CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42141 – Bluetooth: ISO: Check socket flag instead of hcon
https://notcve.org/view.php?id=CVE-2024-42141
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Check socket flag instead of hcon This fixes the following Smatch static checker warning: net/bluetooth/iso.c:1364 iso_sock_recvmsg() error: we previously assumed 'pi->conn->hcon' could be null (line 1359) net/bluetooth/iso.c 1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1348 size_t len, int flags) 1349 { 1350 struct sock *sk = sock->sk; 1351 struct iso_pinfo *pi = iso_pi(sk); 1352 1353 BT_DBG("sk %p", sk); 1354 1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 1356 lock_sock(sk); 1357 switch (sk->sk_state) { 1358 case BT_CONNECT2: 1359 if (pi->conn->hcon && ^^^^^^^^^^^^^^ If ->hcon is NULL 1360 test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) { 1361 iso_conn_big_sync(sk); 1362 sk->sk_state = BT_LISTEN; 1363 } else { --> 1364 iso_conn_defer_accept(pi->conn->hcon); ^^^^^^^^^^^^^^ then we're toast 1365 sk->sk_state = BT_CONFIG; 1366 } 1367 release_sock(sk); 1368 return 0; 1369 case BT_CONNECTED: 1370 if (test_bit(BT_SK_PA_SYNC, • https://git.kernel.org/stable/c/fbdc4bc47268953c80853489f696e02d61f9a2c6 https://git.kernel.org/stable/c/c03a10bd5b6ccb22921e04bcddc987410df7e7a9 https://git.kernel.org/stable/c/045669710464a21c67e690ef14698fd71857cb11 https://git.kernel.org/stable/c/33fabef489169c6db87843ef23351ed0d5e51ad8 https://git.kernel.org/stable/c/596b6f081336e77764ca35cfeab66d0fcdbe544e •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-42140 – riscv: kexec: Avoid deadlock in kexec crash path
https://notcve.org/view.php?id=CVE-2024-42140
In the Linux kernel, the following vulnerability has been resolved: riscv: kexec: Avoid deadlock in kexec crash path If the kexec crash code is called in the interrupt context, the machine_kexec_mask_interrupts() function will trigger a deadlock while trying to acquire the irqdesc spinlock and then deactivate irqchip in irq_set_irqchip_state() function. Unlike arm64, riscv only requires irq_eoi handler to complete EOI and keeping irq_set_irqchip_state() will only leave this possible deadlock without any use. So we simply remove it. • https://git.kernel.org/stable/c/12f237200c169a8667cf9dca7a40df8d7917b9fd https://git.kernel.org/stable/c/b17d19a5314a37f7197afd1a0200affd21a7227d https://git.kernel.org/stable/c/7594956fec8902dfc18150bf1dca0940cd4ad025 https://git.kernel.org/stable/c/bb80a7911218bbab2a69b5db7d2545643ab0073d https://git.kernel.org/stable/c/653deee48a4682ea17a05b96fb6842795ab5943c https://git.kernel.org/stable/c/7692c9b6baacdee378435f58f19baf0eb69e4155 https://git.kernel.org/stable/c/484dd545271d02d1571e1c6b62ea7df9dbe5e692 https://git.kernel.org/stable/c/c562ba719df570c986caf0941fea24491 •
CVSS: 4.4EPSS: 0%CPEs: 2EXPL: 0CVE-2024-42139 – ice: Fix improper extts handling
https://notcve.org/view.php?id=CVE-2024-42139
In the Linux kernel, the following vulnerability has been resolved: ice: Fix improper extts handling Extts events are disabled and enabled by the application ts2phc. However, in case where the driver is removed when the application is running, a specific extts event remains enabled and can cause a kernel crash. As a side effect, when the driver is reloaded and application is started again, remaining extts event for the channel from a previous run will keep firing and the message "extts on unexpected channel" might be printed to the user. To avoid that, extts events shall be disabled when PTP is released. • https://git.kernel.org/stable/c/172db5f91d5f7b91670c68a7547798b0b5374158 https://git.kernel.org/stable/c/9f69b31ae9e25dec27ad31fbc64dd99af16ee3d3 https://git.kernel.org/stable/c/00d3b4f54582d4e4a02cda5886bb336eeab268cc https://access.redhat.com/security/cve/CVE-2024-42139 https://bugzilla.redhat.com/show_bug.cgi?id=2301504 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2024-42138 – mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
https://notcve.org/view.php?id=CVE-2024-42138
In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occurred after mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which performs memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. • https://git.kernel.org/stable/c/b217127e5e4ee0ecfce7c5f84cfe082238123bda https://git.kernel.org/stable/c/ab557f5cd993a3201b09593633d04b891263d5c0 https://git.kernel.org/stable/c/f8b55a465b0e8a500179808166fe9420f5c091a1 https://git.kernel.org/stable/c/9af7437669b72f804fc4269f487528dbbed142a2 https://git.kernel.org/stable/c/8ce34dccbe8fa7d2ef86f2d8e7db2a9b67cabfc3 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-42137 – Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
https://notcve.org/view.php?id=CVE-2024-42137
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed serdev") will cause below regression issue: BT can't be enabled after below steps: cold boot -> enable BT -> disable BT -> warm reboot -> BT enable failure if property enable-gpios is not configured within DT|ACPI for QCA6390. The commit is to fix a use-after-free issue within qca_serdev_shutdown() by adding condition to avoid the serdev is flushed or wrote after closed but also introduces this regression issue regarding above steps since the VSC is not sent to reset controller during warm reboot. Fixed by sending the VSC to reset controller within qca_serdev_shutdown() once BT was ever enabled, and the use-after-free issue is also fixed by this change since the serdev is still opened before it is flushed or wrote. Verified by the reported machine Dell XPS 13 9310 laptop over below two kernel commits: commit e00fc2700a3f ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of bluetooth-next tree. commit b23d98d46d28 ("Bluetooth: btusb: Fix triggering coredump implementation for QCA") of linus mainline tree. • https://git.kernel.org/stable/c/e84ec6e25df9bb0968599e92eacedaf3a0a5b587 https://git.kernel.org/stable/c/908d1742b6e694e84ead5c62e4b7c1bfbb8b46a3 https://git.kernel.org/stable/c/ea3ebda47dd56f6e1c62f2e0e1b6e1b0a973e447 https://git.kernel.org/stable/c/272970be3dabd24cbe50e393ffee8f04aec3b9a8 https://git.kernel.org/stable/c/215a26c2404fa34625c725d446967fa328a703eb https://git.kernel.org/stable/c/4ca6013cd18e58ac1044908c40d4006a92093a11 https://git.kernel.org/stable/c/e6e200b264271f62a3fadb51ada9423015ece37b https://git.kernel.org/stable/c/e2d8aa4c763593704ac21e7591aed4f13 •