CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57938 – net/sctp: Prevent autoclose integer overflow in sctp_association_init()
https://notcve.org/view.php?id=CVE-2024-57938
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow. In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX... • https://git.kernel.org/stable/c/9f70f46bd4c7267d48ef461a1d613ec9ec0d520c •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57933 – gve: guard XSK operations on the existence of queues
https://notcve.org/view.php?id=CVE-2024-57933
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disabling or enabling XSK pools would result in a crash, as the RX queue pointer would be NULL. XSK pool registration will occur as part of the next interface up. Similarly, xsk_wakeup needs be guarded against queues disappearing while the function is executing... • https://git.kernel.org/stable/c/fd8e40321a12391e6f554cc637d0c4b6109682a9 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57932 – gve: guard XDP xmit NDO on existence of xdp queues
https://notcve.org/view.php?id=CVE-2024-57932
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should return early if either of these conditions are false. In the case of no loaded XDP program, priv->num_xdp_queues=0 which can cause a divide-by-zero error, and in the case of interface down, num_xdp_queues remains untouched to persist XDP queue count for... • https://git.kernel.org/stable/c/39a7f4aa3e4a7947614cf1d5c27abba3300adb1e •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57931 – selinux: ignore unknown extended permissions
https://notcve.org/view.php?id=CVE-2024-57931
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This co... • https://git.kernel.org/stable/c/fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57930 – tracing: Have process_string() also allow arrays
https://notcve.org/view.php?id=CVE-2024-57930
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a common bug where a TRACE_EVENT() TP_fast_assign() assigns an address of an allocated string to the ring buffer and then references it in TP_printk(), which can be executed hours later when the string is free, the function test_event_printk() runs on all events as they are registered to make sure there's no unwanted dereferencing. It calls process_string() to handle cases i... • https://git.kernel.org/stable/c/f3ff759ec636b4094b8eb2c3801e4e6c97a6b712 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21655 – io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
https://notcve.org/view.php?id=CVE-2025-21655
20 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eventfd_free() directly if the refcount drops to zero. This isn't correct, as any potential freeing of the io_ev_fd should be deferred another RCU grace period. Just call io_eventfd_put() rather than open-code the dec-and-test and free, which will correctl... • https://git.kernel.org/stable/c/21a091b970cdbcf3e8ff829234b51be6f9192766 •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-57929 – dm array: fix releasing a faulty array block twice in dm_array_cursor_end
https://notcve.org/view.php?id=CVE-2024-57929
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty arra... • https://git.kernel.org/stable/c/fdd1315aa5f022fe6574efdc2d9535f75a0ee255 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57926 – drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
https://notcve.org/view.php?id=CVE-2024-57926
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_bind, all private's drm are set as follows. private->all_drm_private[i]->drm = drm; And drm will be released by drm_dev_put in case mtk_drm_kms_init returns failure. However, the shutdown path still accesses the previous allocated memory in drm_atomic_he... • https://git.kernel.org/stable/c/1ef7ed48356cd5f9af2b7671956991b658d8c2ba •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57925 – ksmbd: fix a missing return value check bug
https://notcve.org/view.php?id=CVE-2024-57925
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can lead to an illegal memory write of in_work->response_buf when allocate_interim_rsp_buf() attempts to perform a kzalloc() on it. To address this issue, incorporating a check for the return value of ksmbd_alloc_work_struct() ensures that the function retu... • https://git.kernel.org/stable/c/f8cf1ebb7de62c7d807707ce4abb69d483629263 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57924 – fs: relax assertions on failure to encode file handles
https://notcve.org/view.php?id=CVE-2024-57924
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encod... • https://git.kernel.org/stable/c/adcde2872f8fc399b249758ae1990dcd53b694ea •