2025:10701

Vulnerability from csaf_redhat - Published: 2025-07-09 12:22 - Updated: 2026-09-13 08:28

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors (CVE-2023-52477) * kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() (CVE-2023-52565) * kernel: wifi: rt2x00: restart beacon queue when hardware reset (CVE-2023-52595) * kernel: HID: i2c-hid-of: fix NULL-deref on failed power up (CVE-2024-26717) * kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (CVE-2024-35790) * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807) * kernel: usb: typec: ucsi: Limit read size on v1.2 (CVE-2024-35924) * kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (CVE-2024-36006) * kernel: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (CVE-2023-52781) * kernel: atl1c: Work around the DMA RX overflow issue (CVE-2023-52834) * kernel: pinctrl: core: delete incorrect free in pinctrl_enable() (CVE-2024-36940) * kernel: drm/amdgpu: add error handle to avoid out-of-bounds (CVE-2024-39471) * kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers (CVE-2024-41092) * kernel: usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CVE-2024-41097) * kernel: mlxsw: spectrum_acl_erp: Fix object nesting warning (CVE-2024-43880) * kernel: ELF: fix kernel.randomize_va_space double read (CVE-2024-46826) * kernel: xsk: fix OOB map writes when deleting elements (CVE-2024-56614) * kernel: md: fix mddev uaf while iterating all_mddevs list (CVE-2025-22126) * kernel: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CVE-2022-49846) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-49846

In the Linux kernel, the following vulnerability has been resolved: udf: Fix a slab-out-of-bounds write bug in udf_find_entry() Syzbot reported a slab-out-of-bounds Write bug: loop0: detected capacity change from 0 to 2048 ================================================================== BUG: KASAN: slab-out-of-bounds in udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 Write of size 105 at addr ffff8880123ff896 by task syz-executor323/3610 CPU: 0 PID: 3610 Comm: syz-executor323 Not tainted 6.1.0-rc2-syzkaller-00105-gb229b6ca5abb #0 Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 kasan_check_range+0x2a7/0x2e0 mm/kasan/generic.c:189 memcpy+0x3c/0x60 mm/kasan/shadow.c:66 udf_find_entry+0x8a5/0x14f0 fs/udf/namei.c:253 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ffab0d164d9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe1a7e6bb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffab0d164d9 RDX: 00007ffab0d164d9 RSI: 0000000000000000 RDI: 0000000020000180 RBP: 00007ffab0cd5a10 R08: 0000000000000000 R09: 0000000000000000 R10: 00005555573552c0 R11: 0000000000000246 R12: 00007ffab0cd5aa0 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 3610: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:576 [inline] udf_find_entry+0x7b6/0x14f0 fs/udf/namei.c:243 udf_lookup+0xef/0x340 fs/udf/namei.c:309 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_creat fs/open.c:1402 [inline] __se_sys_creat fs/open.c:1396 [inline] __x64_sys_creat+0x11f/0x160 fs/open.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff8880123ff800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 150 bytes inside of 256-byte region [ffff8880123ff800, ffff8880123ff900) The buggy address belongs to the physical page: page:ffffea000048ff80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x123fe head:ffffea000048ff80 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea00004b8500 dead000000000003 ffff888012041b40 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 1841222404, free_ts 0 create_dummy_stack mm/page_owner.c: ---truncated---

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-devel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-devel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-64k-devel-matched-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debug-devel-matched-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-devel-matched-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-doc-0:5.14.0-427.76.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-devel-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rtla-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.EUS:rv-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.76.1.el9_4.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-64k-modules-extra-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-abi-stablelists-0:5.14.0-427.76.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debug-uki-virt-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-tools-libs-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-uki-virt-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-64k-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-tools-libs-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-kvm-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-kvm-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:bpftool-debuginfo-0:7.3.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-devel-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-core-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-rt-modules-extra-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:kernel-tools-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:libperf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.EUS:python3-perf-debuginfo-0:5.14.0-427.76.1.el9_4.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2023-52477

In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev->bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev->bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1> Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9 RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310 RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840 RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0 Call Trace: hub_event+0x73f/0x156e ? hub_activate+0x5b7/0x68f process_one_work+0x1a2/0x487 worker_thread+0x11a/0x288 kthread+0x13a/0x152 ? process_one_work+0x487/0x487 ? kthread_associate_blkcg+0x70/0x70 ret_from_fork+0x1f/0x30 Fall back to a default behavior if the BOS descriptor isn't accessible and skip all the functionalities that depend on it: LPM support checks, Super Speed capabilitiy checks, U1/U2 states setup.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2023-52565

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix OOB read If the index provided by the user is bigger than the mask size, we might do an out of bound read.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2023-52595

A flaw was found in the Linux kernel. When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in the hardware interface. However, mac80211 will not automatically stop the queue. If the beacon queue is not manually stopped, it will be deadlocked and unable to restart.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2023-52781

In the Linux kernel, the following vulnerability has been resolved: usb: config: fix iteration issue in 'usb_get_bos_descriptor()' The BOS descriptor defines a root descriptor and is the base descriptor for accessing a family of related descriptors. Function 'usb_get_bos_descriptor()' encounters an iteration issue when skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in the same descriptor being read repeatedly. To address this issue, a 'goto' statement is introduced to ensure that the pointer and the amount read is updated correctly. This ensures that the function iterates to the next descriptor instead of reading the same descriptor repeatedly.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2023-52834

In the Linux kernel, the following vulnerability has been resolved: atl1c: Work around the DMA RX overflow issue This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue"). The alx and atl1c drivers had RX overflow error which was why a custom allocator was created to avoid certain addresses. The simpler workaround then created for alx driver, but not for atl1c due to lack of tester. Instead of using a custom allocator, check the allocated skb address and use skb_reserve() to move away from problematic 0x...fc0 address. Tested on AR8131 on Acer 4540.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-26717

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-35790

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns NULL in those cases. Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-35807

A vulnerability was found in the ext4 filesystem in the Linux kernel during on-line resizing operations. When an ext4 filesystem is resized while mounted, it could lead to data corruption.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-35924

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 The Linux kernel CVE team has assigned CVE-2024-35924 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051914-CVE-2024-35924-90f6@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-36006

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage The Linux kernel CVE team has assigned CVE-2024-36006 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052025-CVE-2024-36006-c032@gregkh/T

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-36940

In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

2.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

CWE-415 - Double Free

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Low

CVE-2024-39471

A flaw was found in the Linux kernel's `drm/amdgpu` component. This vulnerability, caused by an out-of-bounds read in the `sdma_v4_0_irq_id_to_seq` function, could allow a local attacker to read sensitive information from kernel memory. This could lead to information disclosure or a denial of service (DoS) due to a system crash.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-41092

A use-after-free was found in drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c in the Linux kernel. This issue can be caused by a race among revocation of fence registers on one side and sequential execution of signal callbacks invoked on completion of a request that was using them on the other, processed in parallel to revocation of those fence registers.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-41097

In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpoints types may be used at urb sumbitting stage which in turn triggers a warning in usb_submit_urb(). Fix the issue by verifying that required endpoint types are present for both in and out endpoints, taking into account cmd endpoint type. Unfortunately, this patch has not been tested on real hardware. [1] Syzbot report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 ... Call Trace: cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649 cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760 cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209 usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055 cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363 usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x23c/0xcd0 drivers/base/dd.c:595 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:965 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc2f/0x2180 drivers/base/core.c:3354 usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170 usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238 usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-43880

A flaw incorrect memory access in the Linux kernel Mellanox network (Ethernet or RDMA) device driver was found. A local user could use this flaw to crash the system.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-284 - Improper Access Control

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-46826

In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with unpredictable consequences. Issue exactly one load for consistent value across one exec.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2024-56614

In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). Due to implicit type conversion, a large unsigned value for map->max_entries can bypass the intended bounds check: if (k >= map->max_entries) return -EINVAL; This allows k to hold a negative value (between -2147483648 and -2), which is then used as an array index in m->xsk_map[k], which results in an out-of-bounds access. spin_lock_bh(&m->lock); map_entry = &m->xsk_map[k]; // Out-of-bounds map_entry old_xs = unrcu_pointer(xchg(map_entry, NULL)); // Oob write if (old_xs) xsk_map_sock_delete(old_xs, map_entry); spin_unlock_bh(&m->lock); The xchg operation can then be used to cause an out-of-bounds write. Moreover, the invalid map_entry passed to xsk_map_sock_delete can lead to further memory corruption. " It indeed results in following splat: [76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108 [76612.904330] #PF: supervisor write access in kernel mode [76612.909639] #PF: error_code(0x0002) - not-present page [76612.914855] PGD 0 P4D 0 [76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP [76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470 [76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60 [76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff <48> 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31 [76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246 [76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000 [76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000 [76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007 [76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8 [76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0 [76613.005303] FS: 00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000 [76613.013517] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0 [76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [76613.041086] PKRU: 55555554 [76613.043842] Call Trace: [76613.046331] <TASK> [76613.048468] ? __die+0x20/0x60 [76613.051581] ? page_fault_oops+0x15a/0x450 [76613.055747] ? search_extable+0x22/0x30 [76613.059649] ? search_bpf_extables+0x5f/0x80 [76613.063988] ? exc_page_fault+0xa9/0x140 [76613.067975] ? asm_exc_page_fault+0x22/0x30 [76613.072229] ? xsk_map_delete_elem+0x2d/0x60 [76613.076573] ? xsk_map_delete_elem+0x23/0x60 [76613.080914] __sys_bpf+0x19b7/0x23c0 [76613.084555] __x64_sys_bpf+0x1a/0x20 [76613.088194] do_syscall_64+0x37/0xb0 [76613.091832] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [76613.096962] RIP: 0033:0x7f80b6d1e88d [76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141 [76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d [76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003 [76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000 [76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8 [76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00 ---truncated---

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

CVE-2025-22126

A flaw was discovered in the Linux kernel’s MD (multiple device) subsystem during iteration over the all_mddevs list in functions such as md_notify_reboot() and md_exit(). The code used list_for_each_entry_safe, but released locks before completing reference counting, allowing concurrent deletion and freeing of an mddev entry. This led to a use-after-free when the kernel continued to reference freed mddev structures. A local user with low privileges could trigger this to corrupt memory and cause a denial of service. The issue has been resolved by reworking the iteration logic, introducing proper locking and reference handling (mddev_put_locked()), and switching to list_for_each_entry to avoid unsafe continuation across deletions

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2022-49846

Threats

Impact Moderate

References

116 references

URL	Category
https://access.redhat.com/errata/RHSA-2025:10701	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267038	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267724	external
https://bugzilla.redhat.com/show_bug.cgi?id=2268315	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273148	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281054	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281221	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281758	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281989	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282698	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282744	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284477	external
https://bugzilla.redhat.com/show_bug.cgi?id=2294313	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300487	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300492	external
https://bugzilla.redhat.com/show_bug.cgi?id=2315178	external
https://bugzilla.redhat.com/show_bug.cgi?id=2334573	external
https://bugzilla.redhat.com/show_bug.cgi?id=2360236	external
https://bugzilla.redhat.com/show_bug.cgi?id=2363432	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2022-49846	self
https://bugzilla.redhat.com/show_bug.cgi?id=2363432	external
https://www.cve.org/CVERecord?id=CVE-2022-49846	external
https://nvd.nist.gov/vuln/detail/CVE-2022-49846	external
https://lore.kernel.org/linux-cve-announce/202505…	external
https://access.redhat.com/security/cve/CVE-2023-52477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267038	external
https://www.cve.org/CVERecord?id=CVE-2023-52477	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52477	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2023-52565	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267724	external
https://www.cve.org/CVERecord?id=CVE-2023-52565	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52565	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52595	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268315	external
https://www.cve.org/CVERecord?id=CVE-2023-52595	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52595	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52781	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282698	external
https://www.cve.org/CVERecord?id=CVE-2023-52781	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52781	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2023-52834	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282744	external
https://www.cve.org/CVERecord?id=CVE-2023-52834	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52834	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26717	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273148	external
https://www.cve.org/CVERecord?id=CVE-2024-26717	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26717	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-35790	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281054	external
https://www.cve.org/CVERecord?id=CVE-2024-35790	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35790	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35807	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281221	external
https://www.cve.org/CVERecord?id=CVE-2024-35807	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35807	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35924	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281758	external
https://www.cve.org/CVERecord?id=CVE-2024-35924	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35924	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36006	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281989	external
https://www.cve.org/CVERecord?id=CVE-2024-36006	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36006	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36940	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284477	external
https://www.cve.org/CVERecord?id=CVE-2024-36940	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36940	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-39471	self
https://bugzilla.redhat.com/show_bug.cgi?id=2294313	external
https://www.cve.org/CVERecord?id=CVE-2024-39471	external
https://nvd.nist.gov/vuln/detail/CVE-2024-39471	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-41092	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300487	external
https://www.cve.org/CVERecord?id=CVE-2024-41092	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41092	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41097	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300492	external
https://www.cve.org/CVERecord?id=CVE-2024-41097	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41097	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-43880	self
https://bugzilla.redhat.com/show_bug.cgi?id=2306374	external
https://www.cve.org/CVERecord?id=CVE-2024-43880	external
https://nvd.nist.gov/vuln/detail/CVE-2024-43880	external
https://lore.kernel.org/linux-cve-announce/202408…	external
https://access.redhat.com/security/cve/CVE-2024-46826	self
https://bugzilla.redhat.com/show_bug.cgi?id=2315178	external
https://www.cve.org/CVERecord?id=CVE-2024-46826	external
https://nvd.nist.gov/vuln/detail/CVE-2024-46826	external
https://lore.kernel.org/linux-cve-announce/202409…	external
https://access.redhat.com/security/cve/CVE-2024-56614	self
https://bugzilla.redhat.com/show_bug.cgi?id=2334573	external
https://www.cve.org/CVERecord?id=CVE-2024-56614	external
https://nvd.nist.gov/vuln/detail/CVE-2024-56614	external
https://lore.kernel.org/linux-cve-announce/202412…	external
https://access.redhat.com/security/cve/CVE-2025-22126	self
https://bugzilla.redhat.com/show_bug.cgi?id=2360236	external
https://www.cve.org/CVERecord?id=CVE-2025-22126	external
https://nvd.nist.gov/vuln/detail/CVE-2025-22126	external
https://lore.kernel.org/linux-cve-announce/202504…	external

JSON

To clipboard

Loading 1.7 MB of JSON…

CVE-2024-36006 (GCVE-0-2024-36006)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:48 – Updated: 2026-05-12 11:53

Title

mlxsw: spectrum_acl_tcam: Fix incorrect list API usage

Summary

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1]. Fix by returning if the lists are empty as there is nothing to migrate in this case. [1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-20 17:00 UTC

Assigner

Linux mitre root

References

10 references

URL	Tags
https://git.kernel.org/stable/c/0b2c13b670b168e32…
https://git.kernel.org/stable/c/09846c2309b150b8c…
https://git.kernel.org/stable/c/64435b64e43d8ee60…
https://git.kernel.org/stable/c/4526a56e02da3725d…
https://git.kernel.org/stable/c/ab4ecfb627338e440…
https://git.kernel.org/stable/c/af8b593c3dd9df82c…
https://git.kernel.org/stable/c/b377add0f0117409c…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < 0b2c13b670b168e324e1cf109e67056a20fd610a (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < 09846c2309b150b8ce4e0ce96f058197598fc530 (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < 64435b64e43d8ee60faa46c0cd04e323e8b2a7b0 (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < 4526a56e02da3725db979358964df9cd9c567154 (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < ab4ecfb627338e440ae11def004c524a00d93e40 (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < af8b593c3dd9df82cb199be65863af004b09fd97 (git) Affected: 6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf , < b377add0f0117409c418ddd6504bd682ebe0bf79 (git)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.4.275 , ≤ 5.4.* (semver) Unaffected: 5.10.216 , ≤ 5.10.* (semver) Unaffected: 5.15.158 , ≤ 5.15.* (semver) Unaffected: 6.1.90 , ≤ 6.1.* (semver) Unaffected: 6.6.30 , ≤ 6.6.* (semver) Unaffected: 6.8.9 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.1 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Affected: 0 , < V3.1 (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T17:00:50.884985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:47:57.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:12.329Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:53:35.895Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b2c13b670b168e324e1cf109e67056a20fd610a",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "09846c2309b150b8ce4e0ce96f058197598fc530",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "64435b64e43d8ee60faa46c0cd04e323e8b2a7b0",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "4526a56e02da3725db979358964df9cd9c567154",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "ab4ecfb627338e440ae11def004c524a00d93e40",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "af8b593c3dd9df82cb199be65863af004b09fd97",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            },
            {
              "lessThan": "b377add0f0117409c418ddd6504bd682ebe0bf79",
              "status": "affected",
              "version": "6f9579d4e3021b17b0a4cde6b04a6c94c9575cdf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.275",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.158",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.90",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.30",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.9",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_tcam: Fix incorrect list API usage\n\nBoth the function that migrates all the chunks within a region and the\nfunction that migrates all the entries within a chunk call\nlist_first_entry() on the respective lists without checking that the\nlists are not empty. This is incorrect usage of the API, which leads to\nthe following warning [1].\n\nFix by returning if the lists are empty as there is nothing to migrate\nin this case.\n\n[1]\nWARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0\u003e\nModules linked in:\nCPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0\n[...]\nCall Trace:\n \u003cTASK\u003e\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:15:29.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b2c13b670b168e324e1cf109e67056a20fd610a"
        },
        {
          "url": "https://git.kernel.org/stable/c/09846c2309b150b8ce4e0ce96f058197598fc530"
        },
        {
          "url": "https://git.kernel.org/stable/c/64435b64e43d8ee60faa46c0cd04e323e8b2a7b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4526a56e02da3725db979358964df9cd9c567154"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab4ecfb627338e440ae11def004c524a00d93e40"
        },
        {
          "url": "https://git.kernel.org/stable/c/af8b593c3dd9df82cb199be65863af004b09fd97"
        },
        {
          "url": "https://git.kernel.org/stable/c/b377add0f0117409c418ddd6504bd682ebe0bf79"
        }
      ],
      "title": "mlxsw: spectrum_acl_tcam: Fix incorrect list API usage",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36006",
    "datePublished": "2024-05-20T09:48:06.278Z",
    "dateReserved": "2024-05-17T13:50:33.150Z",
    "dateUpdated": "2026-05-12T11:53:35.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36940 (GCVE-0-2024-36940)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:32

Title

pinctrl: core: delete incorrect free in pinctrl_enable()

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-05 14:25 UTC

Assigner

Linux mitre root

References

12 references

URL	Tags
https://git.kernel.org/stable/c/735f4c6b6771eafe3…
https://git.kernel.org/stable/c/cdaa171473d98962a…
https://git.kernel.org/stable/c/288bc4aa75f150d6f…
https://git.kernel.org/stable/c/41f88ef8ba387a12f…
https://git.kernel.org/stable/c/ac7d65795827dc0cf…
https://git.kernel.org/stable/c/558c8039fdf596a58…
https://git.kernel.org/stable/c/f9f1e321d53e4c5b6…
https://git.kernel.org/stable/c/5038a66dad0199de6…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

6 products

Vendor	Product	Version
Linux	Linux	Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < 735f4c6b6771eafe336404c157ca683ad72a040d (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < cdaa171473d98962ae86f2a663d398fda2fbeefd (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < 288bc4aa75f150d6f1ee82dd43c6da1b438b6068 (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < 41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < ac7d65795827dc0cf7662384ed27caf4066bd72e (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < 558c8039fdf596a584a92c171cbf3298919c448c (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < f9f1e321d53e4c5b666b66e5b43da29841fb55ba (git) Affected: 6118714275f0a313ecc296a87ed1af32d9691bed , < 5038a66dad0199de60e5671603ea6623eb9e5c79 (git)
Linux	Linux	Affected: 4.11 Unaffected: 0 , < 4.11 (semver) Unaffected: 4.19.314 , ≤ 4.19.* (semver) Unaffected: 5.4.276 , ≤ 5.4.* (semver) Unaffected: 5.10.217 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.1 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Affected: 0 , < V3.1 (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T14:25:26.979822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T14:25:33.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:54:19.300Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "735f4c6b6771eafe336404c157ca683ad72a040d",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "cdaa171473d98962ae86f2a663d398fda2fbeefd",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "288bc4aa75f150d6f1ee82dd43c6da1b438b6068",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "ac7d65795827dc0cf7662384ed27caf4066bd72e",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "558c8039fdf596a584a92c171cbf3298919c448c",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "f9f1e321d53e4c5b666b66e5b43da29841fb55ba",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            },
            {
              "lessThan": "5038a66dad0199de60e5671603ea6623eb9e5c79",
              "status": "affected",
              "version": "6118714275f0a313ecc296a87ed1af32d9691bed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.314",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.314",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.276",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: core: delete incorrect free in pinctrl_enable()\n\nThe \"pctldev\" struct is allocated in devm_pinctrl_register_and_init().\nIt\u0027s a devm_ managed pointer that is freed by devm_pinctrl_dev_release(),\nso freeing it in pinctrl_enable() will lead to a double free.\n\nThe devm_pinctrl_dev_release() function frees the pindescs and destroys\nthe mutex as well."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The pinctrl core is reached only through local operations \u2014 driver probe/re-probe via module load, deferred-probe retry, or bind/unbind \u2014 with no network- or peer-supplied data anywhere on the path. There is no remote or adjacent protocol handler involved.\nAC:L - The failing condition in `pinctrl_claim_hogs()` includes `-ENOMEM` from `create_pinctrl()`\u0027s `kzalloc()` and from `pinctrl_dt_to_map()`, which a local attacker can drive via sustained memory pressure timed against a driver probe. Once the free happens the devres release is guaranteed to run on the dangling pointer, so no unwinnable race is required.\nPR:L - An unprivileged local account suffices to apply the allocation pressure that induces the `pinctrl_claim_hogs()` error path on a system where an affected pinctrl driver probes or re-probes. No capability check guards `pinctrl_enable()` itself, and the resulting double free is in shared kernel slab state.\nUI:N - The vulnerable path executes autonomously during driver probe and devres teardown; no victim action such as mounting a filesystem or opening a file is needed.\nS:U - The corruption is confined to kernel slab memory within the same security authority \u2014 a standard kernel-level compromise with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - `pinctrl_unregister()` reads extensively through the freed `pctldev` (`-\u003emutex`, `-\u003enode`, `-\u003edesc-\u003epins`, `-\u003ep`), and if the slab object is reclaimed by attacker-groomed data the double free enables heap-layout manipulation that can be leveraged into arbitrary kernel memory disclosure.\nI:H - The stale `list_del(\u0026pctldev-\u003enode)` writes through `next`/`prev` pointers in freed \u2014 and potentially attacker-controlled \u2014 memory, giving a write-what-where primitive, while the second `kfree()` corrupts the slab freelist and permits overlapping-allocation attacks leading to control-flow hijack.\nA:H - Double free plus use-after-free reliably corrupts the SLUB freelist and locks/destroys an already-destroyed mutex, producing an oops or panic; drivers that ignore `pinctrl_enable()`\u0027s return value (e.g. sppctl) leave a dangling pointer live until unbind, guaranteeing a later crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:10.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/735f4c6b6771eafe336404c157ca683ad72a040d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cdaa171473d98962ae86f2a663d398fda2fbeefd"
        },
        {
          "url": "https://git.kernel.org/stable/c/288bc4aa75f150d6f1ee82dd43c6da1b438b6068"
        },
        {
          "url": "https://git.kernel.org/stable/c/41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac7d65795827dc0cf7662384ed27caf4066bd72e"
        },
        {
          "url": "https://git.kernel.org/stable/c/558c8039fdf596a584a92c171cbf3298919c448c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9f1e321d53e4c5b666b66e5b43da29841fb55ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/5038a66dad0199de60e5671603ea6623eb9e5c79"
        }
      ],
      "title": "pinctrl: core: delete incorrect free in pinctrl_enable()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36940",
    "datePublished": "2024-05-30T15:29:28.101Z",
    "dateReserved": "2024-05-30T15:25:07.072Z",
    "dateUpdated": "2026-08-05T11:32:10.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-39471 (GCVE-0-2024-39471)

Vulnerability from cvelistv5 – Published: 2024-06-25 14:28 – Updated: 2026-08-05 11:33

Title

drm/amdgpu: add error handle to avoid out-of-bounds

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add error handle to avoid out-of-bounds if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should be stop to avoid out-of-bounds read, so directly return -EINVAL.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:07 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/5594971e02764aa1c…
https://git.kernel.org/stable/c/8112fa72b7f139052…
https://git.kernel.org/stable/c/ea906e9ac61e3152b…
https://git.kernel.org/stable/c/011552f29f20842c9…
https://git.kernel.org/stable/c/5b0a3dc3e87821acb…
https://git.kernel.org/stable/c/0964c84b93db7fbf7…
https://git.kernel.org/stable/c/8b2faf1a4f3b6c748…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 5594971e02764aa1c8210ffb838cb4e7897716e8 (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 8112fa72b7f139052843ff484130d6f97e9f052f (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < ea906e9ac61e3152bef63597f2d9f4a812fc346a (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 011552f29f20842c9a7a21bffe1f6a2d6457ba46 (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 5b0a3dc3e87821acb80e841b464d335aff242691 (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 0964c84b93db7fbf74f357c1e20957850e092db3 (git) Affected: 7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9 , < 8b2faf1a4f3b6c748c0da36cda865a226534d520 (git)
Linux	Linux	Affected: 5.4 Unaffected: 0 , < 5.4 (semver) Unaffected: 5.4.278 , ≤ 5.4.* (semver) Unaffected: 5.10.219 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.94 , ≤ 6.1.* (semver) Unaffected: 6.6.34 , ≤ 6.6.* (semver) Unaffected: 6.9.5 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.268Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5594971e02764aa1c8210ffb838cb4e7897716e8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8112fa72b7f139052843ff484130d6f97e9f052f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ea906e9ac61e3152bef63597f2d9f4a812fc346a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/011552f29f20842c9a7a21bffe1f6a2d6457ba46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5b0a3dc3e87821acb80e841b464d335aff242691"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0964c84b93db7fbf74f357c1e20957850e092db3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8b2faf1a4f3b6c748c0da36cda865a226534d520"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:48.948392Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:41.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5594971e02764aa1c8210ffb838cb4e7897716e8",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "8112fa72b7f139052843ff484130d6f97e9f052f",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "ea906e9ac61e3152bef63597f2d9f4a812fc346a",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "011552f29f20842c9a7a21bffe1f6a2d6457ba46",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "5b0a3dc3e87821acb80e841b464d335aff242691",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "0964c84b93db7fbf74f357c1e20957850e092db3",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            },
            {
              "lessThan": "8b2faf1a4f3b6c748c0da36cda865a226534d520",
              "status": "affected",
              "version": "7d0e6329dfdcfe48311f8888d6a8dfa73bee00a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.94",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.34",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.5",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add error handle to avoid out-of-bounds\n\nif the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should\nbe stop to avoid out-of-bounds read, so directly return -EINVAL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The amdgpu SDMA trap interrupt handler is only reachable on a machine with a local AMD GPU, driven through the DRM device/render nodes (`/dev/dri/renderD*`) and the GPU interrupt ring. There is no network or adjacent-network path to this code.\nAC:L - The out-of-bounds index is fully deterministic \u2014 once an interrupt vector with an unmatched SDMA client ID is processed, `-EINVAL` is used as the array index every time, with no race window, no memory-layout guessing, and no state the attacker must wait for. A local user with render-node access can keep the SDMA engines and their trap/error interrupts firing continuously to reach the handler repeatedly.\nPR:L - Exercising SDMA queues and provoking trap interrupts only requires opening the unprivileged DRM render node, which is group-readable to ordinary logged-in users on desktops, Android devices, and GPU cloud/container instances. No CAP_SYS_ADMIN or root in the initial namespace is needed.\nUI:N - The interrupt handler runs asynchronously from GPU activity the attacker\u0027s own process generates; no victim must open a file, mount anything, or take any action.\nS:U - The corruption is confined to kernel memory within the same security authority as the host kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `adev-\u003esdma.instance[0xFFFFFFEA]` is an unbounded out-of-bounds read many gigabytes beyond the array, and `amdgpu_fence_process()` then dereferences the resulting `struct amdgpu_ring`, reading `fence_drv.last_seq`, `sync_seq`, `num_fences_mask`, `adev`, and the `fences[]` pointer array from that location \u2014 arbitrary kernel memory read, not a bounded few-byte overread.\nI:H - The wild pointer is not merely read: `amdgpu_fence_process()` performs `atomic_cmpxchg()` on `drv-\u003elast_seq`, `timer_delete()` on `fence_drv.fallback_timer`, `RCU_INIT_POINTER(*ptr, NULL)` stores into `drv-\u003efences[]`, and `dma_fence_put()` (a refcount decrement plus potential release callback) on the garbage pointer \u2014 out-of-bounds writes and a refcount-decrement primitive that are the classic building blocks for control-flow hijacking.\nA:H - Dereferencing a pointer several terabytes out of range in hard-interrupt context faults on unmapped kernel memory, producing an oops/panic that cannot be recovered from in IRQ context, and the corrupting writes and bogus `dma_fence_put()` release paths add further crash modes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:28.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5594971e02764aa1c8210ffb838cb4e7897716e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8112fa72b7f139052843ff484130d6f97e9f052f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea906e9ac61e3152bef63597f2d9f4a812fc346a"
        },
        {
          "url": "https://git.kernel.org/stable/c/011552f29f20842c9a7a21bffe1f6a2d6457ba46"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b0a3dc3e87821acb80e841b464d335aff242691"
        },
        {
          "url": "https://git.kernel.org/stable/c/0964c84b93db7fbf74f357c1e20957850e092db3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b2faf1a4f3b6c748c0da36cda865a226534d520"
        }
      ],
      "title": "drm/amdgpu: add error handle to avoid out-of-bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39471",
    "datePublished": "2024-06-25T14:28:56.906Z",
    "dateReserved": "2024-06-25T14:23:23.745Z",
    "dateUpdated": "2026-08-05T11:33:28.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-41092 (GCVE-0-2024-41092)

Vulnerability from cvelistv5 – Published: 2024-07-29 15:48 – Updated: 2026-08-05 11:35

Title

drm/i915/gt: Fix potential UAF by revoke of fence registers

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines: <6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence ... <6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled <6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled <3> [414.070354] Unable to pin Y-tiled fence; err:-4 <3> [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(&fence->active)) ... <4>[ 609.603992] ------------[ cut here ]------------ <2>[ 609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301! <4>[ 609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G U W 6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1 <4>[ 609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 <4>[ 609.604010] Workqueue: i915 __i915_gem_free_work [i915] <4>[ 609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915] ... <4>[ 609.604271] Call Trace: <4>[ 609.604273] <TASK> ... <4>[ 609.604716] __i915_vma_evict+0x2e9/0x550 [i915] <4>[ 609.604852] __i915_vma_unbind+0x7c/0x160 [i915] <4>[ 609.604977] force_unbind+0x24/0xa0 [i915] <4>[ 609.605098] i915_vma_destroy+0x2f/0xa0 [i915] <4>[ 609.605210] __i915_gem_object_pages_fini+0x51/0x2f0 [i915] <4>[ 609.605330] __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915] <4>[ 609.605440] process_scheduled_works+0x351/0x690 ... In the past, there were similar failures reported by CI from other IGT tests, observed on other platforms. Before commit 63baf4f3d587 ("drm/i915/gt: Only wait for GPU activity before unbinding a GGTT fence"), i915_vma_revoke_fence() was waiting for idleness of vma->active via fence_update(). That commit introduced vma->fence->active in order for the fence_update() to be able to wait selectively on that one instead of vma->active since only idleness of fence registers was needed. But then, another commit 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal") replaced the call to fence_update() in i915_vma_revoke_fence() with only fence_write(), and also added that GEM_BUG_ON(!i915_active_is_idle(&fence->active)) in front. No justification was provided on why we might then expect idleness of vma->fence->active without first waiting on it. The issue can be potentially caused by a race among revocation of fence registers on one side and sequential execution of signal callbacks invoked on completion of a request that was using them on the other, still processed in parallel to revocation of those fence registers. Fix it by waiting for idleness of vma->fence->active in i915_vma_revoke_fence(). (cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:20 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/f771b91f21c46ad12…
https://git.kernel.org/stable/c/29c0fdf49078ab161…
https://git.kernel.org/stable/c/ca0fabd365a27a94a…
https://git.kernel.org/stable/c/06dec31a0a5112a91…
https://git.kernel.org/stable/c/414f4a31f7a811008…
https://git.kernel.org/stable/c/996c3412a06578e9d…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < f771b91f21c46ad1217328d05e72a2c7e3add535 (git) Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < 29c0fdf49078ab161570d3d1c6e13d66f182717d (git) Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < ca0fabd365a27a94a36e68a7a02df8ff3c13dac6 (git) Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < 06dec31a0a5112a91f49085e8a8fa1a82296d5c7 (git) Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < 414f4a31f7a811008fd9a33b06216b060bad18fc (git) Affected: 0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1 , < 996c3412a06578e9d779a16b9e79ace18125ab50 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.162 , ≤ 5.15.* (semver) Unaffected: 6.1.97 , ≤ 6.1.* (semver) Unaffected: 6.6.37 , ≤ 6.6.* (semver) Unaffected: 6.9.8 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:49.323Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f771b91f21c46ad1217328d05e72a2c7e3add535"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/29c0fdf49078ab161570d3d1c6e13d66f182717d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca0fabd365a27a94a36e68a7a02df8ff3c13dac6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/06dec31a0a5112a91f49085e8a8fa1a82296d5c7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/414f4a31f7a811008fd9a33b06216b060bad18fc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/996c3412a06578e9d779a16b9e79ace18125ab50"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41092",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:20:35.535942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:56.013Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f771b91f21c46ad1217328d05e72a2c7e3add535",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            },
            {
              "lessThan": "29c0fdf49078ab161570d3d1c6e13d66f182717d",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            },
            {
              "lessThan": "ca0fabd365a27a94a36e68a7a02df8ff3c13dac6",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            },
            {
              "lessThan": "06dec31a0a5112a91f49085e8a8fa1a82296d5c7",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            },
            {
              "lessThan": "414f4a31f7a811008fd9a33b06216b060bad18fc",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            },
            {
              "lessThan": "996c3412a06578e9d779a16b9e79ace18125ab50",
              "status": "affected",
              "version": "0d86ee35097ae0f1c2c50f2b8035ef480e25e4f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.97",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.37",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Fix potential UAF by revoke of fence registers\n\nCI has been sporadically reporting the following issue triggered by\nigt@i915_selftest@live@hangcheck on ADL-P and similar machines:\n\n\u003c6\u003e [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence\n...\n\u003c6\u003e [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled\n\u003c6\u003e [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled\n\u003c3\u003e [414.070354] Unable to pin Y-tiled fence; err:-4\n\u003c3\u003e [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(\u0026fence-\u003eactive))\n...\n\u003c4\u003e[  609.603992] ------------[ cut here ]------------\n\u003c2\u003e[  609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301!\n\u003c4\u003e[  609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI\n\u003c4\u003e[  609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G     U  W          6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1\n\u003c4\u003e[  609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023\n\u003c4\u003e[  609.604010] Workqueue: i915 __i915_gem_free_work [i915]\n\u003c4\u003e[  609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915]\n...\n\u003c4\u003e[  609.604271] Call Trace:\n\u003c4\u003e[  609.604273]  \u003cTASK\u003e\n...\n\u003c4\u003e[  609.604716]  __i915_vma_evict+0x2e9/0x550 [i915]\n\u003c4\u003e[  609.604852]  __i915_vma_unbind+0x7c/0x160 [i915]\n\u003c4\u003e[  609.604977]  force_unbind+0x24/0xa0 [i915]\n\u003c4\u003e[  609.605098]  i915_vma_destroy+0x2f/0xa0 [i915]\n\u003c4\u003e[  609.605210]  __i915_gem_object_pages_fini+0x51/0x2f0 [i915]\n\u003c4\u003e[  609.605330]  __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915]\n\u003c4\u003e[  609.605440]  process_scheduled_works+0x351/0x690\n...\n\nIn the past, there were similar failures reported by CI from other IGT\ntests, observed on other platforms.\n\nBefore commit 63baf4f3d587 (\"drm/i915/gt: Only wait for GPU activity\nbefore unbinding a GGTT fence\"), i915_vma_revoke_fence() was waiting for\nidleness of vma-\u003eactive via fence_update().   That commit introduced\nvma-\u003efence-\u003eactive in order for the fence_update() to be able to wait\nselectively on that one instead of vma-\u003eactive since only idleness of\nfence registers was needed.  But then, another commit 0d86ee35097a\n(\"drm/i915/gt: Make fence revocation unequivocal\") replaced the call to\nfence_update() in i915_vma_revoke_fence() with only fence_write(), and\nalso added that GEM_BUG_ON(!i915_active_is_idle(\u0026fence-\u003eactive)) in front.\nNo justification was provided on why we might then expect idleness of\nvma-\u003efence-\u003eactive without first waiting on it.\n\nThe issue can be potentially caused by a race among revocation of fence\nregisters on one side and sequential execution of signal callbacks invoked\non completion of a request that was using them on the other, still\nprocessed in parallel to revocation of those fence registers.  Fix it by\nwaiting for idleness of vma-\u003efence-\u003eactive in i915_vma_revoke_fence().\n\n(cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached only through local DRM ioctls on /dev/dri/cardN or renderD128 (I915_GEM_EXECBUFFER2 with EXEC_OBJECT_NEEDS_FENCE, I915_GEM_SET_TILING, I915_GEM_MMAP_OFFSET). There is no remote or adjacent-network component to i915 GGTT fence management.\nAC:L - The attacker controls both sides of the race \u2014 one thread continuously submits fenced batches that populate fence-\u003eactive while another forces revocation via GEM handle close or re-tiling, and with only 8-32 fence registers available GGTT/fence eviction pressure is trivially induced and looped indefinitely until the window is hit.\nPR:L - All required ioctls are DRM_RENDER_ALLOW and need no capability; any user with render-node access \u2014 every logged-in desktop/Chromebook user, container workloads, and sandboxed browser GPU processes \u2014 can reach the code. No root or CAP_SYS_ADMIN is involved.\nUI:N - The attacker performs every step itself via its own ioctl sequence and GPU submissions; no victim action, file open, or mount is required.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed (even under GVT-g the effect stays within the guest kernel).\nC:H - The use-after-free on the freed i915_vma/GEM object, in a slab the attacker grooms freely by cycling GEM allocations, yields an arbitrary kernel read primitive; additionally the stale fence register can be re-programmed for another object, exposing a different context\u0027s tiled buffer contents through the detiler window.\nI:H - Use-after-free of a freed vma written by in-flight retire callbacks gives a heap-spray-backed write primitive suitable for control-flow hijacking, and the un-drained fence register can be reprogrammed to apply wrong start/size/stride/tiling to an unrelated buffer, corrupting its contents.\nA:H - On CONFIG_DRM_I915_DEBUG_GEM kernels this is an immediate kernel BUG()/panic at intel_ggtt_fencing.c:301 as seen in the reported traces, and on production kernels the silent UAF causes oopses and GPU/memory corruption; either way it is a full system crash reproducible on demand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:20.738Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f771b91f21c46ad1217328d05e72a2c7e3add535"
        },
        {
          "url": "https://git.kernel.org/stable/c/29c0fdf49078ab161570d3d1c6e13d66f182717d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca0fabd365a27a94a36e68a7a02df8ff3c13dac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/06dec31a0a5112a91f49085e8a8fa1a82296d5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/414f4a31f7a811008fd9a33b06216b060bad18fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/996c3412a06578e9d779a16b9e79ace18125ab50"
        }
      ],
      "title": "drm/i915/gt: Fix potential UAF by revoke of fence registers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41092",
    "datePublished": "2024-07-29T15:48:05.853Z",
    "dateReserved": "2024-07-12T12:17:45.636Z",
    "dateUpdated": "2026-08-05T11:35:20.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-41097 (GCVE-0-2024-41097)

Vulnerability from cvelistv5 – Published: 2024-07-29 15:48 – Updated: 2026-05-23 15:51

Title

usb: atm: cxacru: fix endpoint checking in cxacru_bind()

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:20 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/5159a81924311c1ec…
https://git.kernel.org/stable/c/23926d316d2836315…
https://git.kernel.org/stable/c/75ddbf776dd04a09f…
https://git.kernel.org/stable/c/1aac4be1aaa517750…
https://git.kernel.org/stable/c/5584c776a1af7807c…
https://git.kernel.org/stable/c/f536f09eb45e4de8d…
https://git.kernel.org/stable/c/ac9007520e392541a…
https://git.kernel.org/stable/c/2eabb655a968b862b…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 5159a81924311c1ec786ad9fdef784ead8676a6a (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 23926d316d2836315cb113569f91393266eb5b47 (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 75ddbf776dd04a09fb9e5267ead5d0c989f84506 (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 1aac4be1aaa5177506219f01dce5e29194e5e95a (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 5584c776a1af7807ca815ee6265f2c1429fc5727 (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < f536f09eb45e4de8d1b9accee9d992aa1846f1d4 (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < ac9007520e392541a29daebaae8b9109007bc781 (git) Affected: 902ffc3c707c1d459ea57428a619a807cbe412f9 , < 2eabb655a968b862bc0c31629a09f0fbf3c80d51 (git) Affected: aef30a0bfdf6c10565285fff1ae8400b34ee0d81 (git) Affected: 2.6.35.5 , < 2.6.36 (semver)
Linux	Linux	Affected: 2.6.36 Unaffected: 0 , < 2.6.36 (semver) Unaffected: 4.19.317 , ≤ 4.19.* (semver) Unaffected: 5.4.279 , ≤ 5.4.* (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.162 , ≤ 5.15.* (semver) Unaffected: 6.1.97 , ≤ 6.1.* (semver) Unaffected: 6.6.37 , ≤ 6.6.* (semver) Unaffected: 6.9.8 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:55.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5159a81924311c1ec786ad9fdef784ead8676a6a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/23926d316d2836315cb113569f91393266eb5b47"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/75ddbf776dd04a09fb9e5267ead5d0c989f84506"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1aac4be1aaa5177506219f01dce5e29194e5e95a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5584c776a1af7807ca815ee6265f2c1429fc5727"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f536f09eb45e4de8d1b9accee9d992aa1846f1d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ac9007520e392541a29daebaae8b9109007bc781"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2eabb655a968b862bc0c31629a09f0fbf3c80d51"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41097",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:20:18.903942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:08.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5159a81924311c1ec786ad9fdef784ead8676a6a",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "23926d316d2836315cb113569f91393266eb5b47",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "75ddbf776dd04a09fb9e5267ead5d0c989f84506",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "1aac4be1aaa5177506219f01dce5e29194e5e95a",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "5584c776a1af7807ca815ee6265f2c1429fc5727",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "f536f09eb45e4de8d1b9accee9d992aa1846f1d4",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "ac9007520e392541a29daebaae8b9109007bc781",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "lessThan": "2eabb655a968b862bc0c31629a09f0fbf3c80d51",
              "status": "affected",
              "version": "902ffc3c707c1d459ea57428a619a807cbe412f9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "aef30a0bfdf6c10565285fff1ae8400b34ee0d81",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.36",
              "status": "affected",
              "version": "2.6.35.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.36"
            },
            {
              "lessThan": "2.6.36",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.317",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.97",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.37",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.8",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "2.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.35.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: fix endpoint checking in cxacru_bind()\n\nSyzbot is still reporting quite an old issue [1] that occurs due to\nincomplete checking of present usb endpoints. As such, wrong\nendpoints types may be used at urb sumbitting stage which in turn\ntriggers a warning in usb_submit_urb().\n\nFix the issue by verifying that required endpoint types are present\nfor both in and out endpoints, taking into account cmd endpoint type.\n\nUnfortunately, this patch has not been tested on real hardware.\n\n[1] Syzbot report:\nusb 1-1: BOGUS urb xfer, pipe 1 != type 3\nWARNING: CPU: 0 PID: 8667 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\nModules linked in:\nCPU: 0 PID: 8667 Comm: kworker/0:4 Not tainted 5.14.0-rc4-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nWorkqueue: usb_hub_wq hub_event\nRIP: 0010:usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502\n...\nCall Trace:\n cxacru_cm+0x3c0/0x8e0 drivers/usb/atm/cxacru.c:649\n cxacru_card_status+0x22/0xd0 drivers/usb/atm/cxacru.c:760\n cxacru_bind+0x7ac/0x11a0 drivers/usb/atm/cxacru.c:1209\n usbatm_usb_probe+0x321/0x1ae0 drivers/usb/atm/usbatm.c:1055\n cxacru_usb_probe+0xdf/0x1e0 drivers/usb/atm/cxacru.c:1363\n usb_probe_interface+0x315/0x7f0 drivers/usb/core/driver.c:396\n call_driver_probe drivers/base/dd.c:517 [inline]\n really_probe+0x23c/0xcd0 drivers/base/dd.c:595\n __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:747\n driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:777\n __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:894\n bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427\n __device_attach+0x228/0x4a0 drivers/base/dd.c:965\n bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487\n device_add+0xc2f/0x2180 drivers/base/core.c:3354\n usb_set_configuration+0x113a/0x1910 drivers/usb/core/message.c:2170\n usb_generic_driver_probe+0xba/0x100 drivers/usb/core/generic.c:238\n usb_probe_device+0xd9/0x2c0 drivers/usb/core/driver.c:293"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:51:55.945Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5159a81924311c1ec786ad9fdef784ead8676a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/23926d316d2836315cb113569f91393266eb5b47"
        },
        {
          "url": "https://git.kernel.org/stable/c/75ddbf776dd04a09fb9e5267ead5d0c989f84506"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aac4be1aaa5177506219f01dce5e29194e5e95a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5584c776a1af7807ca815ee6265f2c1429fc5727"
        },
        {
          "url": "https://git.kernel.org/stable/c/f536f09eb45e4de8d1b9accee9d992aa1846f1d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac9007520e392541a29daebaae8b9109007bc781"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eabb655a968b862bc0c31629a09f0fbf3c80d51"
        }
      ],
      "title": "usb: atm: cxacru: fix endpoint checking in cxacru_bind()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41097",
    "datePublished": "2024-07-29T15:48:10.175Z",
    "dateReserved": "2024-07-12T12:17:45.637Z",
    "dateUpdated": "2026-05-23T15:51:55.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-43880 (GCVE-0-2024-43880)

Vulnerability from cvelistv5 – Published: 2024-08-21 00:06 – Updated: 2026-08-05 11:36

Title

mlxsw: spectrum_acl_erp: Fix object nesting warning

Summary

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can contain more ACLs (i.e., tc filters), but the number of masks in each region (i.e., tc chain) is limited. In order to mitigate the effects of the above limitation, the device allows filters to share a single mask if their masks only differ in up to 8 consecutive bits. For example, dst_ip/25 can be represented using dst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the number of masks being used (and therefore does not support mask aggregation), but can contain a limited number of filters. The driver uses the "objagg" library to perform the mask aggregation by passing it objects that consist of the filter's mask and whether the filter is to be inserted into the A-TCAM or the C-TCAM since filters in different TCAMs cannot share a mask. The set of created objects is dependent on the insertion order of the filters and is not necessarily optimal. Therefore, the driver will periodically ask the library to compute a more optimal set ("hints") by looking at all the existing objects. When the library asks the driver whether two objects can be aggregated the driver only compares the provided masks and ignores the A-TCAM / C-TCAM indication. This is the right thing to do since the goal is to move as many filters as possible to the A-TCAM. The driver also forbids two identical masks from being aggregated since this can only happen if one was intentionally put in the C-TCAM to avoid a conflict in the A-TCAM. The above can result in the following set of hints: H1: {mask X, A-TCAM} -> H2: {mask Y, A-TCAM} // X is Y + delta H3: {mask Y, C-TCAM} -> H4: {mask Z, A-TCAM} // Y is Z + delta After getting the hints from the library the driver will start migrating filters from one region to another while consulting the computed hints and instructing the device to perform a lookup in both regions during the transition. Assuming a filter with mask X is being migrated into the A-TCAM in the new region, the hints lookup will return H1. Since H2 is the parent of H1, the library will try to find the object associated with it and create it if necessary in which case another hints lookup (recursive) will be performed. This hints lookup for {mask Y, A-TCAM} will either return H2 or H3 since the driver passes the library an object comparison function that ignores the A-TCAM / C-TCAM indication. This can eventually lead to nested objects which are not supported by the library [1]. Fix by removing the object comparison function from both the driver and the library as the driver was the only user. That way the lookup will only return exact matches. I do not have a reliable reproducer that can reproduce the issue in a timely manner, but before the fix the issue would reproduce in several minutes and with the fix it does not reproduce in over an hour. Note that the current usefulness of the hints is limited because they include the C-TCAM indication and represent aggregation that cannot actually happen. This will be addressed in net-next. [1] WARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0 Modules linked in: CPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42 Hardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:objagg_obj_parent_assign+0xb5/0xd0 [...] Call Trace: <TASK> __objagg_obj_get+0x2bb/0x580 objagg_obj_get+0xe/0x80 mlxsw_sp_acl_erp_mask_get+0xb5/0xf0 mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510 process_one_work+0x151/0x370

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:05 UTC

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/4dc09f6f260db3c45…
https://git.kernel.org/stable/c/36a9996e020dd5aa3…
https://git.kernel.org/stable/c/9a5261a984bba4f58…
https://git.kernel.org/stable/c/25c6fd9648ad05da4…
https://git.kernel.org/stable/c/0e59c2d2285326670…
https://git.kernel.org/stable/c/fb5d4fc578e655d11…
https://git.kernel.org/stable/c/97d833ceb27dc19f8…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2024…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 4dc09f6f260db3c4565a4ec52ba369393598f2fb (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 36a9996e020dd5aa325e0ecc55eb2328288ea6bb (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 9a5261a984bba4f583d966c550fa72c33ff3714e (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 25c6fd9648ad05da493a5d30881896a78a08b624 (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 0e59c2d22853266704e127915653598f7f104037 (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < fb5d4fc578e655d113f09565f6f047e15f7ab578 (git) Affected: 9069a3817d82b01b3a55da382c774e3575946130 , < 97d833ceb27dc19f8777d63f90be4a27b5daeedf (git)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 5.4.282 , ≤ 5.4.* (semver) Unaffected: 5.10.224 , ≤ 5.10.* (semver) Unaffected: 5.15.165 , ≤ 5.15.* (semver) Unaffected: 6.1.103 , ≤ 6.1.* (semver) Unaffected: 6.6.44 , ≤ 6.6.* (semver) Unaffected: 6.10.3 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43880",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:51.322073Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:17.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:06:33.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c",
            "include/linux/objagg.h",
            "lib/objagg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4dc09f6f260db3c4565a4ec52ba369393598f2fb",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "36a9996e020dd5aa325e0ecc55eb2328288ea6bb",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "9a5261a984bba4f583d966c550fa72c33ff3714e",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "25c6fd9648ad05da493a5d30881896a78a08b624",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "0e59c2d22853266704e127915653598f7f104037",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "fb5d4fc578e655d113f09565f6f047e15f7ab578",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            },
            {
              "lessThan": "97d833ceb27dc19f8777d63f90be4a27b5daeedf",
              "status": "affected",
              "version": "9069a3817d82b01b3a55da382c774e3575946130",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c",
            "include/linux/objagg.h",
            "lib/objagg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: spectrum_acl_erp: Fix object nesting warning\n\nACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM\n(A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can\ncontain more ACLs (i.e., tc filters), but the number of masks in each\nregion (i.e., tc chain) is limited.\n\nIn order to mitigate the effects of the above limitation, the device\nallows filters to share a single mask if their masks only differ in up\nto 8 consecutive bits. For example, dst_ip/25 can be represented using\ndst_ip/24 with a delta of 1 bit. The C-TCAM does not have a limit on the\nnumber of masks being used (and therefore does not support mask\naggregation), but can contain a limited number of filters.\n\nThe driver uses the \"objagg\" library to perform the mask aggregation by\npassing it objects that consist of the filter\u0027s mask and whether the\nfilter is to be inserted into the A-TCAM or the C-TCAM since filters in\ndifferent TCAMs cannot share a mask.\n\nThe set of created objects is dependent on the insertion order of the\nfilters and is not necessarily optimal. Therefore, the driver will\nperiodically ask the library to compute a more optimal set (\"hints\") by\nlooking at all the existing objects.\n\nWhen the library asks the driver whether two objects can be aggregated\nthe driver only compares the provided masks and ignores the A-TCAM /\nC-TCAM indication. This is the right thing to do since the goal is to\nmove as many filters as possible to the A-TCAM. The driver also forbids\ntwo identical masks from being aggregated since this can only happen if\none was intentionally put in the C-TCAM to avoid a conflict in the\nA-TCAM.\n\nThe above can result in the following set of hints:\n\nH1: {mask X, A-TCAM} -\u003e H2: {mask Y, A-TCAM} // X is Y + delta\nH3: {mask Y, C-TCAM} -\u003e H4: {mask Z, A-TCAM} // Y is Z + delta\n\nAfter getting the hints from the library the driver will start migrating\nfilters from one region to another while consulting the computed hints\nand instructing the device to perform a lookup in both regions during\nthe transition.\n\nAssuming a filter with mask X is being migrated into the A-TCAM in the\nnew region, the hints lookup will return H1. Since H2 is the parent of\nH1, the library will try to find the object associated with it and\ncreate it if necessary in which case another hints lookup (recursive)\nwill be performed. This hints lookup for {mask Y, A-TCAM} will either\nreturn H2 or H3 since the driver passes the library an object comparison\nfunction that ignores the A-TCAM / C-TCAM indication.\n\nThis can eventually lead to nested objects which are not supported by\nthe library [1].\n\nFix by removing the object comparison function from both the driver and\nthe library as the driver was the only user. That way the lookup will\nonly return exact matches.\n\nI do not have a reliable reproducer that can reproduce the issue in a\ntimely manner, but before the fix the issue would reproduce in several\nminutes and with the fix it does not reproduce in over an hour.\n\nNote that the current usefulness of the hints is limited because they\ninclude the C-TCAM indication and represent aggregation that cannot\nactually happen. This will be addressed in net-next.\n\n[1]\nWARNING: CPU: 0 PID: 153 at lib/objagg.c:170 objagg_obj_parent_assign+0xb5/0xd0\nModules linked in:\nCPU: 0 PID: 153 Comm: kworker/0:18 Not tainted 6.9.0-rc6-custom-g70fbc2c1c38b #42\nHardware name: Mellanox Technologies Ltd. MSN3700C/VMOD0008, BIOS 5.11 10/10/2018\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:objagg_obj_parent_assign+0xb5/0xd0\n[...]\nCall Trace:\n \u003cTASK\u003e\n __objagg_obj_get+0x2bb/0x580\n objagg_obj_get+0xe/0x80\n mlxsw_sp_acl_erp_mask_get+0xb5/0xf0\n mlxsw_sp_acl_atcam_entry_add+0xe8/0x3c0\n mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0\n mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270\n mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510\n process_one_work+0x151/0x370"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable objagg hint graph is built from tc flower filter masks configured locally via rtnetlink (RTM_NEWTFILTER) on an mlxsw switch port; no remote packet data reaches this code path.\nAC:L - The attacker chooses the filter masks and insertion order that produce the nested-hint condition (X=Y+delta, Y=Z+delta, with a duplicate mask forcing Y into the C-TCAM), and the rehash worker then fires automatically every 5 seconds; the author reproduced it accidentally within several minutes.\nPR:L - Adding tc filters requires CAP_NET_ADMIN over the netdev\u0027s netns (netlink_ns_capable in tc_new_tfilter), and mlxsw ports are not NETIF_F_NETNS_LOCAL, so they can be delegated into a container/namespace whose CAP_NET_ADMIN is held by a non-root principal \u2014 the routine model on whitebox switch platforms where ACL programming is handed to containerized management agents.\nUI:N - No victim action is needed; the periodic mlxsw_sp_acl_tcam_vregion_rehash_work timer triggers the faulty hint-based object creation on its own once the filters are installed.\nS:U - The type confusion and memory corruption are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A small mlxsw_sp_acl_erp_delta object is reinterpreted as the much larger mlxsw_sp_acl_erp, so fields including erp-\u003eid and erp-\u003eerp_table are read out of bounds from adjacent heap and are propagated into hardware register writes, giving an attacker-leverageable disclosure primitive.\nI:H - Type confusion yields an out-of-bounds atomic increment/write via refcount_inc_not_zero(\u0026bf-\u003erefcnt[rule_index]) with a garbage-derived index off a wild bf pointer; additionally the failed rehash and failed rollback leave the ASIC\u0027s ACL tables inconsistent with the configured policy, silently bypassing switch access-control rules.\nA:H - Confirmed general protection fault and WARN_ON oops inside the mlxsw_core kworker (panic under panic_on_warn), which occurs while vregion-\u003elock is held, permanently wedging all subsequent tc filter operations on that region."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:55.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4dc09f6f260db3c4565a4ec52ba369393598f2fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a9996e020dd5aa325e0ecc55eb2328288ea6bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a5261a984bba4f583d966c550fa72c33ff3714e"
        },
        {
          "url": "https://git.kernel.org/stable/c/25c6fd9648ad05da493a5d30881896a78a08b624"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e59c2d22853266704e127915653598f7f104037"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb5d4fc578e655d113f09565f6f047e15f7ab578"
        },
        {
          "url": "https://git.kernel.org/stable/c/97d833ceb27dc19f8777d63f90be4a27b5daeedf"
        }
      ],
      "title": "mlxsw: spectrum_acl_erp: Fix object nesting warning",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-43880",
    "datePublished": "2024-08-21T00:06:32.562Z",
    "dateReserved": "2024-08-17T09:11:59.287Z",
    "dateUpdated": "2026-08-05T11:36:55.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-46826 (GCVE-0-2024-46826)

Vulnerability from cvelistv5 – Published: 2024-09-27 12:39 – Updated: 2026-05-11 20:37

Title

ELF: fix kernel.randomize_va_space double read

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-29 14:12 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/1f81d51141a234ad0…
https://git.kernel.org/stable/c/53f17409abf61f66b…
https://git.kernel.org/stable/c/1cf8cd80903073440…
https://git.kernel.org/stable/c/2a97388a807b6ab55…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 32a932332c8bad842804842eaf9651ad6268e637 , < 1f81d51141a234ad0a3874b4d185dc27a521cd27 (git) Affected: 32a932332c8bad842804842eaf9651ad6268e637 , < 53f17409abf61f66b6f05aff795e938e5ba811d1 (git) Affected: 32a932332c8bad842804842eaf9651ad6268e637 , < 1cf8cd80903073440b6ea055811d04edd24fe4f7 (git) Affected: 32a932332c8bad842804842eaf9651ad6268e637 , < 2a97388a807b6ab5538aa8f8537b2463c6988bd2 (git)
Linux	Linux	Affected: 2.6.25 Unaffected: 0 , < 2.6.25 (semver) Unaffected: 6.1.110 , ≤ 6.1.* (semver) Unaffected: 6.6.51 , ≤ 6.6.* (semver) Unaffected: 6.10.10 , ≤ 6.10.* (semver) Unaffected: 6.11 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46826",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:12:53.943216Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:13:04.287Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:19:13.919Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_elf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f81d51141a234ad0a3874b4d185dc27a521cd27",
              "status": "affected",
              "version": "32a932332c8bad842804842eaf9651ad6268e637",
              "versionType": "git"
            },
            {
              "lessThan": "53f17409abf61f66b6f05aff795e938e5ba811d1",
              "status": "affected",
              "version": "32a932332c8bad842804842eaf9651ad6268e637",
              "versionType": "git"
            },
            {
              "lessThan": "1cf8cd80903073440b6ea055811d04edd24fe4f7",
              "status": "affected",
              "version": "32a932332c8bad842804842eaf9651ad6268e637",
              "versionType": "git"
            },
            {
              "lessThan": "2a97388a807b6ab5538aa8f8537b2463c6988bd2",
              "status": "affected",
              "version": "32a932332c8bad842804842eaf9651ad6268e637",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_elf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.25"
            },
            {
              "lessThan": "2.6.25",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.25",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nELF: fix kernel.randomize_va_space double read\n\nELF loader uses \"randomize_va_space\" twice. It is sysctl and can change\nat any moment, so 2 loads could see 2 different values in theory with\nunpredictable consequences.\n\nIssue exactly one load for consistent value across one exec."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:37:18.165Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f81d51141a234ad0a3874b4d185dc27a521cd27"
        },
        {
          "url": "https://git.kernel.org/stable/c/53f17409abf61f66b6f05aff795e938e5ba811d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cf8cd80903073440b6ea055811d04edd24fe4f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a97388a807b6ab5538aa8f8537b2463c6988bd2"
        }
      ],
      "title": "ELF: fix kernel.randomize_va_space double read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46826",
    "datePublished": "2024-09-27T12:39:25.860Z",
    "dateReserved": "2024-09-11T15:12:18.285Z",
    "dateUpdated": "2026-05-11T20:37:18.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-56614 (GCVE-0-2024-56614)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:51 – Updated: 2026-05-11 20:55

Title

xsk: fix OOB map writes when deleting elements

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 20:01 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/4d03f705e9d7aabeb…
https://git.kernel.org/stable/c/ed08c93d5a9801cc8…
https://git.kernel.org/stable/c/f8abd03f83d5fe81e…
https://git.kernel.org/stable/c/d486b5741d987d3e0…
https://git.kernel.org/stable/c/32cd3db7de97c0c7a…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fbfc504a24f53f7ebe128ab55cb5dba634f4ece8 , < 4d03f705e9d7aabebc6bfa5810f8aab6d176cbb7 (git) Affected: fbfc504a24f53f7ebe128ab55cb5dba634f4ece8 , < ed08c93d5a9801cc8f224a046411fd603c538d07 (git) Affected: fbfc504a24f53f7ebe128ab55cb5dba634f4ece8 , < f8abd03f83d5fe81e76eb93e2c4373eb9f75fd8a (git) Affected: fbfc504a24f53f7ebe128ab55cb5dba634f4ece8 , < d486b5741d987d3e0e6be4ac22cafdf94e6d1a47 (git) Affected: fbfc504a24f53f7ebe128ab55cb5dba634f4ece8 , < 32cd3db7de97c0c7a018756ce66244342fd583f0 (git)
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 5.15.174 , ≤ 5.15.* (semver) Unaffected: 6.1.120 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56614",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:01:11.995418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:13.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:50:59.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xskmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d03f705e9d7aabebc6bfa5810f8aab6d176cbb7",
              "status": "affected",
              "version": "fbfc504a24f53f7ebe128ab55cb5dba634f4ece8",
              "versionType": "git"
            },
            {
              "lessThan": "ed08c93d5a9801cc8f224a046411fd603c538d07",
              "status": "affected",
              "version": "fbfc504a24f53f7ebe128ab55cb5dba634f4ece8",
              "versionType": "git"
            },
            {
              "lessThan": "f8abd03f83d5fe81e76eb93e2c4373eb9f75fd8a",
              "status": "affected",
              "version": "fbfc504a24f53f7ebe128ab55cb5dba634f4ece8",
              "versionType": "git"
            },
            {
              "lessThan": "d486b5741d987d3e0e6be4ac22cafdf94e6d1a47",
              "status": "affected",
              "version": "fbfc504a24f53f7ebe128ab55cb5dba634f4ece8",
              "versionType": "git"
            },
            {
              "lessThan": "32cd3db7de97c0c7a018756ce66244342fd583f0",
              "status": "affected",
              "version": "fbfc504a24f53f7ebe128ab55cb5dba634f4ece8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xskmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: fix OOB map writes when deleting elements\n\nJordy says:\n\n\"\nIn the xsk_map_delete_elem function an unsigned integer\n(map-\u003emax_entries) is compared with a user-controlled signed integer\n(k). Due to implicit type conversion, a large unsigned value for\nmap-\u003emax_entries can bypass the intended bounds check:\n\n\tif (k \u003e= map-\u003emax_entries)\n\t\treturn -EINVAL;\n\nThis allows k to hold a negative value (between -2147483648 and -2),\nwhich is then used as an array index in m-\u003exsk_map[k], which results\nin an out-of-bounds access.\n\n\tspin_lock_bh(\u0026m-\u003elock);\n\tmap_entry = \u0026m-\u003exsk_map[k]; // Out-of-bounds map_entry\n\told_xs = unrcu_pointer(xchg(map_entry, NULL));  // Oob write\n\tif (old_xs)\n\t\txsk_map_sock_delete(old_xs, map_entry);\n\tspin_unlock_bh(\u0026m-\u003elock);\n\nThe xchg operation can then be used to cause an out-of-bounds write.\nMoreover, the invalid map_entry passed to xsk_map_sock_delete can lead\nto further memory corruption.\n\"\n\nIt indeed results in following splat:\n\n[76612.897343] BUG: unable to handle page fault for address: ffffc8fc2e461108\n[76612.904330] #PF: supervisor write access in kernel mode\n[76612.909639] #PF: error_code(0x0002) - not-present page\n[76612.914855] PGD 0 P4D 0\n[76612.917431] Oops: Oops: 0002 [#1] PREEMPT SMP\n[76612.921859] CPU: 11 UID: 0 PID: 10318 Comm: a.out Not tainted 6.12.0-rc1+ #470\n[76612.929189] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019\n[76612.939781] RIP: 0010:xsk_map_delete_elem+0x2d/0x60\n[76612.944738] Code: 00 00 41 54 55 53 48 63 2e 3b 6f 24 73 38 4c 8d a7 f8 00 00 00 48 89 fb 4c 89 e7 e8 2d bf 05 00 48 8d b4 eb 00 01 00 00 31 ff \u003c48\u003e 87 3e 48 85 ff 74 05 e8 16 ff ff ff 4c 89 e7 e8 3e bc 05 00 31\n[76612.963774] RSP: 0018:ffffc9002e407df8 EFLAGS: 00010246\n[76612.969079] RAX: 0000000000000000 RBX: ffffc9002e461000 RCX: 0000000000000000\n[76612.976323] RDX: 0000000000000001 RSI: ffffc8fc2e461108 RDI: 0000000000000000\n[76612.983569] RBP: ffffffff80000001 R08: 0000000000000000 R09: 0000000000000007\n[76612.990812] R10: ffffc9002e407e18 R11: ffff888108a38858 R12: ffffc9002e4610f8\n[76612.998060] R13: ffff888108a38858 R14: 00007ffd1ae0ac78 R15: ffffc9002e4610c0\n[76613.005303] FS:  00007f80b6f59740(0000) GS:ffff8897e0ec0000(0000) knlGS:0000000000000000\n[76613.013517] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[76613.019349] CR2: ffffc8fc2e461108 CR3: 000000011e3ef001 CR4: 00000000007726f0\n[76613.026595] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[76613.033841] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[76613.041086] PKRU: 55555554\n[76613.043842] Call Trace:\n[76613.046331]  \u003cTASK\u003e\n[76613.048468]  ? __die+0x20/0x60\n[76613.051581]  ? page_fault_oops+0x15a/0x450\n[76613.055747]  ? search_extable+0x22/0x30\n[76613.059649]  ? search_bpf_extables+0x5f/0x80\n[76613.063988]  ? exc_page_fault+0xa9/0x140\n[76613.067975]  ? asm_exc_page_fault+0x22/0x30\n[76613.072229]  ? xsk_map_delete_elem+0x2d/0x60\n[76613.076573]  ? xsk_map_delete_elem+0x23/0x60\n[76613.080914]  __sys_bpf+0x19b7/0x23c0\n[76613.084555]  __x64_sys_bpf+0x1a/0x20\n[76613.088194]  do_syscall_64+0x37/0xb0\n[76613.091832]  entry_SYSCALL_64_after_hwframe+0x4b/0x53\n[76613.096962] RIP: 0033:0x7f80b6d1e88d\n[76613.100592] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48\n[76613.119631] RSP: 002b:00007ffd1ae0ac68 EFLAGS: 00000206 ORIG_RAX: 0000000000000141\n[76613.131330] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f80b6d1e88d\n[76613.142632] RDX: 0000000000000098 RSI: 00007ffd1ae0ad20 RDI: 0000000000000003\n[76613.153967] RBP: 00007ffd1ae0adc0 R08: 0000000000000000 R09: 0000000000000000\n[76613.166030] R10: 00007f80b6f77040 R11: 0000000000000206 R12: 00007ffd1ae0aed8\n[76613.177130] R13: 000055ddf42ce1e9 R14: 000055ddf42d0d98 R15: 00\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:55:52.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d03f705e9d7aabebc6bfa5810f8aab6d176cbb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed08c93d5a9801cc8f224a046411fd603c538d07"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8abd03f83d5fe81e76eb93e2c4373eb9f75fd8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d486b5741d987d3e0e6be4ac22cafdf94e6d1a47"
        },
        {
          "url": "https://git.kernel.org/stable/c/32cd3db7de97c0c7a018756ce66244342fd583f0"
        }
      ],
      "title": "xsk: fix OOB map writes when deleting elements",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56614",
    "datePublished": "2024-12-27T14:51:19.154Z",
    "dateReserved": "2024-12-27T14:03:06.014Z",
    "dateUpdated": "2026-05-11T20:55:52.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-22126 (GCVE-0-2025-22126)

Vulnerability from cvelistv5 – Published: 2025-04-16 14:13 – Updated: 2026-05-11 21:13

Title

md: fix mddev uaf while iterating all_mddevs list

Summary

In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating all_mddevs list While iterating all_mddevs list from md_notify_reboot() and md_exit(), list_for_each_entry_safe is used, and this can race with deletint the next mddev, causing UAF: t1: spin_lock //list_for_each_entry_safe(mddev, n, ...) mddev_get(mddev1) // assume mddev2 is the next entry spin_unlock t2: //remove mddev2 ... mddev_free spin_lock list_del spin_unlock kfree(mddev2) mddev_put(mddev1) spin_lock //continue dereference mddev2->all_mddevs The old helper for_each_mddev() actually grab the reference of mddev2 while holding the lock, to prevent from being freed. This problem can be fixed the same way, however, the code will be complex. Hence switch to use list_for_each_entry, in this case mddev_put() can free the mddev1 and it's not safe as well. Refer to md_seq_show(), also factor out a helper mddev_put_locked() to fix this problem.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/ca9f84de76723b358…
https://git.kernel.org/stable/c/d69a23d8e925f8052…
https://git.kernel.org/stable/c/e2a9f73ee408a460f…
https://git.kernel.org/stable/c/5462544ccbad3fc93…
https://git.kernel.org/stable/c/8542870237c3a48ff…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f26514342255855f4ca3c0a92cb1cdea01c33004 , < ca9f84de76723b358dfc0606668efdca54afc2e5 (git) Affected: f26514342255855f4ca3c0a92cb1cdea01c33004 , < d69a23d8e925f8052d657652a6875ec2712c7e33 (git) Affected: f26514342255855f4ca3c0a92cb1cdea01c33004 , < e2a9f73ee408a460f4c9dfe03b4741d6b11652b8 (git) Affected: f26514342255855f4ca3c0a92cb1cdea01c33004 , < 5462544ccbad3fc938a71b01fa5bd3a0dc2b750a (git) Affected: f26514342255855f4ca3c0a92cb1cdea01c33004 , < 8542870237c3a48ff049b6c5df5f50c8728284fa (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.135 , ≤ 6.1.* (semver) Unaffected: 6.6.88 , ≤ 6.6.* (semver) Unaffected: 6.12.25 , ≤ 6.12.* (semver) Unaffected: 6.14.2 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:14.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca9f84de76723b358dfc0606668efdca54afc2e5",
              "status": "affected",
              "version": "f26514342255855f4ca3c0a92cb1cdea01c33004",
              "versionType": "git"
            },
            {
              "lessThan": "d69a23d8e925f8052d657652a6875ec2712c7e33",
              "status": "affected",
              "version": "f26514342255855f4ca3c0a92cb1cdea01c33004",
              "versionType": "git"
            },
            {
              "lessThan": "e2a9f73ee408a460f4c9dfe03b4741d6b11652b8",
              "status": "affected",
              "version": "f26514342255855f4ca3c0a92cb1cdea01c33004",
              "versionType": "git"
            },
            {
              "lessThan": "5462544ccbad3fc938a71b01fa5bd3a0dc2b750a",
              "status": "affected",
              "version": "f26514342255855f4ca3c0a92cb1cdea01c33004",
              "versionType": "git"
            },
            {
              "lessThan": "8542870237c3a48ff049b6c5df5f50c8728284fa",
              "status": "affected",
              "version": "f26514342255855f4ca3c0a92cb1cdea01c33004",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/md.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.135",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.88",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.25",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd: fix mddev uaf while iterating all_mddevs list\n\nWhile iterating all_mddevs list from md_notify_reboot() and md_exit(),\nlist_for_each_entry_safe is used, and this can race with deletint the\nnext mddev, causing UAF:\n\nt1:\nspin_lock\n//list_for_each_entry_safe(mddev, n, ...)\n mddev_get(mddev1)\n // assume mddev2 is the next entry\n spin_unlock\n            t2:\n            //remove mddev2\n            ...\n            mddev_free\n            spin_lock\n            list_del\n            spin_unlock\n            kfree(mddev2)\n mddev_put(mddev1)\n spin_lock\n //continue dereference mddev2-\u003eall_mddevs\n\nThe old helper for_each_mddev() actually grab the reference of mddev2\nwhile holding the lock, to prevent from being freed. This problem can be\nfixed the same way, however, the code will be complex.\n\nHence switch to use list_for_each_entry, in this case mddev_put() can free\nthe mddev1 and it\u0027s not safe as well. Refer to md_seq_show(), also factor\nout a helper mddev_put_locked() to fix this problem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:13:28.326Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca9f84de76723b358dfc0606668efdca54afc2e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d69a23d8e925f8052d657652a6875ec2712c7e33"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2a9f73ee408a460f4c9dfe03b4741d6b11652b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5462544ccbad3fc938a71b01fa5bd3a0dc2b750a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8542870237c3a48ff049b6c5df5f50c8728284fa"
        }
      ],
      "title": "md: fix mddev uaf while iterating all_mddevs list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22126",
    "datePublished": "2025-04-16T14:13:09.399Z",
    "dateReserved": "2024-12-29T08:45:45.823Z",
    "dateUpdated": "2026-05-11T21:13:28.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2025:10701

CVE-2024-36006 (GCVE-0-2024-36006)

CVE-2024-36940 (GCVE-0-2024-36940)

CVE-2024-39471 (GCVE-0-2024-39471)

CVE-2024-41092 (GCVE-0-2024-41092)

CVE-2024-41097 (GCVE-0-2024-41097)

CVE-2024-43880 (GCVE-0-2024-43880)

CVE-2024-46826 (GCVE-0-2024-46826)

CVE-2024-56614 (GCVE-0-2024-56614)

CVE-2025-22126 (GCVE-0-2025-22126)

Tags

Sightings

Nomenclature

Related by attack behaviour