CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-26899 – block: fix deadlock between bd_link_disk_holder and partition scan
https://notcve.org/view.php?id=CVE-2024-26899
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bd_link_disk_holder and partition scan 'open_mutex' of gendisk is used to protect open/close block devices. But in bd_link_disk_holder(), it is used to protect the creation of symlink between holding disk and slave bdev, which introduces some issues. When bd_link_disk_holder() is called, the driver is usually in the process of initialization/modification and may suspend submitting io. At this time, any io hold 'o... • https://git.kernel.org/stable/c/1b0a2d950ee2a54aa04fb31ead32144be0bbf690 • CWE-667: Improper Locking CWE-833: Deadlock •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2024-26898 – aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
https://notcve.org/view.php?id=CVE-2024-26898
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a deni... • https://git.kernel.org/stable/c/7562f876cd93800f2f8c89445f2a563590b24e09 • CWE-416: Use After Free •
CVSS: 4.6EPSS: 0%CPEs: 8EXPL: 0CVE-2024-26897 – wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
https://notcve.org/view.php?id=CVE-2024-26897
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by the time it runs. However, because of the order in which things are initialised, this is not guaranteed to be the case, because the device is exposed to the USB subsystem before the ath9k driver initialisation is completed. We already committed a partia... • https://git.kernel.org/stable/c/78c8397132dd4735ac6a7b5a651302f0b9f264ad • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26896 – wifi: wfx: fix memory leak when starting AP
https://notcve.org/view.php?id=CVE-2024-26896
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: fix memory leak when starting AP Kmemleak reported this error: unreferenced object 0xd73d1180 (size 184): comm "wpa_supplicant", pid 1559, jiffies 13006305 (age 964.245s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 1e 00 01 00 00 00 00 00 ................ backtrace: [<5ca11420>] kmem_cache_alloc+0x20c/0x5ac [<127bdd74>] __alloc_skb+0x144/0x170 [
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-26895 – wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
https://notcve.org/view.php?id=CVE-2024-26895
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilc_netdev_cleanup currently triggers a KASAN warning, which can be observed on interface registration error path, or simply by removing the module/unbinding device from driver: echo spi0.1 > /sys/bus/spi/drivers/wilc1000_spi/unbind ================================================================== BUG: KASAN: slab-use-after-free in wilc_netdev_cleanup+0x508/0x5c... • https://git.kernel.org/stable/c/8399918f3056e1033f0f4c08eab437fb38d6f22d •
CVSS: 6.0EPSS: 0%CPEs: 9EXPL: 0CVE-2024-26894 – ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
https://notcve.org/view.php?id=CVE-2024-26894
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak: unreferenced object 0xffff896282f6c000 (size 1024): comm "swapper/0", pid 1, jiffies 4294893170 hex dump (first 32 bytes): 00 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (... • https://git.kernel.org/stable/c/3d339dcbb56d8d70c1b959aff87d74adc3a84eea • CWE-401: Missing Release of Memory after Effective Lifetime CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26893 – firmware: arm_scmi: Fix double free in SMC transport cleanup path
https://notcve.org/view.php?id=CVE-2024-26893
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chan_free callback function, defined by each transport. Since multiple protocols might share the same transport_info member, chan_free() might want to clean up the same member multiple times within the given SCMI transport implementation. In this case, it is SMC transport. This will lead to a NULL pointer dereferen... • https://git.kernel.org/stable/c/1dc6558062dadfabd2fb3bd885fa6e92ec7196f2 •
CVSS: 4.4EPSS: 0%CPEs: 6EXPL: 0CVE-2024-26892 – wifi: mt76: mt7921e: fix use-after-free in free_irq()
https://notcve.org/view.php?id=CVE-2024-26892
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the unexpected event after deregistration. For this case, let's apply MT76_REMOVED flag to indicate the device was removed and do not run into the resource access anymore. BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e] Read of size 8 ... • https://git.kernel.org/stable/c/9270270d62191b7549296721e8d5f3dc0df01563 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-26891 – iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
https://notcve.org/view.php?id=CVE-2024-26891
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the device by flapping device's link through setting the slot's link control register, as pciehp_ist() DLLSC interrupt sequence response, pciehp will unload the device driver and then power it off. thus cause an IOMMU device-TLB invalidation (Intel VT-d spec, ... • https://git.kernel.org/stable/c/6f7db75e1c469057fe7588ed959328ead771ccc7 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-26890 – Bluetooth: btrtl: fix out of bounds memory access
https://notcve.org/view.php?id=CVE-2024-26890
17 Apr 2024 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: fix out of bounds memory access The problem is detected by KASAN. btrtl driver uses private hci data to store 'struct btrealtek_data'. If btrtl driver is used with btusb, then memory for private hci data is allocated in btusb. But no private data is allocated after hci_dev, when btrtl is used with hci_h5. This commit adds memory allocation for hci_h5 case. ================================================================== ... • https://git.kernel.org/stable/c/5b355944b19011011dd3fd4187444c5ff1d76ad2 • CWE-125: Out-of-bounds Read •