A vulnerability in the Linux kernel's device tree and open firmware driver (of: module) could cause a NULL pointer dereference in the vsnprintf() function due to improper handling of str and len parameters in of_modalias(). This flaw may lead to a kernel crash (kernel oops). The issue has been fixed in updated Linux kernel versions.
A use-after-free vulnerability in the Linux kernel's IOMMU VT-d I/O page fault reporting path was resolved by adding a mutex to synchronize device lookup and release operations. The flaw involved a race condition where a device could be freed after being found in the device rbtree but before fault parameters were retrieved, potentially leading to memory corruption. This issue affects multiple Linux kernel versions prior to 6.8.0-35.35 and several specific older versions. The vulnerability has a high CVSS score of 8.8 and impacts confidentiality, integrity, and availability. A patch is available and should be applied to mitigate the risk.
CVE-2024-35799 is a vulnerability in the Linux kernel's drm/amd/display component where disabling a stream encoder calls a function that no longer exists, causing a crash. This issue has been resolved by adding a check for a NULL function declaration before disabling the stream encoder. The vulnerability can lead to a denial of service by crashing the system. A fix is available and has been incorporated in Linux kernel versions 6.8.0-35.35 and later, as well as specific 4.11.0 and 4.13.0 builds. The CVSS score is 6.2 (medium severity) with no known exploits in the wild.
A vulnerability in the Linux kernel's x86 floating point unit (FPU) handling was fixed by ensuring the per-CPU cached xfd_state is kept in sync with the MSR_IA32_XFD register. Previously, on CPU hotplug events, the MSR_IA32_XFD register was reset but the cached xfd_state was not, causing them to become out of sync. This desynchronization could lead to a failure in updating the MSR, resulting in a #NM exception in kernel space and causing a kernel crash. The issue is resolved by introducing a function to update both the cached state and the MSR together. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-35.35 and several specific older versions. A patch is available to address this issue.
A vulnerability in the Linux kernel's x86 EFI stub was resolved. The EFI stub normally calls EFI boot services using the firmware's stack, which must be at least 128k in size. In mixed mode boot, a smaller 16k stack was used, causing EFI boot service calls to use an undersized decompressor stack. Recent changes moved the boot stack location, making overruns corrupt critical memory sections. The fix records the firmware stack pointer on entry and switches to it for EFI boot service calls, preventing stack corruption.
A vulnerability in the Linux kernel's md/dm-raid subsystem was resolved. The issue involved unsafe direct calls to md_reap_sync_thread() from raid_message() without holding the reconfig_mutex, risking data corruption or instability. The fix replaces this call with stop_sync_thread() to safely unregister the sync_thread, avoiding deadlocks. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-35.35 and several specific older versions. A patch is available to address this issue.
A vulnerability in the Linux kernel's block subsystem was fixed to correct improper page reference counting for unaligned buffers in the __bio_release_pages() function. This flaw caused an incorrect number of pages to be released when buffers did not start at the beginning of a page, potentially leading to system instability or denial of service. The issue affects multiple Linux kernel versions prior to 6.8.0-35.35 and several specific older versions. A patch is available to address this problem.
A vulnerability in the Linux kernel's bcachefs filesystem was resolved where the snapshots allocated by kvzalloc in __snapshot_t_mut were improperly freed using kfree instead of kvfree. This incorrect deallocation could cause a kernel page fault and crash during unmount operations. The issue affects multiple Linux kernel versions and has been assigned CVE-2024-35832 with a CVSS score of 5.5 (high severity).
A vulnerability in the Linux kernel NVMe driver related to reserved tag allocation has been fixed. The issue caused the admin queue to fail to reconnect when using NVMe over RDMA due to a deadlock involving tag allocation between admin and fabric queues. This could result in a permanent failure to reconnect the admin queue, impacting availability. The vulnerability has a CVSS score of 7.5 and is considered to have a high impact on availability but no confidentiality or integrity impact. A patch is available to address this issue by reserving two tags for the admin queue to avoid deadlock.
A deadlock vulnerability was identified and fixed in the Linux kernel's Btrfs filesystem related to extent locking during fiemap operations. The issue occurs because the extent lock was held for the entire duration of the fiemap call, which could cause a deadlock when page faults happen while copying extents to user space. The fix reduces the locking scope to avoid deadlocks while maintaining consistency during delalloc checks.
A vulnerability in the Linux kernel's dm-raid component related to the sync_thread freezing during suspend has been resolved. The issue involved improper handling of the MD_RECOVERY_FROZEN flag and synchronization thread stopping logic, which could cause hangs and filesystem corruption during suspend operations. The fix corrects the flag usage and synchronization thread management to prevent these issues. Although this patch resolves the immediate hang and ext4 corruption problems, a deadlock related to dm-raid456 remains and will be addressed in future patches.
A vulnerability in the Linux kernel's dmaengine dw-edma eDMA component was resolved by adding a synchronization read before starting DMA transfers in remote setup. The issue involves a race condition where the doorbell register could be toggled before the linked list write completes, potentially causing errors. This affects certain versions of the linux-hwe-edge kernel and has a CVSS score of 7.8.
A vulnerability in the Linux kernel's MCTP networking component was fixed by ensuring that the function mctp_local_output properly frees socket buffers (skb) on all error paths. Previously, skb ownership was only taken on success, potentially causing memory leaks if the function failed in certain states. This issue affects multiple Linux kernel versions including various Ubuntu HWE edge releases. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but can cause availability issues due to resource leaks. A patch is available to address this issue.
A vulnerability in the Linux kernel's drm/amdgpu subsystem related to the call order in the amdgpu_ttm_move() function has been resolved. The issue involved incorrect handling of move notifications and statistics updates, potentially leading to system compromise. This flaw has been fixed in Linux kernel versions 6.8.0 and later. The vulnerability has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability. Multiple Linux kernel security issues were addressed in the same update. No known exploits are reported in the wild.
A vulnerability in the Linux kernel's nbd (Network Block Device) component was identified where the function nla_nest_start() may fail and return NULL without proper null checking. This issue has been resolved by inserting a null check and setting errno appropriately. The vulnerability affects multiple specific versions of the linux-azure kernel.
A vulnerability in the Linux kernel's f2fs filesystem driver could cause a kernel panic or deadloop during recovery when certain fault injection conditions are met. The issue arises if f2fs_reserve_new_block() returns -ENOSPC during recovery, potentially triggering a panic, or if a fault injection rate of 1 with only FAULT_BLOCK fault type enabled causes a deadloop in block reservation. This vulnerability has been fixed by removing the panic trigger and limiting the loop count during block reservation.
A vulnerability in the Linux kernel's f2fs filesystem compression feature could cause data corruption after a sudden power-off recovery (SPOR). The issue arises if a data block in a compressed cluster is not persisted with metadata during checkpointing, potentially leading to corrupted data. This flaw has been fixed to ensure compressed pages are properly written during checkpoint operations.
A vulnerability in the Linux kernel's AMD GPU display driver (amdgpu_dm_fini function) could lead to a NULL pointer dereference due to improper NULL checks for the 'adev->dm.dc' pointer. This issue has been fixed by improving the NULL checks to prevent potential crashes. The vulnerability has a CVSS score of 5.5, indicating a low severity denial of service impact. A patch is available and has been released by the vendor.
A vulnerability in the Linux kernel's iwlwifi driver (CVE-2024-27056) was resolved. The issue occurs because the resume code path assumes the transmit (TX) queue for the offloading TID exists, but if no packets have been sent on TID 0, the queue is not allocated, causing a crash during resume. The fix ensures the queue exists at suspend time to prevent this crash.
A vulnerability in the Linux kernel's ASoC SOF ipc4-pcm component caused misalignment between kernel and firmware states after system suspend when audio was active, leading to audio resume failures. The issue arises if the firmware crashes during audio playback or stream reset before suspend, causing IPC errors and interrupted state changes. Errors on stream close are ignored, allowing kernel state correction on the second DSP boot after a panic. This vulnerability has been resolved in patched versions.