A vulnerability in the Linux kernel's AMD DRM display driver was resolved by adding a NULL check in the dc_state_release function. This fix prevents a NULL pointer dereference that could lead to a denial of service. The issue affects multiple Linux kernel versions prior to 6.8.0-35.35 and specific 4.11.0 and 4.13.0 builds. The vulnerability has a medium severity rating with a CVSS score of 5.5. No known exploits are reported in the wild. The vendor has released official fixes for affected versions.
CVE-2024-26938 is a vulnerability in the Linux kernel's drm/i915/bios component where the function intel_bios_encoder_supports_dp_dual_mode() did not properly handle a NULL devdata pointer. This could cause the kernel to oops (crash) if no Video BIOS Table (VBT) was present or if the encoder was not declared in the VBT. The fix involves tolerating a NULL devdata by bailing early, preventing the crash but losing the ability to detect DP++ ports. This vulnerability has been patched in affected Linux kernel versions.
A vulnerability in the Linux kernel's ESP (Encapsulating Security Payload) networking code was fixed to address improper handling of pages from the page_pool during skb reorganization. The flaw caused a page_pool leak that could lead to a system crash, observable under specific configurations involving IPsec and GRE forwarding. The fix introduces a wrapper function to correctly manage page reference counting for page_pool pages.
A slab-out-of-bounds vulnerability in the Linux kernel's ksmbd component was fixed. The issue occurs when the NameOffset field of smb2_create_req is smaller than the Buffer offset, leading to an out-of-bounds read. The patch enforces a minimum value for the name offset to prevent this. This vulnerability has a high severity score of 8.1 and affects multiple Linux kernel versions prior to 6.8.0-35.35 and certain specific older versions. A patch is available to address this issue.
A deadlock vulnerability in the Linux kernel's MediaTek clock controller probing was resolved by ensuring a runtime PM get call during probe to prevent lock acquisition conflicts. This issue affected multiple Linux kernel versions and could cause a denial of service due to deadlock. The vulnerability has been fixed in updated kernel releases.
A race condition vulnerability in the Linux kernel's interconnect subsystem was resolved by ensuring proper locking order when accessing the req_list. The issue involved concurrent access to icc_node::req_list protected by separate mutexes, causing potential invalid pointer dereferences. The fix enforces holding the icc_bw_lock mutex before manipulating req_list, preventing race conditions. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-1011.12~22.04.1 and specific older versions. A patch is available, and users should update and reboot to apply the fix.
A deadlock vulnerability (CVE-2024-27014) in the Linux kernel's mlx5e network driver was resolved. The issue occurs when disabling adaptive Receive Flow Steering (aRFS) under a state lock, where canceling scheduled aRFS work waits on a handler that tries to reacquire the same lock, causing a deadlock. The fix introduces an aRFS state variable to prevent rule additions when aRFS is disabled. This vulnerability affects multiple linux-azure kernel versions prior to 6.8.0-1011.12~22.04.1 and specific 4.11.x and 4.13.x versions. The CVSS score is 5.5 (medium severity) with impact limited to availability (denial of service). A patch is available and included in recent Linux kernel updates.
CVE-2024-27022 is a race condition vulnerability in the Linux kernel's fork operation related to the handling of file VMAs (Virtual Memory Areas). The flaw occurs because the kernel links a file VMA before it is fully initialized, leading to potential use of uninitialized VMA locks. This vulnerability has been resolved by deferring the linking of the file VMA until it is fully initialized.
A high severity vulnerability (CVE-2024-26853) in the Linux kernel's igc network driver was resolved. The flaw involves improper handling of frames in the XDP_REDIRECT path, where frames can be freed twice, leading to memory corruption and potential kernel panic. This occurs when frames cannot be transmitted due to a full queue, and the driver incorrectly calls xdp_return_frame_rx_napi, causing instability. The issue affects multiple Linux kernel versions and can be triggered by generating excessive traffic through XDP_REDIRECT. A patch is available to correct this behavior.
A use-after-free vulnerability was identified and resolved in the Linux kernel's spi: lpspi driver, specifically in the probe function fsl_lpspi_probe(). The issue arises due to manual memory allocation and disposal combined with device-managed resource handling, leading to potential use of freed memory. This can cause a kernel NULL pointer dereference and denial of service. The vulnerability affects multiple versions of the linux-azure kernel prior to 6.8.0-35.35 and certain 4.11.x and 4.13.x builds. A patch is available to address this issue.
A race condition vulnerability in the Linux kernel's f2fs filesystem was resolved that could cause data corruption due to improper truncation of meta inode pages. The issue arises because invalidate_mapping_pages() may skip invalidating pages with certain statuses, leading to stale data writes. The fix replaces this with truncate_inode_pages_range() to ensure proper page dropping. This vulnerability affects multiple specific Linux kernel versions and has a CVSS score of 7.8, indicating high impact on confidentiality, integrity, and availability. A patch is available and should be applied to affected systems.
A vulnerability in the Linux kernel's drm/bridge adv7511 driver could cause a kernel crash due to an uninitialized data access during IRQ handling in the probe function. This issue has been fixed by moving IRQ registration to the end of the probe process. The flaw could lead to a denial of service via a kernel oops triggered by an IRQ pending before initialization completes.
A vulnerability in the Linux kernel's SCSI UFS core component was fixed to address a shift operation issue in the ufshcd_clear_cmd() function. The flaw occurs when task_tag is 32 or greater and the system uses a 4-byte unsigned int, causing an out-of-bounds bitwise shift. This can lead to kernel exceptions and internal errors. The issue has been resolved in affected Linux kernel versions.
A vulnerability in the Linux kernel's block layer involving incorrect handling of iov_iter direction has been resolved. Syzkaller reported a warning due to an iov_iter used in the wrong direction when a transfer direction of SG_DXFER_TO_FROM_DEV is specified. This causes the kernel to copy user buffers into the kernel, read into them, and then copy data back to user space, using the iovec in both directions. The fix detects this situation and constructs a new iterator with the correct direction for the copy-in operation.
A vulnerability in the Linux kernel's cadence-quadspi driver causes incorrect pointer usage in runtime suspend and resume functions, leading to memory corruption and potential kernel crashes. This occurs because the driver incorrectly treats the same device driver data pointer as two different structures, causing invalid memory access during device power management operations. The issue affects multiple Linux kernel versions and has been resolved in patched releases.
A medium severity vulnerability (CVE-2024-26740) in the Linux kernel's net/sched subsystem related to the act_mirred module has been resolved. The issue involves a deadlock caused by reversing traffic flow with redirect (egress to ingress) that can lead to socket lock contention and hangs in testing environments. The fix involves using the Rx backlog to handle packets in such scenarios to avoid inline processing deadlocks. This vulnerability affects specific Linux Azure kernel versions and certain Ubuntu kernel builds.
A vulnerability in the Linux kernel's scsi smartpqi driver was fixed related to incorrect blk-mq registration when the module parameter disable_managed_interrupts is enabled. The driver incorrectly called blk_mq_pci_map_queues() instead of blk_mq_map_queues() when the PCI_IRQ_AFFINITY flag is disabled, causing a kernel stack trace and potentially undefined behavior. This issue has been resolved in affected Linux kernel versions.
A vulnerability in the Linux kernel's md (multiple device) subsystem related to the handling of sync_thread registration during reshape operations has been resolved. The issue occurs when a reshape is interrupted, causing the sync_thread to be registered directly from pers->run() without guaranteeing execution of md_do_sync(), leading to a hang in stop_sync_thread() because the MD_RECOVERY_RUNNING flag cannot be cleared. The fix removes direct registration of sync_thread from raid10 and raid5 and delegates this responsibility to md_check_recovery().
A vulnerability in the Linux kernel's md (multiple device) subsystem related to handling read-only arrays in md_check_recovery() has been resolved. The issue arises when dm-raid manipulates the read-only flag without properly stopping the sync thread, causing a hang during array stop operations. This flaw can lead to a denial of service by hanging the system during RAID recovery operations. The vulnerability affects specific versions of the linux-azure kernel prior to 6.8.0-2002.2 and several specific 4.x versions. A fix is available to address this synchronization and state management issue.
A race condition vulnerability in the Linux kernel's memory management swap subsystem (CVE-2024-26759) can cause data corruption or loss when multiple threads concurrently swap in the same memory entry. This occurs due to an ABA problem where one thread installs a stale page into the page table entry (PTE) after another thread frees and reuses the swap entry. The issue affects certain Linux Azure kernel versions and has been fixed by introducing proper synchronization to prevent concurrent swapin operations on the same entry.