Threat database

A vulnerability in the Linux kernel's AMD display driver (drm/amd/display) has been resolved. The issues involved incorrect integer type comparisons in loop conditions that could cause infinite loops and pointer dereferences occurring before null checks. This could lead to denial of service due to kernel instability. The vulnerability affects multiple specific Linux kernel versions prior to 6.8.0-2002.2 and several exact older versions. A patch is available to address these issues.

A medium severity vulnerability in the Linux kernel affecting the HID nvidia-shield driver was resolved by adding missing null pointer checks during LED initialization. The issue arises because devm_kasprintf() can return NULL on allocation failure, and the kernel code did not verify this before use, potentially leading to a denial of service. Multiple specific Linux kernel versions are affected. A patch is available to address this issue.

A vulnerability in the Linux kernel's AMD display driver (dcn35_clkmgr) could cause an array-index-out-of-bounds memory access. This issue arises from improper iteration over an array of dcn35 clocks, potentially leading to memory corruption. The flaw has been fixed by limiting the iteration to the array's actual size. The vulnerability affects multiple specific Linux kernel versions and has a CVSS score of 7.8. A patch is available to address this issue.

A vulnerability in the Linux kernel's interconnect driver for Qualcomm sc8180x SoCs was resolved. The issue involved the CO0 BCM component not being marked as keepalive, causing hardware like the UFS controller to lose connection to the SoC, resulting in platform hangs and extensive log spam. This flaw could lead to denial of service due to system hangs. The vulnerability is tracked as CVE-2024-26714 with a CVSS score of 5.5 (medium severity). Multiple affected Linux kernel versions prior to 6.5.0-1023.23~22.04.1 and specific older versions are impacted. A patch is available to mark the CO0 BCM as keepalive, preventing the disconnection and system hang.

A vulnerability in the Linux kernel's nouveau driver was addressed by offloading fence uevents work to a workqueue, resolving a deadlock between the fctx lock and the irq lock. This fix prevents a denial of service condition caused by the deadlock. The issue affects multiple versions of the linux-hwe-edge kernel prior to version 6.5.0-1023.23~22.04.1 and several specific older kernel builds. The vulnerability has a medium severity rating with a CVSS score of 5.5 and does not impact confidentiality or integrity but affects availability. A patch is available and should be applied to mitigate the issue.