[Git][security-tracker-team/security-tracker][master] Merge Linux CVEs from kernel-sec
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jul 12 20:13:48 BST 2024
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
e11c052f by Salvatore Bonaccorso at 2024-07-12T21:13:10+02:00
Merge Linux CVEs from kernel-sec
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,456 @@
+CVE-2024-41006 [netrom: Fix a memory leak in nr_heartbeat_expiry()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/0b9130247f3b6a1122478471ff0e014ea96bb735 (6.10-rc5)
+CVE-2024-41005 [netpoll: Fix race condition in netpoll_owner_active]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/c2e6a872bde9912f1a7579639c5ca3adf1003916 (6.10-rc1)
+CVE-2024-41004 [tracing: Build event generation tests only as modules]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/3572bd5689b0812b161b40279e39ca5b66d73e88 (6.10-rc5)
+CVE-2024-41003 [bpf: Fix reg_set_min_max corruption of fake_reg]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/92424801261d1564a0bb759da3cf3ccd69fdf5a2 (6.10-rc5)
+CVE-2024-41002 [crypto: hisilicon/sec - Fix memory leak for sec resource release]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/bba4250757b4ae1680fea435a358d8093f254094 (6.10-rc1)
+CVE-2024-41001 [io_uring/sqpoll: work around a potential audit memory leak]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/c4ce0ab27646f4206a9eb502d6fe45cb080e1cae (6.10-rc1)
+CVE-2024-41000 [block/ioctl: prefer different overflow check]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ccb326b5f9e623eb7f130fbbf2505ec0e2dcaff9 (6.10-rc1)
+CVE-2024-40999 [net: ena: Add validation for completion descriptors consistency]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b37b98a3a0c1198bafe8c2d9ce0bc845b4e7a9a7 (6.10-rc1)
+CVE-2024-40998 [ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b4b4fda34e535756f9e774fb2d09c4537b7dfd1c (6.10-rc1)
+CVE-2024-40997 [cpufreq: amd-pstate: fix memory leak on CPU EPP exit]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/cea04f3d9aeebda9d9c063c0dfa71e739c322c81 (6.10-rc1)
+CVE-2024-40996 [bpf: Avoid splat in pskb_pull_reason]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2bbe3e5a2f4ef69d13be54f1cf895b4658287080 (6.10-rc5)
+CVE-2024-40995 [net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/d864319871b05fadd153e0aede4811ca7008f5d6 (6.10-rc5)
+CVE-2024-40994 [ptp: fix integer overflow in max_vclocks_store]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/81d23d2a24012e448f651e007fac2cfd20a45ce0 (6.10-rc5)
+CVE-2024-40993 [netfilter: ipset: Fix suspicious rcu_dereference_protected()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/8ecd06277a7664f4ef018abae3abd3451d64e7a6 (6.10-rc5)
+CVE-2024-40992 [RDMA/rxe: Fix responder length checking for UD request packets]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/f67ac0061c7614c1548963d3ef1ee1606efd8636 (6.10-rc5)
+CVE-2024-40991 [dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/ba27e9d2207784da748b19170a2e56bd7770bd81 (6.10-rc5)
+CVE-2024-40990 [RDMA/mlx5: Add check for srq max_sge attribute]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/36ab7ada64caf08f10ee5a114d39964d1f91e81d (6.10-rc5)
+CVE-2024-40989 [KVM: arm64: Disassociate vcpus from redistributor region on teardown]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8 (6.10-rc5)
+CVE-2024-40988 [drm/radeon: fix UBSAN warning in kv_dpm.c]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/a498df5421fd737d11bfd152428ba6b1c8538321 (6.10-rc5)
+CVE-2024-40987 [drm/amdgpu: fix UBSAN warning in kv_dpm.c]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/f0d576f840153392d04b2d52cf3adab8f62e8cb6 (6.10-rc5)
+CVE-2024-40986 [dmaengine: xilinx: xdma: Fix data synchronisation in xdma_channel_isr()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/462237d2d93fc9e9221d1cf9f773954d27da83c0 (6.10-rc5)
+CVE-2024-40985 [net/tcp_ao: Don't leak ao_info on error-path]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/f9ae848904289ddb16c7c9e4553ed4c64300de49 (6.10-rc5)
+CVE-2024-40984 [ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine."]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/a83e1385b780d41307433ddbc86e3c528db031f0 (6.10-rc5)
+CVE-2024-40983 [tipc: force a dst refcount before doing decryption]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/2ebe8f840c7450ecbfca9d18ac92e9ce9155e269 (6.10-rc5)
+CVE-2024-40982 [ssb: Fix potential NULL pointer dereference in ssb_device_uevent()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/789c17185fb0f39560496c2beab9b57ce1d0cbe7 (6.10-rc1)
+CVE-2024-40981 [batman-adv: bypass empty buckets in batadv_purge_orig_ref()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/40dc8ab605894acae1473e434944924a22cfaaa0 (6.10-rc1)
+CVE-2024-40980 [drop_monitor: replace spin_lock by raw_spin_lock]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/f1e197a665c2148ebc25fe09c53689e60afea195 (6.10-rc1)
+CVE-2024-40979 [wifi: ath12k: fix kernel crash during resume]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/303c017821d88ebad887814114d4e5966d320b28 (6.10-rc1)
+CVE-2024-40978 [scsi: qedi: Fix crash while reading debugfs attribute]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/28027ec8e32ecbadcd67623edb290dad61e735b5 (6.10-rc1)
+CVE-2024-40977 [wifi: mt76: mt7921s: fix potential hung tasks during chip recovery]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ecf0b2b8a37c8464186620bef37812a117ff6366 (6.10-rc1)
+CVE-2024-40976 [drm/lima: mask irqs in timeout path before hard reset]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/a421cc7a6a001b70415aa4f66024fa6178885a14 (6.10-rc1)
+CVE-2024-40975 [platform/x86: x86-android-tablets: Unregister devices in reverse order]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/3de0f2627ef849735f155c1818247f58404dddfe (6.10-rc1)
+CVE-2024-40974 [powerpc/pseries: Enforce hcall result buffer validity and size]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ff2e185cf73df480ec69675936c4ee75a445c3e4 (6.10-rc1)
+CVE-2024-40973 [media: mtk-vcodec: potential null pointer deference in SCP]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/53dbe08504442dc7ba4865c09b3bbf5fe849681b (6.10-rc1)
+CVE-2024-40972 [ext4: do not create EA inode under buffer lock]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/0a46ef234756dca04623b7591e8ebb3440622f0b (6.10-rc1)
+CVE-2024-40971 [f2fs: remove clear SB_INLINECRYPT flag in default_options]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ac5eecf481c29942eb9a862e758c0c8b68090c33 (6.10-rc1)
+CVE-2024-40970 [Avoid hw_desc array overrun in dw-axi-dmac]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/333e11bf47fa8d477db90e2900b1ed3c9ae9b697 (6.10-rc1)
+CVE-2024-40969 [f2fs: don't set RO when shutting down f2fs]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/3bdb7f161697e2d5123b89fe1778ef17a44858e7 (6.10-rc1)
+CVE-2024-40968 [MIPS: Octeon: Add PCIe link status check]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/29b83a64df3b42c88c0338696feb6fdcd7f1f3b7 (6.10-rc1)
+CVE-2024-40967 [serial: imx: Introduce timeout when waiting on transmitter empty]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/e533e4c62e9993e62e947ae9bbec34e4c7ae81c2 (6.10-rc1)
+CVE-2024-40966 [tty: add the option to have a tty reject a new ldisc]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/6bd23e0c2bb6c65d4f5754d1456bc9a4427fc59b (6.10-rc1)
+CVE-2024-40965 [i2c: lpi2c: Avoid calling clk_get_rate during transfer]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/4268254a39484fc11ba991ae148bacbe75d9cc0a (6.10-rc1)
+CVE-2024-40964 [ALSA: hda: cs35l41: Possible null pointer dereference in cs35l41_hda_unbind()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6386682cdc8b41319c92fbbe421953e33a28840c (6.10-rc5)
+CVE-2024-40963 [mips: bmips: BCM6358: make sure CBR is correctly set]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ce5cdd3b05216b704a704f466fb4c2dff3778caf (6.10-rc5)
+CVE-2024-40962 [btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/cebae292e0c32a228e8f2219c270a7237be24a6a (6.10-rc5)
+CVE-2024-40961 [ipv6: prevent possible NULL deref in fib6_nh_init()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/2eab4543a2204092c3a7af81d7d6c506e59a03a6 (6.10-rc5)
+CVE-2024-40960 [ipv6: prevent possible NULL dereference in rt6_probe()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b86762dbe19a62e785c189f313cda5b989931f37 (6.10-rc5)
+CVE-2024-40959 [xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/d46401052c2d5614da8efea5788532f0401cb164 (6.10-rc5)
+CVE-2024-40958 [netns: Make get_net_ns() handle zero refcount net]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ff960f9d3edbe08a736b5a224d91a305ccc946b0 (6.10-rc5)
+CVE-2024-40957 [seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779 (6.10-rc5)
+CVE-2024-40956 [dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e3215deca4520773cd2b155bed164c12365149a7 (6.10-rc5)
+CVE-2024-40955 [ext4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/13df4d44a3aaabe61cd01d277b6ee23ead2a5206 (6.10-rc1)
+CVE-2024-40954 [net: do not leave a dangling sk pointer, when socket creation fails]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 (6.10-rc5)
+CVE-2024-40953 [KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/49f683b41f28918df3e51ddc0d928cb2e934ccdb (6.10-rc5)
+CVE-2024-40952 [ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/58f7e1e2c9e72c7974054c64c3abeac81c11f822 (6.10-rc5)
+CVE-2024-40951 [ocfs2: fix NULL pointer dereference in ocfs2_abort_trigger()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/685d03c3795378fca6a1b3d43581f7f1a3fc095f (6.10-rc5)
+CVE-2024-40950 [mm: huge_memory: fix misused mapping_large_folio_support() for anon folios]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6a50c9b512f7734bc356f4bd47885a6f7c98491a (6.10-rc5)
+CVE-2024-40949 [mm: shmem: fix getting incorrect lruvec when replacing a shmem folio]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/9094b4a1c76cfe84b906cc152bab34d4ba26fa5c (6.10-rc5)
+CVE-2024-40948 [mm/page_table_check: fix crash on ZONE_DEVICE]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/8bb592c2eca8fd2bc06db7d80b38da18da4a2f43 (6.10-rc5)
+CVE-2024-40947 [ima: Avoid blocking in RCU read-side critical section]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/9a95c5bfbf02a0a7f5983280fe284a0ff0836c34 (6.10-rc5)
+CVE-2024-40946 [hid: asus: asus_report_fixup: fix potential read out of bounds]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/89e1ee118d6f0ee6bd6e80d8fe08839875daa241 (6.10-rc3)
+CVE-2024-40945 [iommu: Return right value in iommu_sva_bind_device()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/89e8a2366e3bce584b6c01549d5019c5cda1205e (6.10-rc3)
+CVE-2024-40944 [x86/kexec: Fix bug with call depth tracking]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/93c1800b3799f17375989b0daf76497dd3e80922 (6.10-rc3)
+CVE-2024-40943 [ocfs2: fix races between hole punching and AIO+DIO]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/952b023f06a24b2ad6ba67304c4c84d45bea2f18 (6.10-rc1)
+CVE-2024-40942 [wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b7d7f11a291830fdf69d3301075dd0fb347ced84 (6.10-rc3)
+CVE-2024-40941 [wifi: iwlwifi: mvm: don't read past the mfuart notifcation]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/4bb95f4535489ed830cf9b34b0a891e384d1aee4 (6.10-rc3)
+CVE-2024-40940 [net/mlx5: Fix tainted pointer delete is case of flow rules creation fail]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/229bedbf62b13af5aba6525ad10b62ad38d9ccb5 (6.10-rc3)
+CVE-2024-40939 [net: wwan: iosm: Fix tainted pointer delete is case of region creation fail]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b0c9a26435413b81799047a7be53255640432547 (6.10-rc3)
+CVE-2024-40938 [landlock: Fix d_parent walk]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/88da52ccd66e65f2e63a6c35c9dff55d448ef4dc (6.10-rc2)
+CVE-2024-40937 [gve: Clear napi->skb before dev_kfree_skb_any()]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e (6.10-rc4)
+CVE-2024-40936 [cxl/region: Fix memregion leaks in devm_cxl_add_region()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/49ba7b515c4c0719b866d16f068e62d16a8a3dd1 (6.10-rc3)
+CVE-2024-40935 [cachefiles: flush all requests after setting CACHEFILES_DEAD]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/85e833cd7243bda7285492b0653c3abb1e2e757b (6.10-rc4)
+CVE-2024-40934 [HID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/ce3af2ee95170b7d9e15fff6e500d67deab1e7b3 (6.10-rc3)
+CVE-2024-40933 [iio: temperature: mlx90635: Fix ERR_PTR dereference in mlx90635_probe()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a23c14b062d8800a2192077d83273bbfe6c7552d (6.10-rc4)
+CVE-2024-40932 [drm/exynos/vidi: fix memory leak in .get_modes()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/38e3825631b1f314b21e3ade00b5a4d737eb054e (6.10-rc4)
+CVE-2024-40931 [mptcp: ensure snd_una is properly initialized on connect]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3 (6.10-rc4)
+CVE-2024-40930 [wifi: cfg80211: validate HE operation element parsing]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4dc3a3893dae5a7f73e5809273aca0f1f3548d55 (6.10-rc3)
+CVE-2024-40929 [wifi: iwlwifi: mvm: check n_ssids before accessing the ssids]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/60d62757df30b74bf397a2847a6db7385c6ee281 (6.10-rc3)
+CVE-2024-40928 [net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0dcc53abf58d572d34c5313de85f607cd33fc691 (6.10-rc3)
+CVE-2024-40927 [xhci: Handle TD clearing for multiple streams case]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/5ceac4402f5d975e5a01c806438eb4e554771577 (6.10-rc4)
+CVE-2024-40926 [drm/nouveau: don't attempt to schedule hpd_work on headless cards]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/b96a225377b6602299a03d2ce3c289b68cd41bb7 (6.10-rc4)
+CVE-2024-40925 [block: fix request.queuelist usage in flush]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/d0321c812d89c5910d8da8e4b10c891c6b96ff70 (6.10-rc4)
+CVE-2024-40924 [drm/i915/dpt: Make DPT object unshrinkable]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/43e2b37e2ab660c3565d4cff27922bc70e79c3f1 (6.10-rc2)
+CVE-2024-40923 [vmxnet3: disable rx data ring on dma allocation failure]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/ffbe335b8d471f79b259e950cb20999700670456 (6.10-rc3)
+CVE-2024-40922 [io_uring/rsrc: don't lock while !TASK_RUNNING]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/54559642b96116b45e4b5ca7fd9f7835b8561272 (6.10-rc4)
+CVE-2024-40921 [net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/36c92936e868601fa1f43da6758cf55805043509 (6.10-rc4)
+CVE-2024-40920 [net: bridge: mst: fix suspicious rcu usage in br_mst_set_state]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/546ceb1dfdac866648ec959cbc71d9525bd73462 (6.10-rc4)
+CVE-2024-40919 [bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/a9b9741854a9fe9df948af49ca5514e0ed0429df (6.10-rc4)
+CVE-2024-40918 [parisc: Try to fix random segmentation faults in package builds]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/72d95924ee35c8cd16ef52f912483ee938a34d49 (6.10-rc4)
+CVE-2024-40917 [memblock: make memblock_set_node() also warn about use of MAX_NUMNODES]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e0eec24e2e199873f43df99ec39773ad3af2bff7 (6.10-rc4)
+CVE-2024-40916 [drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/799d4b392417ed6889030a5b2335ccb6dcf030ab (6.10-rc4)
+CVE-2024-40915 [riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/fb1cf0878328fe75d47f0aed0a65b30126fcefc4 (6.10-rc1)
+CVE-2024-40914 [mm/huge_memory: don't unpoison huge_zero_folio]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/fe6f86f4b40855a130a19aa589f9ba7f650423f4 (6.10-rc1)
+CVE-2024-40913 [cachefiles: defer exposing anon_fd until after copy_to_user() succeeds]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4b4391e77a6bf24cba2ef1590e113d9b73b11039 (6.10-rc4)
+CVE-2024-40912 [wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/44c06bbde6443de206b30f513100b5670b23fc5e (6.10-rc3)
+CVE-2024-40911 [wifi: cfg80211: Lock wiphy in cfg80211_get_station]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/642f89daa34567d02f312d03e41523a894906dae (6.10-rc3)
+CVE-2024-40910 [ax25: Fix refcount imbalance on inbound connections]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/3c34fb0bd4a4237592c5ecb5b2e2531900c55774 (6.10-rc3)
+CVE-2024-40909 [bpf: Fix a potential use-after-free in bpf_link_free()]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/2884dc7d08d98a89d8d65121524bb7533183a63a (6.10-rc3)
+CVE-2024-40908 [bpf: Set run context for rawtp test_run callback]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/d0d1df8ba18abc57f28fb3bc053b2bf319367f2c (6.10-rc3)
+CVE-2024-40907 [ionic: fix kernel panic in XDP_TX action]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/491aee894a08bc9b8bb52e7363b9d4bc6403f363 (6.10-rc3)
+CVE-2024-40906 [net/mlx5: Always stop health timer during driver removal]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/c8b3f38d2dae0397944814d691a419c451f9906f (6.10-rc3)
+CVE-2024-40905 [ipv6: fix possible race in __fib6_drop_pcpu_from()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b01e1c030770ff3b4fe37fc7cc6bca03f594133f (6.10-rc3)
+CVE-2024-40904 [USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/22f00812862564b314784167a89f27b444f82a46 (6.10-rc4)
+CVE-2024-40903 [usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/e7e921918d905544500ca7a95889f898121ba886 (6.10-rc4)
+CVE-2024-40902 [jfs: xattr: fix buffer overflow for invalid xattr]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f (6.10-rc4)
+CVE-2024-40901 [scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/4254dfeda82f20844299dca6c38cbffcfd499f41 (6.10-rc4)
+CVE-2024-40900 [cachefiles: remove requests from xarray during flushing requests]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/0fc75c5940fa634d84e64c93bfc388e1274ed013 (6.10-rc4)
+CVE-2024-40899 [cachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/de3e26f9e5b76fc628077578c001c4a51bf54d06 (6.10-rc4)
+CVE-2024-39510 [cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/da4a827416066191aafeeccee50a8836a826ba10 (6.10-rc4)
+CVE-2024-39509 [HID: core: remove unnecessary WARN_ON() in implement()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/4aa2dcfbad538adf7becd0034a3754e1bd01b2b5 (6.10-rc3)
+CVE-2024-39508 [io_uring/io-wq: Use set_bit() and test_bit() at worker->flags]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/8a565304927fbd28c9f028c492b5c1714002cbab (6.10-rc1)
+CVE-2024-39507 [net: hns3: fix kernel crash problem in concurrent scenario]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/12cda920212a49fa22d9e8b9492ac4ea013310a4 (6.10-rc4)
+CVE-2024-39506 [liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/c44711b78608c98a3e6b49ce91678cd0917d5349 (6.10-rc4)
+CVE-2024-39505 [drm/komeda: check for error-valued pointer]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/b880018edd3a577e50366338194dee9b899947e0 (6.10-rc4)
+CVE-2024-39504 [netfilter: nft_inner: validate mandatory meta and payload]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/c4ab9da85b9df3692f861512fe6c9812f38b7471 (6.10-rc4)
+CVE-2024-39503 [netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/4e7aaa6b82d63e8ddcbfb56b4fd3d014ca586f10 (6.10-rc4)
+CVE-2024-39502 [ionic: fix use after netif_napi_del()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/79f18a41dd056115d685f3b0a419c7cd40055e13 (6.10-rc4)
+CVE-2024-39501 [drivers: core: synchronize really_probe() and dev_uevent()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/c0a40097f0bc81deafc15f9195d1fb54595cd6d0 (6.10-rc4)
+CVE-2024-39500 [sock_map: avoid race between sock_map_close and sk_psock_put]
+ - linux 6.9.7-1
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/4b4647add7d3c8530493f7247d11e257ee425bf0 (6.10-rc2)
+CVE-2024-39499 [vmci: prevent speculation leaks by sanitizing event in event_deliver()]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/8003f00d895310d409b2bf9ef907c56b42a4e0f4 (6.10-rc1)
+CVE-2024-39498 [drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2]
+ - linux 6.9.7-1
+ [bookworm] - linux <not-affected> (Vulnerable code not present)
+ [bullseye] - linux <not-affected> (Vulnerable code not present)
+ NOTE: https://git.kernel.org/linus/5a507b7d2be15fddb95bf8dee01110b723e2bcd9 (6.10-rc1)
+CVE-2024-39497 [drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/39bc27bd688066a63e56f7f64ad34fae03fbe3b8 (6.10-rc2)
+CVE-2024-39496 [btrfs: zoned: fix use-after-free due to race with dev replace]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/0090d6e1b210551e63cf43958dc7a1ec942cdde9 (6.10-rc1)
+CVE-2024-39495 [greybus: Fix use-after-free bug in gb_interface_release due to race condition.]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce (6.10-rc1)
+CVE-2024-39494 [ima: Fix use-after-free on a dentry's dname.name]
+ - linux 6.9.7-1
+ NOTE: https://git.kernel.org/linus/be84f32bb2c981ca670922e047cdde1488b233de (6.10-rc1)
CVE-2024-6677 (Privilege escalation in uberAgent)
NOT-FOR-US: uberAgent
CVE-2024-6625 (The WP Total Branding \u2013 Complete branding solution for WordPress ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e11c052f764370d73a36e01156fc1a2a562acbc5
--
This project does not include diff previews in email notifications.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e11c052f764370d73a36e01156fc1a2a562acbc5
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240712/3a097375/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list