CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57929 – dm array: fix releasing a faulty array block twice in dm_array_cursor_end
https://notcve.org/view.php?id=CVE-2024-57929
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty arra... • https://git.kernel.org/stable/c/fdd1315aa5f022fe6574efdc2d9535f75a0ee255 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57928 – netfs: Fix enomem handling in buffered reads
https://notcve.org/view.php?id=CVE-2024-57928
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecache() gets an error from either ->prepare_read() or from netfs_prepare_read_iterator(), it needs to decrement ->nr_outstanding, cancel the subrequest and break out of the issuing loop. Currently, it only does this for two of the cases, but there are two more that aren't handled. Fix this by moving the handling to a common place and jumping to it from all four places. This i... • https://git.kernel.org/stable/c/ee4cdf7ba857a894ad1650d6ab77669cbbfa329e •
CVSS: 8.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57927 – nfs: Fix oops in nfs_netfs_init_request() when copying to cache
https://notcve.org/view.php?id=CVE-2024-57927
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: nfs: Fix oops in nfs_netfs_init_request() when copying to cache When netfslib wants to copy some data that has just been read on behalf of nfs, it creates a new write request and calls nfs_netfs_init_request() to initialise it, but with a NULL file pointer. This causes nfs_file_open_context() to oops - however, we don't actually need the nfs context as we're only going to write to the cache. Fix this by just returning if we aren't given a f... • https://git.kernel.org/stable/c/ee4cdf7ba857a894ad1650d6ab77669cbbfa329e •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57926 – drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
https://notcve.org/view.php?id=CVE-2024-57926
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_bind, all private's drm are set as follows. private->all_drm_private[i]->drm = drm; And drm will be released by drm_dev_put in case mtk_drm_kms_init returns failure. However, the shutdown path still accesses the previous allocated memory in drm_atomic_he... • https://git.kernel.org/stable/c/1ef7ed48356cd5f9af2b7671956991b658d8c2ba •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2024-57925 – ksmbd: fix a missing return value check bug
https://notcve.org/view.php?id=CVE-2024-57925
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can lead to an illegal memory write of in_work->response_buf when allocate_interim_rsp_buf() attempts to perform a kzalloc() on it. To address this issue, incorporating a check for the return value of ksmbd_alloc_work_struct() ensures that the function retu... • https://git.kernel.org/stable/c/6f0207218c4c125f5bf32055ac4220b4ef3b7e67 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-57924 – fs: relax assertions on failure to encode file handles
https://notcve.org/view.php?id=CVE-2024-57924
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encod... • https://git.kernel.org/stable/c/f47c834a9131ae64bee3c462f4e610c67b0a000f •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57923 – btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path
https://notcve.org/view.php?id=CVE-2024-57923
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data length passed to zlib_compress_folios() can be arbitrary, always setting strm.avail_in to a multiple of PAGE_SIZE may cause read-in bytes to exceed the input range. Currently this triggers an assert in btrfs_compress_folios() on the debug kernel (see below). Fix strm.avail_in calculation for S390 hardware acceleration path. assertion failed: *total_in <= ... • https://git.kernel.org/stable/c/fd1e75d0105d2289e24b6d63cee49e6f7952c8bf •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-57922 – drm/amd/display: Add check for granularity in dml ceil/floor helpers
https://notcve.org/view.php?id=CVE-2024-57922
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert and divide-by-zero error in dcn_bw_ functions. [How] Add check for granularity 0. (cherry picked from commit f6e09701c3eb2ccb8cb0518e0b67f1c69742a4ec) In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granu... • https://git.kernel.org/stable/c/8a9315e6f7b2d94c65a1ba476481deddb20fc3ae •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57921 – drm/amdgpu: Add a lock when accessing the buddy trim function
https://notcve.org/view.php?id=CVE-2024-57921
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When running YouTube videos and Steam games simultaneously, the tester found a system hang / race condition issue with the multi-display configuration setting. Adding a lock to the buddy allocator's trim function would be the solution.
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-57919 – drm/amd/display: fix divide error in DM plane scale calcs
https://notcve.org/view.php?id=CVE-2024-57919
19 Jan 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix divide error in DM plane scale calcs dm_get_plane_scale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix by setting out-scale size as zero when the dst size is zero, similar to what is done by drm_calc_scale(). This issue started with the introduction of cursor ovelay mode that uses this function to assess cursor mode changes via dm_crtc_get_cursor_mode() b... • https://git.kernel.org/stable/c/1b04dcca4fb10dd3834893a60de74edd99f2bfaf •