CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57948 – mac802154: check local interfaces before deleting sdata list
https://notcve.org/view.php?id=CVE-2024-57948
31 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system. CPU0 CPU1 ==== ==== genl_family_rcv_msg_doit ieee802154_unregister_hw ieee802154_del_iface ieee802154_remove_interfaces rdev_del_virtual_intf_deprecated list_del(&sdata->list) ieee802154_if_remove list_del_rcu... • https://git.kernel.org/stable/c/0d11dc30edfc4acef0acef130bb5ca596317190a •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57947 – netfilter: nf_set_pipapo: fix initial map fill
https://notcve.org/view.php?id=CVE-2024-57947
23 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo: fix initial map fill The initial buffer has to be inited to all-ones, but it must restrict it to the size of the first field, not the total field size. After each round in the map search step, the result and the fill map are swapped, so if we have a set where f->bsize of the first element is smaller than m->bsize_max, those one-bits are leaked into future rounds result map. This makes pipapo find an incorrect match... • https://git.kernel.org/stable/c/3c4287f62044a90e73a561aa05fc46e62da173da •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57946 – virtio-blk: don't keep queue frozen during system suspend
https://notcve.org/view.php?id=CVE-2024-57946
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before deleting vqs.") replaces queue quiesce with queue freeze in virtio-blk's PM callbacks. And the motivation is to drain inflight IOs before suspending. block layer's queue freeze looks very handy, but it is also easy to cause deadlock, such as, any attempt to call into bio_queue_enter() may run into deadlock if t... • https://git.kernel.org/stable/c/d738f3215bb4f88911ff4579780a44960c8e0ca5 •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2025-21664 – dm thin: make get_first_thin use rcu-safe list first function
https://notcve.org/view.php?id=CVE-2025-21664
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty() -> list_first() sequence in RCU safe code. This is because each of these functions performs its own READ_ONCE() of the list head. This can lead to a situation where the list_empty() sees a valid list entry, but the subsequent list_first() sees a diffe... • https://git.kernel.org/stable/c/b10ebd34cccae1b431caf1be54919aede2be7cbe •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21656 – hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
https://notcve.org/view.php?id=CVE-2025-21656
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error codes. Currently the driver just passes error codes of scsi_execute_cmd() to hwmon core, which is incorrect because hwmon only checks for negative error codes. This leads to hwmon reporting uninitialized data to userspace in case of SCSI errors (for example... • https://git.kernel.org/stable/c/5b46903d8bf372e563bf2150d46b87fff197a109 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-57940 – exfat: fix the infinite loop in exfat_readdir()
https://notcve.org/view.php?id=CVE-2024-57940
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the... • https://git.kernel.org/stable/c/ca06197382bde0a3bc20215595d1c9ce20c6e341 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-57939 – riscv: Fix sleeping in invalid context in die()
https://notcve.org/view.php?id=CVE-2024-57939
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. That causes the following warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 285, name: mutex preempt_count: 110001, expected: 0 RCU nest depth: 0, expect... • https://git.kernel.org/stable/c/76d2a0493a17d4c8ecc781366850c3c4f8e1a446 •
CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57938 – net/sctp: Prevent autoclose integer overflow in sctp_association_init()
https://notcve.org/view.php?id=CVE-2024-57938
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in sctp_association_init() that can consequently trigger overflow. In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX... • https://git.kernel.org/stable/c/9f70f46bd4c7267d48ef461a1d613ec9ec0d520c •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57931 – selinux: ignore unknown extended permissions
https://notcve.org/view.php?id=CVE-2024-57931
21 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels. In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This co... • https://git.kernel.org/stable/c/fa1aa143ac4a682c7f5fd52a3cf05f5a6fe44a0a •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2023-52923 – netfilter: nf_tables: adapt set backend to use GC transaction API
https://notcve.org/view.php?id=CVE-2023-52923
20 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _... • https://git.kernel.org/stable/c/9d0982927e79049675cb6c6c04a0ebb3dad5a434 •