CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-26918 – PCI: Fix active state requirement in PME polling
https://notcve.org/view.php?id=CVE-2024-26918
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix active state requirement in PME polling The commit noted in fixes added a bogus requirement that runtime PM managed devices need to be in the RPM_ACTIVE state for PME polling. In fact, only devices in low power states should be polled. However there's still a requirement that the device config space must be accessible, which has implications for both the current state of the polled device and the parent bridge, when present. It's not sufficient to assume the bridge remains in D0 and cases have been observed where the bridge passes the D0 test, but the PM state indicates RPM_SUSPENDING and config space of the polled device becomes inaccessible during pci_pme_wakeup(). Therefore, since the bridge is already effectively required to be in the RPM_ACTIVE state, formalize this in the code and elevate the PM usage count to maintain the state while polling the subordinate device. This resolves a regression reported in the bugzilla below where a Thunderbolt/USB4 hierarchy fails to scan for an attached NVMe endpoint downstream of a bridge in a D3hot power state. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: PCI: corrige el requisito de estado activo en el sondeo de PME. La confirmación observada en las correcciones agregó un requisito falso de que los dispositivos administrados por PM en tiempo de ejecución deben estar en el estado RPM_ACTIVE para el sondeo de PME. • https://git.kernel.org/stable/c/d3fcd7360338358aa0036bec6d2cf0e37a0ca624 https://git.kernel.org/stable/c/63b1a3d9dd3b3f6d67f524e76270e66767090583 https://git.kernel.org/stable/c/a4f12e5cbac2865c151d1e97e36eb24205afb23b https://git.kernel.org/stable/c/41044d5360685e78a869d40a168491a70cdb7e73 •
CVSS: -EPSS: 0%CPEs: 11EXPL: 0CVE-2024-26917 – scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock"
https://notcve.org/view.php?id=CVE-2024-26917
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" This reverts commit 1a1975551943f681772720f639ff42fbaa746212. This commit causes interrupts to be lost for FCoE devices, since it changed sping locks from "bh" to "irqsave". Instead, a work queue should be used, and will be addressed in a separate commit. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: scsi: Revertir "scsi: fcoe: Reparar posible punto muerto en &fip->ctlr_lock" Esto revierte el commit 1a1975551943f681772720f639ff42fbaa746212. Este commit provoca que se pierdan las interrupciones para los dispositivos FCoE, ya que cambió los bloqueos de sping de "bh" a "irqsave". En su lugar, se debe utilizar una cola de trabajo, que se abordará en un commit separado. • https://git.kernel.org/stable/c/264eae2f523d2aae38188facb4ece893023f25da https://git.kernel.org/stable/c/d2bf25674cea74b865d367d09be5dfe9aff5922a https://git.kernel.org/stable/c/9cce8ef7a6fa858bbcacd8679a5ca5a4fd3a6df3 https://git.kernel.org/stable/c/076fb40cf27ab9232d8cce1f007e663e46705302 https://git.kernel.org/stable/c/5a5fb3b1754fa2b4db95f0151b4af0fb6f8918ec https://git.kernel.org/stable/c/1a1975551943f681772720f639ff42fbaa746212 https://git.kernel.org/stable/c/4ea46b479a00dd232f0dbc81fdc27f9330ecb3ad https://git.kernel.org/stable/c/694ddc5bf35a5b6f9acb6e4724324c910 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26916 – Revert "drm/amd: flush any delayed gfxoff on suspend entry"
https://notcve.org/view.php?id=CVE-2024-26916
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd: flush any delayed gfxoff on suspend entry" commit ab4750332dbe ("drm/amdgpu/sdma5.2: add begin/end_use ring callbacks") caused GFXOFF control to be used more heavily and the codepath that was removed from commit 0dee72639533 ("drm/amd: flush any delayed gfxoff on suspend entry") now can be exercised at suspend again. Users report that by using GNOME to suspend the lockscreen trigger will cause SDMA traffic and the system can deadlock. This reverts commit 0dee726395333fea833eaaf838bc80962df886c8. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: Revertir "drm/amd: eliminar cualquier gfxoff retrasado al suspender la entrada" commit ab4750332dbe ("drm/amdgpu/sdma5.2: agregar devoluciones de llamada de anillo de inicio/fin de uso") provocó que el control de GFXOFF se utilizará más intensamente y la ruta de código que se eliminó del commit 0dee72639533 ("drm/amd: eliminar cualquier gfxoff retrasado al suspender la entrada") ahora se puede ejercer nuevamente en suspensión. Los usuarios informan que al usar GNOME para suspender el activador de la pantalla de bloqueo provocará tráfico SDMA y el sistema puede bloquearse. Esto revierte el commit 0dee726395333fea833eaaf838bc80962df886c8. • https://git.kernel.org/stable/c/f94942885e8416ce9de84d8fae93684002682b5d https://git.kernel.org/stable/c/78b2ba39beef21c8baebb1868569c2026ad76de0 https://git.kernel.org/stable/c/3aae4ef4d799fb3d0381157640fdb251008cf0ae https://git.kernel.org/stable/c/ab4750332dbe535243def5dcebc24ca00c1f98ac https://git.kernel.org/stable/c/65158edb0a3a8df23197d52cd24287e39eaf95d6 https://git.kernel.org/stable/c/ff70e6ff6fc2413caf33410af7462d1f584d927e https://git.kernel.org/stable/c/caa2565a2e13899be31f7b1e069e6465d3e2adb0 https://git.kernel.org/stable/c/d855ceb6a5fde668c5431156bc60fae0c •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-26915 – drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
https://notcve.org/view.php?id=CVE-2024-26915
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Allows us to detect subsequent IH ring buffer overflows as well. En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amdgpu: Restablecer el bit IH OVERFLOW_CLEAR También nos permite detectar desbordamientos posteriores del búfer en anillo IH. A flaw was found in the Linux kernel. The IH OVERFLOW_CLEAR bit was not reset. • https://git.kernel.org/stable/c/9a9d00c23d170d4ef5a1b28e6b69f5c85dd12bc1 https://git.kernel.org/stable/c/a28f4d1e0bed85943d309ac243fd1c200f8af9a2 https://git.kernel.org/stable/c/8983397951b4b0bd51bb4b4ba9749424e1ccbb70 https://git.kernel.org/stable/c/2827633c9dab6304ec4cdbf369363219832e605d https://git.kernel.org/stable/c/7330256268664ea0a7dd5b07a3fed363093477dd https://access.redhat.com/security/cve/CVE-2024-26915 https://bugzilla.redhat.com/show_bug.cgi?id=2275790 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2024-26914 – drm/amd/display: fix incorrect mpc_combine array size
https://notcve.org/view.php?id=CVE-2024-26914
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix incorrect mpc_combine array size [why] MAX_SURFACES is per stream, while MAX_PLANES is per asic. The mpc_combine is an array that records all the planes per asic. Therefore MAX_PLANES should be used as the array size. Using MAX_SURFACES causes array overflow when there are more than 3 planes. [how] Use the MAX_PLANES for the mpc_combine array size. En el kernel de Linux, se resolvió la siguiente vulnerabilidad: drm/amd/display: corrige el tamaño incorrecto de la matriz mpc_combine [por qué] MAX_SURFACES es por flujo, mientras que MAX_PLANES es por asic. mpc_combine es una matriz que registra todos los planos por asic. • https://git.kernel.org/stable/c/0bd8ef618a42d7e6ea3f701065264e15678025e3 https://git.kernel.org/stable/c/39079fe8e660851abbafa90cd55cbf029210661f •