Vulnerability-Lookup

RHSA-2024:4583

Vulnerability from csaf_redhat - Published: 2024-07-17 01:06 - Updated: 2026-08-25 14:46

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (CVE-2021-47548) * kernel: net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (CVE-2021-47596) * kernel: vt: fix memory overlapping when deleting chars in the buffer (CVE-2022-48627) * kernel: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (CVE-2023-52638) * kernel: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (CVE-2024-26783) * kernel: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (CVE-2024-26858) * kernel: netfilter: nf_tables: use timestamp to check for set element timeout (CVE-2024-27397) * kernel: nvme: fix reconnection fail due to reserved tag allocation (CVE-2024-27435) * kernel: net: ena: Fix incorrect descriptor free behavior (CVE-2024-35958) * kernel: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (CVE-2024-36904) * kernel: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (CVE-2024-38543) * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586) * kernel: net: micrel: Fix receiving the timestamp in the frame for lan8841 (CVE-2024-38593) * kernel: netfilter: tproxy: bail out if IP has been disabled on the device (CVE-2024-36270) * kernel: octeontx2-af: avoid off-by-one read from userspace (CVE-2024-36957) * kernel: blk-cgroup: fix list corruption from resetting io stat (CVE-2024-38663) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2021-47548

A vulnerability was found in the Linux kernel's Hisilicon Ethernet driver, in the hns_dsaf_ge_srst_by_port() function, which allows for a possible array overflow, which occurs when an input value exceeds the expected range, leading to potential memory corruption.

6.0 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H

CWE-129 - Improper Validation of Array Index

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-427.26.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.26.1.el9_4.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-427.26.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-kvm-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.26.1.el9_4.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2021-47596

A vulnerability was found in the Linux kernel's HNS3 network driver related to a use-after-free condition in the hclgevf_send_mbx_msg function. The issue occurs when the hns3_remove function uninstalls a client instance before uninstalling the acceleration engine device, leading to access of freed memory during the device's uninstall process, resulting in system crash.

7.3 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2022-48627

A flaw was found in the Linux kernel's virtual terminal driver which causes a memory overlapping copy to occur, this overlapping copy can lead to data corruption and could potentially allow an attacker interacting with a virtual terminal to corrupt or expose system memory.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-1260 - Improper Handling of Overlap Between Protected Memory Ranges

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2023-52638

A vulnerability was found in the Linux kernel's Controller Area Network (CAN) protocol, within the J1939 protocol implementation. This issue occurs due to a potential deadlock caused by a race condition involving three locks: j1939_socks_lock, active_session_list_lock, and sk_session_queue_lock. This issue was identified in a Syzbot bug report.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-833 - Deadlock

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26783

A vulnerability was found in the Linux kernel's memory management subsystem. The `wakeup_kswapd()` function was called with an incorrect zone index. This error could disrupt the proper functioning of memory management, potentially leading to system instability or performance issues.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-762 - Mismatched Memory Management Routines

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-26858

A vulnerability was found in the mlx5e_txwqe_complete() function in the Linux kernel. The CPU or compiler may reorder two of the functions: mlx5e_ptp_metadata_map_put() and mlx5e_ptpsq_track_metadata(), and a situation could arise where metadata tracking occurs before the metadata map is fully populated. This could lead to a NULL pointer dereference which can cause crashes.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-27397

A use-after-free flaw was found in the Linux kernel’s netfilter subsystem in how a user triggers the element timeout. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-27435

CVE-2024-27435 is a Linux kernel vulnerability in the NVMe over RDMA implementation, where a reconnection failure occurs due to a deadlock caused by reserved tag allocation. The issue arises when the admin queue is quiesced while resetting the controller, causing a keep-alive request to hold the only reserved tag. As the admin queue and fabric queue share this tagset, the reconnection fails because no available tags are left for the connection command.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-35958

This is a vulnerability in the Linux kernel's Elastic Network Adapter (ENA) driver, which manages network interfaces on certain platforms. The driver utilizes two types of transmit (TX) queues: one for packets from the network stack and another for packets directed by XDP (eXpress Data Path) operations. The function ena_free_tx_bufs() is responsible for unmapping and freeing descriptors of uncompleted TX transactions. However, it incorrectly assumes that all TX queues handle packets from the network stack, leading to improper handling of descriptors in XDP-specific queues. This mismanagement can result in descriptors not being freed correctly, potentially causing system crashes, especially during a Virtual Function (VF) reset. The issue has been resolved by updating the driver to correctly differentiate between the two types of TX queues, ensuring proper descriptor management. Users are advised to update their Linux kernel to a version that includes this fix to maintain system stability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-36270

In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [..] RIP: 0010:nf_tproxy_laddr4+0xb7/0x340 net/ipv4/netfilter/nf_tproxy_ipv4.c:62 Call Trace: nft_tproxy_eval_v4 net/netfilter/nft_tproxy.c:56 [inline] nft_tproxy_eval+0xa9a/0x1a00 net/netfilter/nft_tproxy.c:168 __in_dev_get_rcu() can return NULL, so check for this.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-36886

A use-after-free (UAF) flaw exists in the Linux Kernel within the reassembly of fragmented TIPC messages, specifically in the tipc_buf_append() function. The issue results due to a lack of checks in the error handling cleanup and can trigger a UAF on "struct sk_buff", which may lead to remote code execution.

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Important

CVE-2024-36904

A use-after-free flaw was found in the Linux kernel’s TCP protocol in how a local user triggers a complex race condition during connection to the socket. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-36957

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: avoid off-by-one read from userspace We try to access count + 1 byte from userspace with memdup_user(buffer, count + 1). However, the userspace only provides buffer of count bytes and only these count bytes are verified to be okay to access. To ensure the copied buffer is NUL terminated, we use memdup_user_nul instead.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE-193 - Off-by-one Error

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Low

CVE-2024-38543

A flaw was found in the Linux kernel. This vulnerability, located in the `lib/test_hmm.c` component, arises from improper handling of memory allocation failures within the `dmirror_device_evict_chunk()` function. Specifically, if `kcalloc()` returns null due to insufficient physical memory, dereferencing `src_pfns` or `dst_pfns` can lead to a null pointer dereference. A local attacker with low privileges could exploit this issue to trigger a denial of service, potentially causing the system to become unresponsive or crash.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-38586

in linux kernel r8169, when transmitting small fragmented packets, invalid entries were inserted into the transmit ring buffer, leading to calls to dma_unmap_single() with a null address.

4.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-457 - Use of Uninitialized Variable

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-38593

In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, then this workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING is not enabled, then the ptp_clock is not initialized so then it would crash when it would try to access the delayed work. So then basically by setting up and then down the port, it would crash. The fix consists in checking if the ptp_clock is initialized and only then cancel the delayed work.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-457 - Use of Uninitialized Variable

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Moderate

CVE-2024-38663

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix list corruption from resetting io stat Since commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()"), each iostat instance is added to blkcg percpu list, so blkcg_reset_stats() can't reset the stat instance by memset(), otherwise the llist may be corrupted. Fix the issue by only resetting the counter part.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-665 - Improper Initialization

Affected products

Fixed 279 products, the same list as for CVE-2021-47548

Threats

Impact Low

References

105 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:4583	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2267509	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273082	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273466	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275735	external
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281131	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281925	external
https://bugzilla.redhat.com/show_bug.cgi?id=2283401	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284541	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284581	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293230	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293380	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293402	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293456	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293653	external
https://bugzilla.redhat.com/show_bug.cgi?id=2294225	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2021-47548	self
https://bugzilla.redhat.com/show_bug.cgi?id=2283401	external
https://www.cve.org/CVERecord?id=CVE-2021-47548	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47548	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2021-47596	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293230	external
https://www.cve.org/CVERecord?id=CVE-2021-47596	external
https://nvd.nist.gov/vuln/detail/CVE-2021-47596	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2022-48627	self
https://bugzilla.redhat.com/show_bug.cgi?id=2267509	external
https://www.cve.org/CVERecord?id=CVE-2022-48627	external
https://nvd.nist.gov/vuln/detail/CVE-2022-48627	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2023-52638	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273082	external
https://www.cve.org/CVERecord?id=CVE-2023-52638	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52638	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273466	external
https://www.cve.org/CVERecord?id=CVE-2024-26783	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26783	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275735	external
https://www.cve.org/CVERecord?id=CVE-2024-26858	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26858	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-27397	self
https://bugzilla.redhat.com/show_bug.cgi?id=2280434	external
https://www.cve.org/CVERecord?id=CVE-2024-27397	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27397	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-27435	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281131	external
https://www.cve.org/CVERecord?id=CVE-2024-27435	external
https://nvd.nist.gov/vuln/detail/CVE-2024-27435	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35958	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281925	external
https://www.cve.org/CVERecord?id=CVE-2024-35958	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35958	external
https://access.redhat.com/security/cve/CVE-2024-36270	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293653	external
https://www.cve.org/CVERecord?id=CVE-2024-36270	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36270	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-36886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2277238	external
https://www.cve.org/CVERecord?id=CVE-2024-36886	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36886	external
https://lore.kernel.org/all/752f1ccf762223d109845…	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36904	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284541	external
https://www.cve.org/CVERecord?id=CVE-2024-36904	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36904	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36957	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284581	external
https://www.cve.org/CVERecord?id=CVE-2024-36957	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36957	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-38543	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293456	external
https://www.cve.org/CVERecord?id=CVE-2024-38543	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38543	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38586	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293402	external
https://www.cve.org/CVERecord?id=CVE-2024-38586	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38586	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38593	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293380	external
https://www.cve.org/CVERecord?id=CVE-2024-38593	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38593	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38663	self
https://bugzilla.redhat.com/show_bug.cgi?id=2294225	external
https://www.cve.org/CVERecord?id=CVE-2024-38663	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38663	external
https://lore.kernel.org/linux-cve-announce/202406…	external

JSON

To clipboard

Loading 1.7 MB of JSON…

CVE-2024-36886 (GCVE-0-2024-36886)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:28 – Updated: 2026-08-05 11:31

Title

tipc: fix UAF in error path

Summary

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in error path Sam Page (sam4k) working with Trend Micro Zero Day Initiative reported a UAF in the tipc_buf_append() error path: BUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 Read of size 8 at addr ffff88804d2a7c80 by task poc/8034 CPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 Call Trace: <IRQ> __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:377 print_report+0xc4/0x620 linux/mm/kasan/report.c:488 kasan_report+0xda/0x110 linux/mm/kasan/report.c:601 kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183 skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026 skb_release_all linux/net/core/skbuff.c:1094 __kfree_skb linux/net/core/skbuff.c:1108 kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144 kfree_skb linux/./include/linux/skbuff.h:1244 tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186 tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324 tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824 tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159 tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390 udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346 __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422 ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254 dst_input linux/./include/net/dst.h:461 ip_rcv_finish linux/net/ipv4/ip_input.c:449 NF_HOOK linux/./include/linux/netfilter.h:314 NF_HOOK linux/./include/linux/netfilter.h:308 ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534 __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648 process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976 __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576 napi_poll linux/net/core/dev.c:6645 net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781 __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553 do_softirq linux/kernel/softirq.c:454 do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441 </IRQ> <TASK> __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381 local_bh_enable linux/./include/linux/bottom_half.h:33 rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851 __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378 dev_queue_xmit linux/./include/linux/netdevice.h:3169 neigh_hh_output linux/./include/net/neighbour.h:526 neigh_output linux/./include/net/neighbour.h:540 ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235 __ip_finish_output linux/net/ipv4/ip_output.c:313 __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295 ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323 NF_HOOK_COND linux/./include/linux/netfilter.h:303 ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433 dst_output linux/./include/net/dst.h:451 ip_local_out linux/net/ipv4/ip_output.c:129 ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492 udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963 udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250 inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850 sock_sendmsg_nosec linux/net/socket.c:730 __sock_sendmsg linux/net/socket.c:745 __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191 __do_sys_sendto linux/net/socket.c:2203 __se_sys_sendto linux/net/socket.c:2199 __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199 do_syscall_x64 linux/arch/x86/entry/common.c:52 do_syscall_ ---truncated---

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-22 03:55 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

11 references

URL	Tags
https://git.kernel.org/stable/c/e19ec8ab0e25bc480…
https://git.kernel.org/stable/c/93bc2d6d16f2c3178…
https://git.kernel.org/stable/c/367766ff9e407f8a6…
https://git.kernel.org/stable/c/66116556076f0b96b…
https://git.kernel.org/stable/c/21ea04aad8a0839b4…
https://git.kernel.org/stable/c/ffd4917c1edb3c3ff…
https://git.kernel.org/stable/c/a0fbb26f8247e326a…
https://git.kernel.org/stable/c/080cbb890286cd794…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://security.netapp.com/advisory/ntap-2024101…

Impacted products

4 products

Vendor	Product	Version
Linux	Linux	Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < e19ec8ab0e25bc4803d7cc91c84e84532e2781bd (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 93bc2d6d16f2c3178736ba6b845b30475856dc40 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 367766ff9e407f8a68409b7ce4dc4d5a72afeab1 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 66116556076f0b96bc1aa9844008c743c8c67684 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 21ea04aad8a0839b4ec27ef1691ca480620e8e14 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < ffd4917c1edb3c3ff334fce3704fbe9c39f35682 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < a0fbb26f8247e326a320e2cb4395bfb234332c90 (git) Affected: 1149557d64c97dc9adf3103347a1c0e8c06d3b89 , < 080cbb890286cd794f1ee788bbc5463e2deb7c2b (git)
Linux	Linux	Affected: 4.1 Unaffected: 0 , < 4.1 (semver) Unaffected: 4.19.314 , ≤ 4.19.* (semver) Unaffected: 5.4.276 , ≤ 5.4.* (semver) Unaffected: 5.10.217 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 4.1 cpe:2.3:o:linux:linux_kernel:4.1:-::::::
linux	linux_kernel	Affected: 1149557d64c9 , < e19ec8ab0e25 (custom) Affected: 1149557d64c9 , < 93bc2d6d16f2 (custom) Affected: 1149557d64c9 , < 367766ff9e40 (custom) Affected: 1149557d64c9 , < 66116556076f (custom) Affected: 1149557d64c9 , < 21ea04aad8a0 (custom) Affected: 1149557d64c9 , < ffd4917c1edb (custom) Affected: 1149557d64c9 , < a0fbb26f8247 (custom) Affected: 1149557d64c9 , < 080cbb890286 (custom) cpe:2.3:o:linux:linux_kernel::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.1:-:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e19ec8ab0e25",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "93bc2d6d16f2",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "367766ff9e40",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "66116556076f",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "21ea04aad8a0",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "ffd4917c1edb",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "a0fbb26f8247",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              },
              {
                "lessThan": "080cbb890286",
                "status": "affected",
                "version": "1149557d64c9",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-36886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-22T03:55:33.064938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-24T12:40:50.587Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-10-18T13:07:39.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241018-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e19ec8ab0e25bc4803d7cc91c84e84532e2781bd",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "93bc2d6d16f2c3178736ba6b845b30475856dc40",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "367766ff9e407f8a68409b7ce4dc4d5a72afeab1",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "66116556076f0b96bc1aa9844008c743c8c67684",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "21ea04aad8a0839b4ec27ef1691ca480620e8e14",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "ffd4917c1edb3c3ff334fce3704fbe9c39f35682",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "a0fbb26f8247e326a320e2cb4395bfb234332c90",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            },
            {
              "lessThan": "080cbb890286cd794f1ee788bbc5463e2deb7c2b",
              "status": "affected",
              "version": "1149557d64c97dc9adf3103347a1c0e8c06d3b89",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/msg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.314",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.314",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.276",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix UAF in error path\n\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\n\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\n\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable reassembly code is reached directly from received network packets via the TIPC UDP bearer (`tipc_udp_recv` on routable UDP port 6118 \u2192 `tipc_rcv` \u2192 `tipc_link_rcv` \u2192 `tipc_link_input` \u2192 `tipc_buf_append`), as shown in the reporter\u0027s own KASAN stack trace. The attacker only needs IP reachability to the bearer address, not link-layer adjacency.\nAC:L - The error path is entered whenever `tipc_msg_validate()` rejects the reassembled message, and every field it checks (version, header size, message size, length) lives in the attacker-supplied fragment payload, so a FIRST_FRAGMENT followed by a malformed LAST_FRAGMENT triggers the UAF deterministically. There is no race and no memory-layout condition outside the attacker\u0027s influence \u2014 skb heap grooming is done by the attacker\u0027s own packet stream.\nPR:N - TIPC neighbour discovery and link establishment (`tipc_disc_rcv` \u2192 `tipc_node_check_dest`) perform no authentication whatsoever; only a matching net_id (default 4711) is required, and TIPC_CRYPTO is a non-default option. An unauthenticated remote peer can bring up a link and immediately send the malicious fragment sequence.\nUI:N - The whole path executes in softirq/NAPI context on packet arrival with no involvement from any local user or application. No victim action of any kind is needed.\nS:U - The corruption is confined to kernel slab memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary. Impact is standard kernel-level compromise.\nC:H - This is a use-after-free/double-free of an skb: `kfree_skb_list_reason()` dereferences the freed fragment\u0027s `next` pointer, and the freed object can be reclaimed and filled with attacker-chosen data via network skb spraying, yielding a controlled read primitive and kernel memory disclosure.\nI:H - The coalesce path double-frees the skb into `skbuff_cache`, and the frag_list path causes `__kfree_skb()` on an attacker-controlled `next` pointer \u2014 classic type-confusion/arbitrary-free primitives that are leverageable into arbitrary kernel writes and control-flow hijack.\nA:H - The flaw is a KASAN-confirmed slab use-after-free plus double free in softirq context, which reliably oopses or panics the kernel on unpatched systems. It can be re-triggered at will by an unauthenticated remote peer for a persistent remote DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:51.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e19ec8ab0e25bc4803d7cc91c84e84532e2781bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/93bc2d6d16f2c3178736ba6b845b30475856dc40"
        },
        {
          "url": "https://git.kernel.org/stable/c/367766ff9e407f8a68409b7ce4dc4d5a72afeab1"
        },
        {
          "url": "https://git.kernel.org/stable/c/66116556076f0b96bc1aa9844008c743c8c67684"
        },
        {
          "url": "https://git.kernel.org/stable/c/21ea04aad8a0839b4ec27ef1691ca480620e8e14"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffd4917c1edb3c3ff334fce3704fbe9c39f35682"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0fbb26f8247e326a320e2cb4395bfb234332c90"
        },
        {
          "url": "https://git.kernel.org/stable/c/080cbb890286cd794f1ee788bbc5463e2deb7c2b"
        }
      ],
      "title": "tipc: fix UAF in error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36886",
    "datePublished": "2024-05-30T15:28:55.059Z",
    "dateReserved": "2024-05-30T15:25:07.065Z",
    "dateUpdated": "2026-08-05T11:31:51.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36904 (GCVE-0-2024-36904)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:29 – Updated: 2026-08-05 11:31

Title

tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

Summary

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt. If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else. To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false. [0]: refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027 RDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0 RBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0 R10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84 R13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0 FS: 00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> ? refcount_warn_saturate+0xe5/0x110 ? __warn+0x81/0x130 ? refcount_warn_saturate+0xe5/0x110 ? report_bug+0x171/0x1a0 ? refcount_warn_saturate+0xe5/0x110 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? refcount_warn_saturate+0xe5/0x110 tcp_twsk_unique+0x186/0x190 __inet_check_established+0x176/0x2d0 __inet_hash_connect+0x74/0x7d0 ? __pfx___inet_check_established+0x10/0x10 tcp_v4_connect+0x278/0x530 __inet_stream_connect+0x10f/0x3d0 inet_stream_connect+0x3a/0x60 __sys_connect+0xa8/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x83/0x170 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7f62c11a885d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d RDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003 RBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0 R13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0 </TASK>

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-12 19:20 UTC

Assigner

Linux mitre root

References

14 references

URL	Tags
https://git.kernel.org/stable/c/84546cc1aeeb4df3e…
https://git.kernel.org/stable/c/1796ca9c6f5bd5055…
https://git.kernel.org/stable/c/1d9cf07810c30ef79…
https://git.kernel.org/stable/c/27b0284d8be182a81…
https://git.kernel.org/stable/c/13ed7cdf079686ccd…
https://git.kernel.org/stable/c/6e48faad92be13166…
https://git.kernel.org/stable/c/517e32ea0a8c72202…
https://git.kernel.org/stable/c/f2db7230f73a80dbb…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://lists.debian.org/debian-lts-announce/2024…	x_transferred
https://security.netapp.com/advisory/ntap-2024090…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

9 products

Vendor	Product	Version
Linux	Linux	Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 84546cc1aeeb4df3e444b18a4293c9823f974be9 (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 1796ca9c6f5bd50554214053af5f47d112818ee3 (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 1d9cf07810c30ef7948879567d10fd1f01121d34 (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 27b0284d8be182a81feb65581ab6a724dfd596e8 (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 13ed7cdf079686ccd3618335205700c03f6fb446 (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 6e48faad92be13166184d21506e4e54c79c13adc (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < 517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc (git) Affected: ec94c2696f0bcd5ae92a553244e4ac30d2171a2d , < f2db7230f73a80dbb179deab78f88a7947f0ab7e (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 4.19.314 , ≤ 4.19.* (semver) Unaffected: 5.4.276 , ≤ 5.4.* (semver) Unaffected: 5.10.217 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.1 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Unaffected: 0 , < * (custom)
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	Affected: 0 , < V3.1 (custom)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	Affected: V3.1.0 , < V3.1.5 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T19:20:22.181493Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T19:20:38.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-05T08:03:30.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/84546cc1aeeb4df3e444b18a4293c9823f974be9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1796ca9c6f5bd50554214053af5f47d112818ee3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d9cf07810c30ef7948879567d10fd1f01121d34"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/27b0284d8be182a81feb65581ab6a724dfd596e8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13ed7cdf079686ccd3618335205700c03f6fb446"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6e48faad92be13166184d21506e4e54c79c13adc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f2db7230f73a80dbb179deab78f88a7947f0ab7e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20240905-0004/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1.5",
                "status": "affected",
                "version": "V3.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:54:07.539Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "84546cc1aeeb4df3e444b18a4293c9823f974be9",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "1796ca9c6f5bd50554214053af5f47d112818ee3",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "1d9cf07810c30ef7948879567d10fd1f01121d34",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "27b0284d8be182a81feb65581ab6a724dfd596e8",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "13ed7cdf079686ccd3618335205700c03f6fb446",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "6e48faad92be13166184d21506e4e54c79c13adc",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            },
            {
              "lessThan": "f2db7230f73a80dbb179deab78f88a7947f0ab7e",
              "status": "affected",
              "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.314",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.314",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.276",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Use refcount_inc_not_zero() in tcp_twsk_unique().\n\nAnderson Nascimento reported a use-after-free splat in tcp_twsk_unique()\nwith nice analysis.\n\nSince commit ec94c2696f0b (\"tcp/dccp: avoid one atomic operation for\ntimewait hashdance\"), inet_twsk_hashdance() sets TIME-WAIT socket\u0027s\nsk_refcnt after putting it into ehash and releasing the bucket lock.\n\nThus, there is a small race window where other threads could try to\nreuse the port during connect() and call sock_hold() in tcp_twsk_unique()\nfor the TIME-WAIT socket with zero refcnt.\n\nIf that happens, the refcnt taken by tcp_twsk_unique() is overwritten\nand sock_put() will cause underflow, triggering a real use-after-free\nsomewhere else.\n\nTo avoid the use-after-free, we need to use refcount_inc_not_zero() in\ntcp_twsk_unique() and give up on reusing the port if it returns false.\n\n[0]:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110\nCPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1\nHardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023\nRIP: 0010:refcount_warn_saturate+0xe5/0x110\nCode: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff \u003c0f\u003e 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8\nRSP: 0018:ffffc90006b43b60 EFLAGS: 00010282\nRAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027\nRDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0\nRBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0\nR10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84\nR13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0\nFS:  00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0\nPKRU: 55555554\nCall Trace:\n \u003cTASK\u003e\n ? refcount_warn_saturate+0xe5/0x110\n ? __warn+0x81/0x130\n ? refcount_warn_saturate+0xe5/0x110\n ? report_bug+0x171/0x1a0\n ? refcount_warn_saturate+0xe5/0x110\n ? handle_bug+0x3c/0x80\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? refcount_warn_saturate+0xe5/0x110\n tcp_twsk_unique+0x186/0x190\n __inet_check_established+0x176/0x2d0\n __inet_hash_connect+0x74/0x7d0\n ? __pfx___inet_check_established+0x10/0x10\n tcp_v4_connect+0x278/0x530\n __inet_stream_connect+0x10f/0x3d0\n inet_stream_connect+0x3a/0x60\n __sys_connect+0xa8/0xd0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0x83/0x170\n entry_SYSCALL_64_after_hwframe+0x78/0x80\nRIP: 0033:0x7f62c11a885d\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48\nRSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a\nRAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d\nRDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003\nRBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0\nR13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0\n \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code in `tcp_twsk_unique()` is only reached from the outbound `connect(2)` path (`tcp_v4_connect` \u2192 `__inet_hash_connect` \u2192 `__inet_check_established`), which a remote peer cannot invoke; a local socket must initiate the connection. Both sides of the race are driven by local syscalls (close() generating TIME-WAIT, connect() reusing the 4-tuple), fully exercisable over loopback.\nAC:L - The attacker creates and controls both sides of the race \u2014 one set of threads generates TIME-WAIT sockets via active close, another loops on bind()+connect() against the same 4-tuple \u2014 and can retry indefinitely at thousands of attempts per second, as demonstrated by the reporter\u0027s working `trigger` reproducer. No non-default sysctl is required, since the explicitly-bound `twp == NULL` path bypasses the `tcp_tw_reuse` check entirely.\nPR:L - Only an unprivileged local user account is needed: creating TCP sockets, bind() with SO_REUSEADDR, connect(), and close() require no capabilities, and the whole sequence works inside a network namespace or on loopback.\nUI:N - The attacker performs every step itself with its own sockets; no victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel slab memory managed by the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The refcount underflow prematurely frees a `tcp_timewait_sock` that is still referenced by the ehash/bhash chains and the connect path; on a SLAB_TYPESAFE_BY_RCU slab the attacker reallocates that memory with sprayed TIME-WAIT sockets, yielding a use-after-free read primitive over kernel memory and adjacent socket state.\nI:H - The stale pointers permit writes through the dangling object \u2014 hlist_nulls chain pointer updates, timer re-arming, and `inet_twsk_kill()` refcount decrements applied to reallocated objects \u2014 cascading into refcount corruption of unrelated `struct sock` allocations, a well-established path to arbitrary write and control-flow hijack.\nA:H - Even the benign outcome is a `refcount_t` WARN (an immediate panic under the widely used panic_on_warn), and the underflow reliably frees a live socket, causing kernel oops/panic from list-corruption and freed-memory dereference in the TCP hash tables."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:55.416Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/84546cc1aeeb4df3e444b18a4293c9823f974be9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1796ca9c6f5bd50554214053af5f47d112818ee3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d9cf07810c30ef7948879567d10fd1f01121d34"
        },
        {
          "url": "https://git.kernel.org/stable/c/27b0284d8be182a81feb65581ab6a724dfd596e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/13ed7cdf079686ccd3618335205700c03f6fb446"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e48faad92be13166184d21506e4e54c79c13adc"
        },
        {
          "url": "https://git.kernel.org/stable/c/517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2db7230f73a80dbb179deab78f88a7947f0ab7e"
        }
      ],
      "title": "tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36904",
    "datePublished": "2024-05-30T15:29:05.457Z",
    "dateReserved": "2024-05-30T15:25:07.067Z",
    "dateUpdated": "2026-08-05T11:31:55.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-36957 (GCVE-0-2024-36957)

Vulnerability from cvelistv5 – Published: 2024-05-30 15:35 – Updated: 2026-05-23 15:47

Title

octeontx2-af: avoid off-by-one read from userspace

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-05 18:14 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/bcdac70adceb44373…
https://git.kernel.org/stable/c/ec697fbd38cbe2eef…
https://git.kernel.org/stable/c/8f11fe3ea3fc26164…
https://git.kernel.org/stable/c/0a0285cee11c7dcc2…
https://git.kernel.org/stable/c/fc3e0076c1f82fe98…
https://git.kernel.org/stable/c/f299ee709fb450364…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: dae49384d0d7695540e2d75168f323cef1384810 , < bcdac70adceb44373da204c3c297f2a98e13216e (git) Affected: 3a2eb515d1367c0f667b76089a6e727279c688b8 , < ec697fbd38cbe2eef0948b58673b146caa95402f (git) Affected: 3a2eb515d1367c0f667b76089a6e727279c688b8 , < 8f11fe3ea3fc261640cfc8a5addd838000407c67 (git) Affected: 3a2eb515d1367c0f667b76089a6e727279c688b8 , < 0a0285cee11c7dcc2657bcd456e469958a5009e7 (git) Affected: 3a2eb515d1367c0f667b76089a6e727279c688b8 , < fc3e0076c1f82fe981d321e3a7bad4cbee542c19 (git) Affected: 3a2eb515d1367c0f667b76089a6e727279c688b8 , < f299ee709fb45036454ca11e90cb2810fe771878 (git) Affected: c9a2ed3fdd037314a71e6a6ba5d99a3605f6f9c7 (git) Affected: 5.10.20 , < 5.10.217 (semver) Affected: 5.11.3 , < 5.12 (semver)
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 5.10.217 , ≤ 5.10.* (semver) Unaffected: 5.15.159 , ≤ 5.15.* (semver) Unaffected: 6.1.91 , ≤ 6.1.* (semver) Unaffected: 6.6.31 , ≤ 6.6.* (semver) Unaffected: 6.8.10 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T18:14:35.481589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T18:14:45.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.509Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bcdac70adceb44373da204c3c297f2a98e13216e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec697fbd38cbe2eef0948b58673b146caa95402f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f11fe3ea3fc261640cfc8a5addd838000407c67"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0a0285cee11c7dcc2657bcd456e469958a5009e7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc3e0076c1f82fe981d321e3a7bad4cbee542c19"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f299ee709fb45036454ca11e90cb2810fe771878"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bcdac70adceb44373da204c3c297f2a98e13216e",
              "status": "affected",
              "version": "dae49384d0d7695540e2d75168f323cef1384810",
              "versionType": "git"
            },
            {
              "lessThan": "ec697fbd38cbe2eef0948b58673b146caa95402f",
              "status": "affected",
              "version": "3a2eb515d1367c0f667b76089a6e727279c688b8",
              "versionType": "git"
            },
            {
              "lessThan": "8f11fe3ea3fc261640cfc8a5addd838000407c67",
              "status": "affected",
              "version": "3a2eb515d1367c0f667b76089a6e727279c688b8",
              "versionType": "git"
            },
            {
              "lessThan": "0a0285cee11c7dcc2657bcd456e469958a5009e7",
              "status": "affected",
              "version": "3a2eb515d1367c0f667b76089a6e727279c688b8",
              "versionType": "git"
            },
            {
              "lessThan": "fc3e0076c1f82fe981d321e3a7bad4cbee542c19",
              "status": "affected",
              "version": "3a2eb515d1367c0f667b76089a6e727279c688b8",
              "versionType": "git"
            },
            {
              "lessThan": "f299ee709fb45036454ca11e90cb2810fe771878",
              "status": "affected",
              "version": "3a2eb515d1367c0f667b76089a6e727279c688b8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9a2ed3fdd037314a71e6a6ba5d99a3605f6f9c7",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.217",
              "status": "affected",
              "version": "5.10.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.217",
                  "versionStartIncluding": "5.10.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.159",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.91",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.31",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: avoid off-by-one read from userspace\n\nWe try to access count + 1 byte from userspace with memdup_user(buffer,\ncount + 1). However, the userspace only provides buffer of count bytes and\nonly these count bytes are verified to be okay to access. To ensure the\ncopied buffer is NUL terminated, we use memdup_user_nul instead."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:47:48.972Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bcdac70adceb44373da204c3c297f2a98e13216e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec697fbd38cbe2eef0948b58673b146caa95402f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f11fe3ea3fc261640cfc8a5addd838000407c67"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a0285cee11c7dcc2657bcd456e469958a5009e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc3e0076c1f82fe981d321e3a7bad4cbee542c19"
        },
        {
          "url": "https://git.kernel.org/stable/c/f299ee709fb45036454ca11e90cb2810fe771878"
        }
      ],
      "title": "octeontx2-af: avoid off-by-one read from userspace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36957",
    "datePublished": "2024-05-30T15:35:50.445Z",
    "dateReserved": "2024-05-30T15:25:07.080Z",
    "dateUpdated": "2026-05-23T15:47:48.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38543 (GCVE-0-2024-38543)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-05-11 20:18

Title

lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure

Summary

In the Linux kernel, the following vulnerability has been resolved: lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure The kcalloc() in dmirror_device_evict_chunk() will return null if the physical memory has run out. As a result, if src_pfns or dst_pfns is dereferenced, the null pointer dereference bug will happen. Moreover, the device is going away. If the kcalloc() fails, the pages mapping a chunk could not be evicted. So add a __GFP_NOFAIL flag in kcalloc(). Finally, as there is no need to have physically contiguous memory, Switch kcalloc() to kvcalloc() in order to avoid failing allocations.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:15 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/1a21fdeea502658e3…
https://git.kernel.org/stable/c/65e528a69cb3ed4a2…
https://git.kernel.org/stable/c/ce47e8ead9a72834c…
https://git.kernel.org/stable/c/3b20d18f475bd1730…
https://git.kernel.org/stable/c/c2af060d1c18beaec…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b2ef9f5a5cb37643ca5def3516c546457074b882 , < 1a21fdeea502658e315bd939409b755974f4fb64 (git) Affected: b2ef9f5a5cb37643ca5def3516c546457074b882 , < 65e528a69cb3ed4a286c45b4afba57461c8b5b33 (git) Affected: b2ef9f5a5cb37643ca5def3516c546457074b882 , < ce47e8ead9a72834cc68431d53f8092ce69bebb7 (git) Affected: b2ef9f5a5cb37643ca5def3516c546457074b882 , < 3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc (git) Affected: b2ef9f5a5cb37643ca5def3516c546457074b882 , < c2af060d1c18beaec56351cf9c9bcbbc5af341a3 (git)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.8.12 , ≤ 6.8.* (semver) Unaffected: 6.9.3 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.183Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1a21fdeea502658e315bd939409b755974f4fb64"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/65e528a69cb3ed4a286c45b4afba57461c8b5b33"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce47e8ead9a72834cc68431d53f8092ce69bebb7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c2af060d1c18beaec56351cf9c9bcbbc5af341a3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38543",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:15:10.301202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:58.014Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/test_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a21fdeea502658e315bd939409b755974f4fb64",
              "status": "affected",
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "versionType": "git"
            },
            {
              "lessThan": "65e528a69cb3ed4a286c45b4afba57461c8b5b33",
              "status": "affected",
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "versionType": "git"
            },
            {
              "lessThan": "ce47e8ead9a72834cc68431d53f8092ce69bebb7",
              "status": "affected",
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "versionType": "git"
            },
            {
              "lessThan": "3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc",
              "status": "affected",
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "versionType": "git"
            },
            {
              "lessThan": "c2af060d1c18beaec56351cf9c9bcbbc5af341a3",
              "status": "affected",
              "version": "b2ef9f5a5cb37643ca5def3516c546457074b882",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/test_hmm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/test_hmm.c: handle src_pfns and dst_pfns allocation failure\n\nThe kcalloc() in dmirror_device_evict_chunk() will return null if the\nphysical memory has run out.  As a result, if src_pfns or dst_pfns is\ndereferenced, the null pointer dereference bug will happen.\n\nMoreover, the device is going away.  If the kcalloc() fails, the pages\nmapping a chunk could not be evicted.  So add a __GFP_NOFAIL flag in\nkcalloc().\n\nFinally, as there is no need to have physically contiguous memory, Switch\nkcalloc() to kvcalloc() in order to avoid failing allocations."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:18:42.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1a21fdeea502658e315bd939409b755974f4fb64"
        },
        {
          "url": "https://git.kernel.org/stable/c/65e528a69cb3ed4a286c45b4afba57461c8b5b33"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce47e8ead9a72834cc68431d53f8092ce69bebb7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b20d18f475bd17309db640dbe7d7c7ebb5bc2bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2af060d1c18beaec56351cf9c9bcbbc5af341a3"
        }
      ],
      "title": "lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38543",
    "datePublished": "2024-06-19T13:35:17.994Z",
    "dateReserved": "2024-06-18T19:36:34.919Z",
    "dateUpdated": "2026-05-11T20:18:42.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38586 (GCVE-0-2024-38586)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:37 – Updated: 2026-05-11 20:19

Title

r8169: Fix possible ring buffer corruption on fragmented Tx packets.

Summary

In the Linux kernel, the following vulnerability has been resolved: r8169: Fix possible ring buffer corruption on fragmented Tx packets. An issue was found on the RTL8125b when transmitting small fragmented packets, whereby invalid entries were inserted into the transmit ring buffer, subsequently leading to calls to dma_unmap_single() with a null address. This was caused by rtl8169_start_xmit() not noticing changes to nr_frags which may occur when small packets are padded (to work around hardware quirks) in rtl8169_tso_csum_v2(). To fix this, postpone inspecting nr_frags until after any padding has been applied.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:13 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/61c1c98e2607120ce…
https://git.kernel.org/stable/c/b6d21cf40de103d63…
https://git.kernel.org/stable/c/0c48185a953095567…
https://git.kernel.org/stable/c/68222d7b4b72aa321…
https://git.kernel.org/stable/c/078d5b7500d70af2d…
https://git.kernel.org/stable/c/54e7a0d111240c92c…
https://git.kernel.org/stable/c/c71e3a5cffd5309d7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < 61c1c98e2607120ce9c3fa1bf75e6da909712b27 (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < b6d21cf40de103d63ae78551098a7c06af8c98dd (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < 0c48185a95309556725f818b82120bb74e9c627d (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < 68222d7b4b72aa321135cd453dac37f00ec41fd1 (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < 078d5b7500d70af2de6b38e226b03f0b932026a6 (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < 54e7a0d111240c92c0f02ceba6eb8f26bf6d6479 (git) Affected: 9020845fb5d6bb4876a38fdf1259600e7d9a63d4 , < c71e3a5cffd5309d7f84444df03d5b72600cc417 (git)
Linux	Linux	Affected: 5.7 Unaffected: 0 , < 5.7 (semver) Unaffected: 5.10.221 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.8.12 , ≤ 6.8.* (semver) Unaffected: 6.9.3 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.972Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/61c1c98e2607120ce9c3fa1bf75e6da909712b27"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b6d21cf40de103d63ae78551098a7c06af8c98dd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0c48185a95309556725f818b82120bb74e9c627d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/68222d7b4b72aa321135cd453dac37f00ec41fd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/078d5b7500d70af2de6b38e226b03f0b932026a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54e7a0d111240c92c0f02ceba6eb8f26bf6d6479"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c71e3a5cffd5309d7f84444df03d5b72600cc417"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:13:50.332760Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:55.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/realtek/r8169_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "61c1c98e2607120ce9c3fa1bf75e6da909712b27",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "b6d21cf40de103d63ae78551098a7c06af8c98dd",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "0c48185a95309556725f818b82120bb74e9c627d",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "68222d7b4b72aa321135cd453dac37f00ec41fd1",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "078d5b7500d70af2de6b38e226b03f0b932026a6",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "54e7a0d111240c92c0f02ceba6eb8f26bf6d6479",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            },
            {
              "lessThan": "c71e3a5cffd5309d7f84444df03d5b72600cc417",
              "status": "affected",
              "version": "9020845fb5d6bb4876a38fdf1259600e7d9a63d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/realtek/r8169_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.221",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nr8169: Fix possible ring buffer corruption on fragmented Tx packets.\n\nAn issue was found on the RTL8125b when transmitting small fragmented\npackets, whereby invalid entries were inserted into the transmit ring\nbuffer, subsequently leading to calls to dma_unmap_single() with a null\naddress.\n\nThis was caused by rtl8169_start_xmit() not noticing changes to nr_frags\nwhich may occur when small packets are padded (to work around hardware\nquirks) in rtl8169_tso_csum_v2().\n\nTo fix this, postpone inspecting nr_frags until after any padding has been\napplied."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:19:35.312Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/61c1c98e2607120ce9c3fa1bf75e6da909712b27"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6d21cf40de103d63ae78551098a7c06af8c98dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c48185a95309556725f818b82120bb74e9c627d"
        },
        {
          "url": "https://git.kernel.org/stable/c/68222d7b4b72aa321135cd453dac37f00ec41fd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/078d5b7500d70af2de6b38e226b03f0b932026a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/54e7a0d111240c92c0f02ceba6eb8f26bf6d6479"
        },
        {
          "url": "https://git.kernel.org/stable/c/c71e3a5cffd5309d7f84444df03d5b72600cc417"
        }
      ],
      "title": "r8169: Fix possible ring buffer corruption on fragmented Tx packets.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38586",
    "datePublished": "2024-06-19T13:37:41.879Z",
    "dateReserved": "2024-06-18T19:36:34.929Z",
    "dateUpdated": "2026-05-11T20:19:35.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38593 (GCVE-0-2024-38593)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:45 – Updated: 2026-05-11 20:19

Title

net: micrel: Fix receiving the timestamp in the frame for lan8841

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-20 15:38 UTC

CWE

CWE-noinfo Not enough information

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/3ddf170e4a604f5d4…
https://git.kernel.org/stable/c/3fd4282d5f25c3c97…
https://git.kernel.org/stable/c/64a47cf634ae44e92…
https://git.kernel.org/stable/c/aea27a92a41dae148…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cc75549548482ed653c23f212544e58cb38ea980 , < 3ddf170e4a604f5d4d9459a36993f5e92b53e8b0 (git) Affected: cc75549548482ed653c23f212544e58cb38ea980 , < 3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975 (git) Affected: cc75549548482ed653c23f212544e58cb38ea980 , < 64a47cf634ae44e92be24ebc982410841093bd7b (git) Affected: cc75549548482ed653c23f212544e58cb38ea980 , < aea27a92a41dae14843f92c79e9e42d8f570105c (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.8.12 , ≤ 6.8.* (semver) Unaffected: 6.9.3 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38593",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-20T15:38:26.160801Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T17:17:14.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3ddf170e4a604f5d4d9459a36993f5e92b53e8b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/64a47cf634ae44e92be24ebc982410841093bd7b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aea27a92a41dae14843f92c79e9e42d8f570105c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/micrel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3ddf170e4a604f5d4d9459a36993f5e92b53e8b0",
              "status": "affected",
              "version": "cc75549548482ed653c23f212544e58cb38ea980",
              "versionType": "git"
            },
            {
              "lessThan": "3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975",
              "status": "affected",
              "version": "cc75549548482ed653c23f212544e58cb38ea980",
              "versionType": "git"
            },
            {
              "lessThan": "64a47cf634ae44e92be24ebc982410841093bd7b",
              "status": "affected",
              "version": "cc75549548482ed653c23f212544e58cb38ea980",
              "versionType": "git"
            },
            {
              "lessThan": "aea27a92a41dae14843f92c79e9e42d8f570105c",
              "status": "affected",
              "version": "cc75549548482ed653c23f212544e58cb38ea980",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/phy/micrel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: micrel: Fix receiving the timestamp in the frame for lan8841\n\nThe blamed commit started to use the ptp workqueue to get the second\npart of the timestamp. And when the port was set down, then this\nworkqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING\nis not enabled, then the ptp_clock is not initialized so then it would\ncrash when it would try to access the delayed work.\nSo then basically by setting up and then down the port, it would crash.\nThe fix consists in checking if the ptp_clock is initialized and only\nthen cancel the delayed work."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:19:43.643Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3ddf170e4a604f5d4d9459a36993f5e92b53e8b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975"
        },
        {
          "url": "https://git.kernel.org/stable/c/64a47cf634ae44e92be24ebc982410841093bd7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/aea27a92a41dae14843f92c79e9e42d8f570105c"
        }
      ],
      "title": "net: micrel: Fix receiving the timestamp in the frame for lan8841",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38593",
    "datePublished": "2024-06-19T13:45:44.031Z",
    "dateReserved": "2024-06-18T19:36:34.931Z",
    "dateUpdated": "2026-05-11T20:19:43.643Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38663 (GCVE-0-2024-38663)

Vulnerability from cvelistv5 – Published: 2024-06-24 13:50 – Updated: 2026-08-05 11:33

Title

blk-cgroup: fix list corruption from resetting io stat

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-25 13:51 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/d4a60298ac34f027a…
https://git.kernel.org/stable/c/89bb36c72e1951843…
https://git.kernel.org/stable/c/6da6680632792709c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3b8cc6298724021da845f2f9fd7dd4b6829a6817 , < d4a60298ac34f027a09f8f893fdbd9e06279bb24 (git) Affected: 3b8cc6298724021da845f2f9fd7dd4b6829a6817 , < 89bb36c72e1951843f9e04dc84412e31fcc849a9 (git) Affected: 3b8cc6298724021da845f2f9fd7dd4b6829a6817 , < 6da6680632792709cecf2b006f2fe3ca7857e791 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.9.4 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38663",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-25T13:51:20.493125Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-25T13:51:34.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4a60298ac34f027a09f8f893fdbd9e06279bb24"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/89bb36c72e1951843f9e04dc84412e31fcc849a9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6da6680632792709cecf2b006f2fe3ca7857e791"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4a60298ac34f027a09f8f893fdbd9e06279bb24",
              "status": "affected",
              "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817",
              "versionType": "git"
            },
            {
              "lessThan": "89bb36c72e1951843f9e04dc84412e31fcc849a9",
              "status": "affected",
              "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817",
              "versionType": "git"
            },
            {
              "lessThan": "6da6680632792709cecf2b006f2fe3ca7857e791",
              "status": "affected",
              "version": "3b8cc6298724021da845f2f9fd7dd4b6829a6817",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix list corruption from resetting io stat\n\nSince commit 3b8cc6298724 (\"blk-cgroup: Optimize blkcg_rstat_flush()\"),\neach iostat instance is added to blkcg percpu list, so blkcg_reset_stats()\ncan\u0027t reset the stat instance by memset(), otherwise the llist may be\ncorrupted.\n\nFix the issue by only resetting the counter part."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by writing to the cgroup v1 control file `blkio.reset_stats` and by submitting block I/O from the same cgroup, both of which require local access to the machine (cgroupfs write + write(2)/read(2) to a block device or file). There is no network, adjacent-network, or physical path into `blkcg_reset_stats()`.\nAC:L - The attacker controls both sides of the race: they generate I/O inside their own cgroup to populate `blkcg-\u003elhead` via `blk_cgroup_bio_start()` and concurrently write `blkio.reset_stats` in a loop from another thread, and `blkcg_reset_stats()` takes only `blkcg-\u003elock`, which the I/O path never acquires. Once `lqueued` is cleared on a still-linked node, the very next bio deterministically re-adds it and forms a cycle \u2014 no memory layout or timing outside the attacker\u0027s influence is needed, and failed attempts can be retried indefinitely.\nPR:L - `cgroup_kn_set_ugid()` explicitly sets cgroup directories and control files to the uid/gid of their creator, so an unprivileged user or container root with write access to a delegated cgroup v1 blkio subtree (standard in LXC/LXD, Docker/Kubernetes, and systemd `Delegate=` setups) can `mkdir` a child cgroup and own its `blkio.reset_stats` file, then generate I/O and write it. No init-namespace root or capability is required, and the resulting lockless-list corruption is not confined to the attacker\u0027s own cgroup \u2014 it hangs the whole machine.\nUI:N - The attacker performs both the I/O submission and the `blkio.reset_stats` write from their own processes; no victim has to mount, open, or otherwise interact with anything.\nS:U - The corrupted `blkg_iostat_set` lockless lists and the resulting crash/corruption are entirely within the kernel\u0027s own security authority; no VM, hypervisor, or IOMMU boundary is crossed by the bug itself.\nC:H - This is a memory-corruption defect \u2014 `memset()` over live `llist_node` linkage and the `lqueued` membership flag inside per-CPU `blkg_iostat_set` objects \u2014 which desynchronizes the list-membership invariant that the blkg lifetime rules depend on (in the v6.2\u2013v6.4 part of the affected range llist membership held a `percpu_ref` on `blkg-\u003erefcnt`, so lost/duplicated puts corrupt `struct blkcg_gq` lifetime accounting). The same broken invariant in this exact function has since produced a confirmed slab use-after-free in `__blkcg_rstat_flush()`, and dangling/looped links into kmalloc\u0027d blkg and per-CPU stat memory are leverageable for kernel memory disclosure via heap grooming.\nI:H - The corrupted links cause `__blkcg_rstat_flush()` to write unbounded, attacker-influenced counter deltas through the cyclic chain into ancestor blkgs\u0027 `iostat` (`blkcg_iostat_update(parent, ...)`), modifying kernel state belonging to higher-privileged cgroups, and the underlying pointer/refcount corruption of `struct blkcg_gq` is the classic primitive for heap grooming and writes through stale pointers. Per kernel CNA practice, list corruption of this class is treated as exploitable for control-flow-relevant memory modification.\nA:H - The reliable, immediate outcome is a cyclic lockless list that makes `llist_for_each_entry_safe()` in `__blkcg_rstat_flush()` spin forever while holding the global `raw_spinlock_t blkg_stat_lock` with local IRQs disabled \u2014 every other CPU entering rstat flush then spins too, producing a hard lockup and watchdog panic. Additionally, the `memset`-to-`bis-\u003eblkg = blkg` window lets a concurrent flush dereference a NULL `blkg`, and the truncated chains permanently leak blkg references and per-CPU stats."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:20.039Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4a60298ac34f027a09f8f893fdbd9e06279bb24"
        },
        {
          "url": "https://git.kernel.org/stable/c/89bb36c72e1951843f9e04dc84412e31fcc849a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6da6680632792709cecf2b006f2fe3ca7857e791"
        }
      ],
      "title": "blk-cgroup: fix list corruption from resetting io stat",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38663",
    "datePublished": "2024-06-24T13:50:51.710Z",
    "dateReserved": "2024-06-21T11:16:40.592Z",
    "dateUpdated": "2026-08-05T11:33:20.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:4583

CVE-2024-36886 (GCVE-0-2024-36886)

CVE-2024-36904 (GCVE-0-2024-36904)

CVE-2024-36957 (GCVE-0-2024-36957)

CVE-2024-38543 (GCVE-0-2024-38543)

CVE-2024-38586 (GCVE-0-2024-38586)

CVE-2024-38593 (GCVE-0-2024-38593)

CVE-2024-38663 (GCVE-0-2024-38663)

Tags

Sightings

Nomenclature

Related by attack behaviour