CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57997 – wifi: wcn36xx: fix channel survey memory allocation size
https://notcve.org/view.php?id=CVE-2024-57997
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix channel survey memory allocation size KASAN reported a memory allocation issue in wcn->chan_survey due to incorrect size calculation. This commit uses kcalloc to allocate memory for wcn->chan_survey, ensuring proper initialization and preventing the use of uninitialized values when there are no frames on the channel. In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix channel survey memo... • https://git.kernel.org/stable/c/29696e0aa413b9d56558731aae3806d7cff48d36 •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57996 – net_sched: sch_sfq: don't allow 1 packet limit
https://notcve.org/view.php?id=CVE-2024-57996
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: don't allow 1 packet limit The current implementation does not work correctly with a limit of 1. iproute2 actually checks for this and this patch adds the check in kernel as well. This fixes the following syzkaller reported crash: UBSAN: array-index-out-of-bounds in net/sched/sch_sfq.c:210:6 index 65535 is out of range for type 'struct sfq_head[128]' CPU: 0 PID: 2569 Comm: syz-executor101 Not tainted 5.10.0-smp-DEV #1 Ha... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57995 – wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()
https://notcve.org/view.php?id=CVE-2024-57995
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio, it gets deleted from that radio through a call to ath12k_mac_unassign_link_vif(). This action frees the arvif pointer. Subsequently, there is a check involving arvif, which will result in a read-after-free scenario. Fix this by moving this check after arvif is again assigned via call to a... • https://git.kernel.org/stable/c/b5068bc9180d06a5ac242b0f9263047c14f86211 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57994 – ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple()
https://notcve.org/view.php?id=CVE-2024-57994
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() Jakub added a lockdep_assert_no_hardirq() check in __page_pool_put_page() to increase test coverage. syzbot found a splat caused by hard irq blocking in ptr_ring_resize_multiple() [1] As current users of ptr_ring_resize_multiple() do not require hard irqs being masked, replace it to only block BH. Rename helpers to better reflect they are safe against BH only. - ptr_ring_r... • https://git.kernel.org/stable/c/ff4e538c8c3e675a15e1e49509c55951832e0451 •
CVSS: 7.1EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57993 – HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
https://notcve.org/view.php?id=CVE-2024-57993
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue. [1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appsp... • https://git.kernel.org/stable/c/c49c33637802a2c6957a78119eb8be3b055dd9e9 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57988 – Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
https://notcve.org/view.php?id=CVE-2024-57988
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() devm_kstrdup() can return a NULL pointer on failure,but this returned value in btbcm_get_board_name() is not checked. Add NULL check in btbcm_get_board_name(), to handle kernel NULL pointer dereference error. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() devm_kstrdup() can return a NULL pointer on failu... • https://git.kernel.org/stable/c/f9183eaad91521ba1c04a19e5606ae61560a735e •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57987 – Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
https://notcve.org/view.php?id=CVE-2024-57987
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL point accessed. Add a null point check to avoid the Kernel Oops. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL point accessed.... • https://git.kernel.org/stable/c/b39910bb54d9ff696caaed4e83ae92a798cd8bf8 •
CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2024-57986 – HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
https://notcve.org/view.php?id=CVE-2024-57986
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated with Resolution Multipliers. One of the errors was fixed by commit ea427a222d8b ("HID: core: Fix deadloop in hid_apply_multiplier."), but the other has not been fixed. This error arises because hid_apply_multipler() assumes that every Resolution Multipli... • https://git.kernel.org/stable/c/5a4abb36f312cf83206b1b7d1308ba47cba0b3cc •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-57984 – i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
https://notcve.org/view.php?id=CVE-2024-57984
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition In dw_i3c_common_probe, &master->hj_work is bound with dw_i3c_hj_work. And dw_i3c_master_irq_handler can call dw_i3c_master_irq_handle_ibis function to start the work. If we remove the module which will call dw_i3c_common_remove to make cleanup, it will free master->base through i3c_master_unregister while the work mentioned above will be used. The sequence of operati... • https://git.kernel.org/stable/c/1dd728f5d4d4b8b53196c1e0fcf86bbaaee39cef • CWE-416: Use After Free •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57982 – xfrm: state: fix out-of-bounds read during lookup
https://notcve.org/view.php?id=CVE-2024-57982
27 Feb 2025 — In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array. rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask; While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_e... • https://git.kernel.org/stable/c/c2f672fc94642bae96821a393f342edcfa9794a6 •