Vulnerability-Lookup

RHSA-2024:6567

Vulnerability from csaf_redhat - Published: 2024-09-11 01:10 - Updated: 2026-08-28 04:46

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Notes

Topic: An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: nfsd: fix RELEASE_LOCKOWNER (CVE-2024-26629) * kernel: mm: cachestat: fix folio read-after-free in cache walk (CVE-2024-26630) * kernel: mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (CVE-2024-26720) * kernel: Bluetooth: af_bluetooth: Fix deadlock (CVE-2024-26886) * kernel: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (CVE-2024-26946) * kernel: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (CVE-2024-35791) * kernel: mm: cachestat: fix two shmem bugs (CVE-2024-35797) * kernel: x86/coco: Require seeding RNG with RDRAND on CoCo systems (CVE-2024-35875) * kernel: mm/hugetlb: fix missing hugetlb_lock for resv uncharge (CVE-2024-36000) * kernel: iommufd: Fix missing update of domains_itree after splitting iopt_area (CVE-2023-52801) * kernel: net: fix out-of-bounds access in ops_init (CVE-2024-36883) * kernel: regmap: maple: Fix cache corruption in regcache_maple_drop() (CVE-2024-36019) * kernel: usb-storage: alauda: Check whether the media is initialized (CVE-2024-38619) * kernel: net: bridge: mst: fix vlan use-after-free (CVE-2024-36979) * kernel: scsi: qedf: Ensure the copied buf is NUL terminated (CVE-2024-38559) * kernel: xhci: Handle TD clearing for multiple streams case (CVE-2024-40927) * kernel: cxl/region: Fix memregion leaks in devm_cxl_add_region() (CVE-2024-40936) * kernel: net/sched: Fix UAF when resolving a clash (CVE-2024-41040) * kernel: ppp: reject claimed-as-LCP but actually malformed packets (CVE-2024-41044) * kernel: mm: prevent derefencing NULL ptr in pfn_section_valid() (CVE-2024-41055) * kernel: PCI/MSI: Fix UAF in msi_capability_init (CVE-2024-41096) * kernel: xdp: Remove WARN() from __xdp_reg_mem_model() (CVE-2024-42082) * kernel: x86: stop playing stack games in profile_pc() (CVE-2024-42096) * kernel: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (CVE-2024-42102) * kernel: mm: avoid overflows in dirty throttling logic (CVE-2024-42131) * kernel: nvme: avoid double free special payload (CVE-2024-41073) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-52463

A flaw was found in the Linux kernel, which involves the improper handling of the efivarfs filesystem when the firmware does not support the SetVariable function at runtime. Specifically, even if efivarfs is initially mounted as read-only (RO), it can be remounted as read-write (RW) without checking if the firmware can handle variable updates. This issue allows operations such as efi-updatevar to be executed, which leads to a crash due to a NULL pointer dereference. This crash occurs because the callback for SetVariable is not assigned, causing a level 0 translation fault.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products

Product	Version	Remediation
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debug-devel-matched-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-64k-devel-matched-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debug-devel-matched-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-devel-matched-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-doc-0:5.14.0-427.35.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-devel-matched-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rtla-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.4.0.Z.MAIN.EUS:rv-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.35.1.el9_4.src	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debug-modules-extra-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-64k-modules-extra-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-abi-stablelists-0:5.14.0-427.35.1.el9_4.noarch	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debug-uki-virt-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-tools-libs-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-uki-virt-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-core-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-modules-extra-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: BaseOS-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-64k-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-aarch64-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-ppc64le-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-s390x-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-tools-libs-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:kernel-zfcpdump-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-kvm-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-kvm-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:bpftool-debuginfo-0:7.3.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-debuginfo-common-x86_64-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debug-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-devel-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-core-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-rt-modules-extra-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:kernel-tools-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:libperf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.4.0.Z.MAIN.EUS:python3-perf-debuginfo-0:5.14.0-427.35.1.el9_4.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2023-52801

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domains_itree after splitting iopt_area In iopt_area_split(), if the original iopt_area has filled a domain and is linked to domains_itree, pages_nodes have to be properly reinserted. Otherwise the domains_itree becomes corrupted and we will UAF.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-99 - Improper Control of Resource Identifiers ('Resource Injection')

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Low

CVE-2024-26629

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix RELEASE_LOCKOWNER The test on so_count in nfsd4_release_lockowner() is nonsense and harmful. Revert to using check_for_locks(), changing that to not sleep. First: harmful. As is documented in the kdoc comment for nfsd4_release_lockowner(), the test on so_count can transiently return a false positive resulting in a return of NFS4ERR_LOCKS_HELD when in fact no locks are held. This is clearly a protocol violation and with the Linux NFS client it can cause incorrect behaviour. If RELEASE_LOCKOWNER is sent while some other thread is still processing a LOCK request which failed because, at the time that request was received, the given owner held a conflicting lock, then the nfsd thread processing that LOCK request can hold a reference (conflock) to the lock owner that causes nfsd4_release_lockowner() to return an incorrect error. The Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it never sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so it knows that the error is impossible. It assumes the lock owner was in fact released so it feels free to use the same lock owner identifier in some later locking request. When it does reuse a lock owner identifier for which a previous RELEASE failed, it will naturally use a lock_seqid of zero. However the server, which didn't release the lock owner, will expect a larger lock_seqid and so will respond with NFS4ERR_BAD_SEQID. So clearly it is harmful to allow a false positive, which testing so_count allows. The test is nonsense because ... well... it doesn't mean anything. so_count is the sum of three different counts. 1/ the set of states listed on so_stateids 2/ the set of active vfs locks owned by any of those states 3/ various transient counts such as for conflicting locks. When it is tested against '2' it is clear that one of these is the transient reference obtained by find_lockowner_str_locked(). It is not clear what the other one is expected to be. In practice, the count is often 2 because there is precisely one state on so_stateids. If there were more, this would fail. In my testing I see two circumstances when RELEASE_LOCKOWNER is called. In one case, CLOSE is called before RELEASE_LOCKOWNER. That results in all the lock states being removed, and so the lockowner being discarded (it is removed when there are no more references which usually happens when the lock state is discarded). When nfsd4_release_lockowner() finds that the lock owner doesn't exist, it returns success. The other case shows an so_count of '2' and precisely one state listed in so_stateid. It appears that the Linux client uses a separate lock owner for each file resulting in one lock state per lock owner, so this test on '2' is safe. For another client it might not be safe. So this patch changes check_for_locks() to use the (newish) find_any_file_locked() so that it doesn't take a reference on the nfs4_file and so never calls nfsd_file_put(), and so never sleeps. With this check is it safe to restore the use of check_for_locks() rather than testing so_count against the mysterious '2'.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-393 - Return of Wrong Status Code

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-26630

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix folio read-after-free in cache walk In cachestat, we access the folio from the page cache's xarray to compute its page offset, and check for its dirty and writeback flags. However, we do not hold a reference to the folio before performing these actions, which means the folio can concurrently be released and reused as another folio/page/slab. Get around this altogether by just using xarray's existing machinery for the folio page offsets and dirty/writeback states. This changes behavior for tmpfs files to now always report zeroes in their dirty and writeback counters. This is okay as tmpfs doesn't follow conventional writeback cache behavior: its pages get "cleaned" during swapout, after which they're no longer resident etc.

7.1 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-26720

[REJECTED CVE]

0.0 (None)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CWE-369 - Divide By Zero

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

CVE-2024-26886

A flaw was found in the Linux kernel’s Bluetooth subsystem, specifically within the af_bluetooth module. The issue arises when attempting to perform a sock_lock on the .recvmsg method, leading to a deadlock situation. In this scenario, multiple tasks wait indefinitely for a resource, causing significant performance degradation or system crashes. The vulnerability occurs during Bluetooth operations, where tasks are blocked for more than 30 seconds, creating potential instability. The solution was to replace the sock_sock lock with the sk_receive_queue.lock in the bt_sock_ioctl function to prevent a use-after-free (UAF) condition and avoid the deadlock.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-833 - Deadlock

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-26946

An unsafe read function was found in arch/x86/kernel/kprobes/core.c in the Linux kernel .

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-35791

A security vulnerability was identified in the Linux kernel's Kernel-based Virtual Machine subsystem (KVM), specifically affecting the Secure Virtual Machine (SVM) feature used on AMD processors. The issue arises from a use-after-free condition in the svm_register_enc_region() function, which can lead to system instability or potential exploitation.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-35797

CVE-2024-35797 is a vulnerability in the Linux kernel’s memory management, specifically affecting the cachestat feature when handling shared memory. The flaw stems from race conditions during operations like swapping or invalidation, which can lead to out-of-bounds memory access or invalid pointer dereferencing. These issues can result in crashes or system instability. The kernel has been patched to improve checks and handling of swap entries to ensure stable and safe operation.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-35875

CVE-2024-35875 addresses a security concern in the Linux kernel's handling of confidential computing (CoCo) environments. In these setups, the virtual machine (VM) host is untrusted and may attempt to compromise guest VMs. A critical component for maintaining security in such environments is a reliable random number generator (RNG), which depends on the CPU's RDRAND instruction to generate entropy. The vulnerability arises when the RDRAND instruction fails—due to hardware faults or other issues—leaving the RNG without sufficient entropy sources. This deficiency is particularly problematic during the system's initial boot phase, potentially compromising cryptographic operations and overall system security. In CoCo environments, the untrusted VM host can manipulate or observe most inputs to guest VMs. The primary entropy source for these guests is the CPU's RDRAND instruction. If RDRAND fails, the RNG lacks alternative entropy sources, leading to potential security vulnerabilities. A malfunctioning RDRAND during boot can result in insufficient entropy for cryptographic functions, undermining the security of the CoCo environment.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-36000

CVE-2024-36000 addresses a synchronization issue in the Linux kernel's management of huge pages. The problem arises when multiple threads modify the reservation map concurrently without proper locking, leading to potential inconsistencies and system instability.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-36019

A vulnerability was found in the Linux kernel’s `regmap` subsystem. Due to improper indexing in the `regcache_maple_drop()` function, an out-of-bounds access could corrupt the cache by overwriting parts of it with kernel memory.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-36883

An out-of-bounds memory access flaw was found in the Linux kernel’s networking subsystem in how a local user triggers a complex race condition. This flaw allows a local user to crash or potentially escalate their privileges on the system.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-36979

A use-after-free flaw was found in net/bridge/br_mst.c in the Linux kernel. This issue may lead to compromised Confidentiality and Integrity, and can crash.

6.6 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-38559

In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using kstrtouint. Fix this issue by using memdup_user_nul instead of memdup_user.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Low

CVE-2024-38619

In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing divide errors in alauda_read_data() and alauda_write_lba(). - Add a member "media_initialized" to struct alauda_info. - Change a condition in alauda_check_media() to ensure the first initialization. - Add an error check for the return value of alauda_init_media().

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-457 - Use of Uninitialized Variable

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Low

CVE-2024-40927

A vulnerability was found in the Linux kernel's xHCI driver, related to the handling of TD when multiple streams are active, where the issue occurs when the endpoint is stopped, causing TD to remain uncleared, which can lead to system crashes and memory corruption due to stale TD references.

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CWE-820 - Missing Synchronization

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-40936

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix memregion leaks in devm_cxl_add_region() Move the mode verification to __create_region() before allocating the memregion to avoid the memregion leaks.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

CWE-402 - Transmission of Private Resources into a New Sphere ('Resource Leak')

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Low

CVE-2024-41040

A use-after-free vulnerability was found in the net/sshd tcf_ct_flow_table_process_conn of the Linux kernel. This flaw allows an attacker with a crafted payload to induce a system crash, resulting in a loss of system availability.

5.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-41044

The vulnerability was found in the Linux kernel's ppp ppp_generic.c driver, in the ppp_read() and ppp_write() functions where malformed packets were erroneously identified as LCP packets, leading to potential issues with packet handling. This flaw could potentially lead to system instability.

4.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-20 - Improper Input Validation

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-41055

In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call around "ms->usage" to fix a race with section_deactivate() where ms->usage can be cleared. The READ_ONCE() call, by itself, is not enough to prevent NULL pointer dereference. We need to check its value before dereferencing it.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-41073

A flaw was found in the Linux kernel's NVMe component. This vulnerability is due to a double free error that occurs when a discard request needs to be retried and fails before a new special payload is added. A local attacker could exploit this memory corruption issue to cause a denial of service (DoS).

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-1341 - Multiple Releases of Same Resource or Handle

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-41096

A use after free vulnerability was found in the Linux Kernel. Failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init(), which accesses the descriptor for unmasking in the error exit path, leading to a loss of confidentiality, integrity, and availability.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-42082

A flaw was found in the Linux kernel's xdp subsystem in the __xdp_reg_mem_model() function where a memory allocation failure will trigger a warning if the function __mem_id_init_hash_table() returns an error. This warning is unnecessary as it elevates the severity of a memory allocation failure and pollutes the kernel log with redundant and unnecessary warnings, decreasing the readability of system logs.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-42096

In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up making assumptions based on the stack layout that aren't necessarily valid. Basically, the code tries to account the time spent in spinlocks to the caller rather than the spinlock, and while I support that as a concept, it's not worth the code complexity or the KASAN warnings when no serious profiling is done using timers anyway these days. And the code really does depend on stack layout that is only true in the simplest of cases. We've lost the comment at some point (I think when the 32-bit and 64-bit code was unified), but it used to say: Assume the lock function has either no stack frame or a copy of eflags from PUSHF. which explains why it just blindly loads a word or two straight off the stack pointer and then takes a minimal look at the values to just check if they might be eflags or the return pc: Eflags always has bits 22 and up cleared unlike kernel addresses but that basic stack layout assumption assumes that there isn't any lock debugging etc going on that would complicate the code and cause a stack frame. It causes KASAN unhappiness reported for years by syzkaller [1] and others [2]. With no real practical reason for this any more, just remove the code. Just for historical interest, here's some background commits relating to this code from 2006: 0cb91a229364 ("i386: Account spinlocks to the caller during profiling for !FP kernels") 31679f38d886 ("Simplify profile_pc on x86-64") and a code unification from 2009: ef4512882dbe ("x86: time_32/64.c unify profile_pc") but the basics of this thing actually goes back to before the git tree.

5.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Low

CVE-2024-42102

A vulnerability was found in the wb_dirty_limits() function in the Linux kernel, where a removed (u64) cast in the dtc->wb_thresh * dtc->bg_thresh operation can result in multiplication overflow on 32-bit architectures. This issue could lead to memory corruption or performance issues.

4.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-369 - Divide By Zero

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

CVE-2024-42131

A vulnerability was found in the Linux kernel's memory management subsystem where a lack of proper size checks on dirty limits can lead to situations where large dirty limits end up being larger than 32-bits, resulting in potential overflows and divisions by 0. This can cause memory corruption, system instability, or crashes.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 279 products, the same list as for CVE-2023-52463

Threats

Impact Moderate

References

165 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:6567	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265797	external
https://bugzilla.redhat.com/show_bug.cgi?id=2269434	external
https://bugzilla.redhat.com/show_bug.cgi?id=2269436	external
https://bugzilla.redhat.com/show_bug.cgi?id=2273141	external
https://bugzilla.redhat.com/show_bug.cgi?id=2275678	external
https://bugzilla.redhat.com/show_bug.cgi?id=2278206	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281052	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281151	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281727	external
https://bugzilla.redhat.com/show_bug.cgi?id=2281968	external
https://bugzilla.redhat.com/show_bug.cgi?id=2282709	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284271	external
https://bugzilla.redhat.com/show_bug.cgi?id=2284402	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293273	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293276	external
https://bugzilla.redhat.com/show_bug.cgi?id=2293440	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297511	external
https://bugzilla.redhat.com/show_bug.cgi?id=2297520	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300409	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300414	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300429	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300491	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300520	external
https://bugzilla.redhat.com/show_bug.cgi?id=2300713	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301465	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301496	external
https://bugzilla.redhat.com/show_bug.cgi?id=2301637	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-52463	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265797	external
https://www.cve.org/CVERecord?id=CVE-2023-52463	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52463	external
https://lore.kernel.org/linux-cve-announce/202402…	external
https://access.redhat.com/security/cve/CVE-2023-52801	self
https://bugzilla.redhat.com/show_bug.cgi?id=2282709	external
https://www.cve.org/CVERecord?id=CVE-2023-52801	external
https://nvd.nist.gov/vuln/detail/CVE-2023-52801	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-26629	self
https://bugzilla.redhat.com/show_bug.cgi?id=2269434	external
https://www.cve.org/CVERecord?id=CVE-2024-26629	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26629	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2024-26630	self
https://bugzilla.redhat.com/show_bug.cgi?id=2269436	external
https://www.cve.org/CVERecord?id=CVE-2024-26630	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26630	external
https://lore.kernel.org/linux-cve-announce/202403…	external
https://access.redhat.com/security/cve/CVE-2024-26720	self
https://bugzilla.redhat.com/show_bug.cgi?id=2273141	external
https://www.cve.org/CVERecord?id=CVE-2024-26720	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26720	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26886	self
https://bugzilla.redhat.com/show_bug.cgi?id=2275678	external
https://www.cve.org/CVERecord?id=CVE-2024-26886	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26886	external
https://lore.kernel.org/linux-cve-announce/202404…	external
https://access.redhat.com/security/cve/CVE-2024-26946	self
https://bugzilla.redhat.com/show_bug.cgi?id=2278206	external
https://www.cve.org/CVERecord?id=CVE-2024-26946	external
https://nvd.nist.gov/vuln/detail/CVE-2024-26946	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35791	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281052	external
https://www.cve.org/CVERecord?id=CVE-2024-35791	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35791	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35797	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281151	external
https://www.cve.org/CVERecord?id=CVE-2024-35797	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35797	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-35875	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281727	external
https://www.cve.org/CVERecord?id=CVE-2024-35875	external
https://nvd.nist.gov/vuln/detail/CVE-2024-35875	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36000	self
https://bugzilla.redhat.com/show_bug.cgi?id=2281968	external
https://www.cve.org/CVERecord?id=CVE-2024-36000	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36000	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36019	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284402	external
https://www.cve.org/CVERecord?id=CVE-2024-36019	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36019	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36883	self
https://bugzilla.redhat.com/show_bug.cgi?id=2284271	external
https://www.cve.org/CVERecord?id=CVE-2024-36883	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36883	external
https://lore.kernel.org/linux-cve-announce/202405…	external
https://access.redhat.com/security/cve/CVE-2024-36979	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293276	external
https://www.cve.org/CVERecord?id=CVE-2024-36979	external
https://nvd.nist.gov/vuln/detail/CVE-2024-36979	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38559	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293440	external
https://www.cve.org/CVERecord?id=CVE-2024-38559	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38559	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-38619	self
https://bugzilla.redhat.com/show_bug.cgi?id=2293273	external
https://www.cve.org/CVERecord?id=CVE-2024-38619	external
https://nvd.nist.gov/vuln/detail/CVE-2024-38619	external
https://lore.kernel.org/linux-cve-announce/202406…	external
https://access.redhat.com/security/cve/CVE-2024-40927	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297511	external
https://www.cve.org/CVERecord?id=CVE-2024-40927	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40927	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-40936	self
https://bugzilla.redhat.com/show_bug.cgi?id=2297520	external
https://www.cve.org/CVERecord?id=CVE-2024-40936	external
https://nvd.nist.gov/vuln/detail/CVE-2024-40936	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41040	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300409	external
https://www.cve.org/CVERecord?id=CVE-2024-41040	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41040	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41044	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300414	external
https://www.cve.org/CVERecord?id=CVE-2024-41044	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41044	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41055	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300429	external
https://www.cve.org/CVERecord?id=CVE-2024-41055	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41055	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41073	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301637	external
https://www.cve.org/CVERecord?id=CVE-2024-41073	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41073	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-41096	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300491	external
https://www.cve.org/CVERecord?id=CVE-2024-41096	external
https://nvd.nist.gov/vuln/detail/CVE-2024-41096	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42082	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300520	external
https://www.cve.org/CVERecord?id=CVE-2024-42082	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42082	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42096	self
https://bugzilla.redhat.com/show_bug.cgi?id=2300713	external
https://www.cve.org/CVERecord?id=CVE-2024-42096	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42096	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42102	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301465	external
https://www.cve.org/CVERecord?id=CVE-2024-42102	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42102	external
https://lore.kernel.org/linux-cve-announce/202407…	external
https://access.redhat.com/security/cve/CVE-2024-42131	self
https://bugzilla.redhat.com/show_bug.cgi?id=2301496	external
https://www.cve.org/CVERecord?id=CVE-2024-42131	external
https://nvd.nist.gov/vuln/detail/CVE-2024-42131	external
https://lore.kernel.org/linux-cve-announce/202407…	external

JSON

To clipboard

Loading 2.4 MB of JSON…

CVE-2023-52463 (GCVE-0-2023-52463)

Vulnerability from cvelistv5 – Published: 2024-02-23 14:46 – Updated: 2026-05-23 15:25

Title

efivarfs: force RO when remounting if SetVariable is not supported

Summary

In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-04 20:59 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/94c742324ed7e42c5…
https://git.kernel.org/stable/c/2aa141f8bc580f8f9…
https://git.kernel.org/stable/c/d4a9aa7db574a0da6…
https://git.kernel.org/stable/c/0049fe7e4a85849bd…
https://git.kernel.org/stable/c/d4a714873db0866cc…
https://git.kernel.org/stable/c/0e8d2444168dd519f…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f88814cc2578c121e6edef686365036db72af0ed , < 94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8 (git) Affected: f88814cc2578c121e6edef686365036db72af0ed , < 2aa141f8bc580f8f9811dfe4e0e6009812b73826 (git) Affected: f88814cc2578c121e6edef686365036db72af0ed , < d4a9aa7db574a0da64307729cc031fb68597aa8b (git) Affected: f88814cc2578c121e6edef686365036db72af0ed , < 0049fe7e4a85849bdd778cdb72e51a791ff3d737 (git) Affected: f88814cc2578c121e6edef686365036db72af0ed , < d4a714873db0866cc471521114eeac4a5072d548 (git) Affected: f88814cc2578c121e6edef686365036db72af0ed , < 0e8d2444168dd519fea501599d150e62718ed2fe (git) Affected: 552952e51fad35670459674bcb8a03bd96fe4646 (git) Affected: 5.7.11 , < 5.8 (semver)
Linux	Linux	Affected: 5.8 Unaffected: 0 , < 5.8 (semver) Unaffected: 5.10.209 , ≤ 5.10.* (semver) Unaffected: 5.15.148 , ≤ 5.15.* (semver) Unaffected: 6.1.75 , ≤ 6.1.* (semver) Unaffected: 6.6.14 , ≤ 6.6.* (semver) Unaffected: 6.7.2 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T20:59:53.029082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:24.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:19.782Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2aa141f8bc580f8f9811dfe4e0e6009812b73826"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4a9aa7db574a0da64307729cc031fb68597aa8b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0049fe7e4a85849bdd778cdb72e51a791ff3d737"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d4a714873db0866cc471521114eeac4a5072d548"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0e8d2444168dd519fea501599d150e62718ed2fe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/efivarfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "lessThan": "2aa141f8bc580f8f9811dfe4e0e6009812b73826",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "lessThan": "d4a9aa7db574a0da64307729cc031fb68597aa8b",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "lessThan": "0049fe7e4a85849bdd778cdb72e51a791ff3d737",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "lessThan": "d4a714873db0866cc471521114eeac4a5072d548",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "lessThan": "0e8d2444168dd519fea501599d150e62718ed2fe",
              "status": "affected",
              "version": "f88814cc2578c121e6edef686365036db72af0ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "552952e51fad35670459674bcb8a03bd96fe4646",
              "versionType": "git"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/efivarfs/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefivarfs: force RO when remounting if SetVariable is not supported\n\nIf SetVariable at runtime is not supported by the firmware we never assign\na callback for that function. At the same time mount the efivarfs as\nRO so no one can call that.  However, we never check the permission flags\nwhen someone remounts the filesystem as RW. As a result this leads to a\ncrash looking like this:\n\n$ mount -o remount,rw /sys/firmware/efi/efivars\n$ efi-updatevar -f PK.auth PK\n\n[  303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[  303.280482] Mem abort info:\n[  303.280854]   ESR = 0x0000000086000004\n[  303.281338]   EC = 0x21: IABT (current EL), IL = 32 bits\n[  303.282016]   SET = 0, FnV = 0\n[  303.282414]   EA = 0, S1PTW = 0\n[  303.282821]   FSC = 0x04: level 0 translation fault\n[  303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000\n[  303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000\n[  303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP\n[  303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6\n[  303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1\n[  303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023\n[  303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[  303.292123] pc : 0x0\n[  303.292443] lr : efivar_set_variable_locked+0x74/0xec\n[  303.293156] sp : ffff800008673c10\n[  303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000\n[  303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027\n[  303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000\n[  303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000\n[  303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54\n[  303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4\n[  303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002\n[  303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201\n[  303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc\n[  303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000\n[  303.303341] Call trace:\n[  303.303679]  0x0\n[  303.303938]  efivar_entry_set_get_size+0x98/0x16c\n[  303.304585]  efivarfs_file_write+0xd0/0x1a4\n[  303.305148]  vfs_write+0xc4/0x2e4\n[  303.305601]  ksys_write+0x70/0x104\n[  303.306073]  __arm64_sys_write+0x1c/0x28\n[  303.306622]  invoke_syscall+0x48/0x114\n[  303.307156]  el0_svc_common.constprop.0+0x44/0xec\n[  303.307803]  do_el0_svc+0x38/0x98\n[  303.308268]  el0_svc+0x2c/0x84\n[  303.308702]  el0t_64_sync_handler+0xf4/0x120\n[  303.309293]  el0t_64_sync+0x190/0x194\n[  303.309794] Code: ???????? ???????? ???????? ???????? (????????)\n[  303.310612] ---[ end trace 0000000000000000 ]---\n\nFix this by adding a .reconfigure() function to the fs operations which\nwe can use to check the requested flags and deny anything that\u0027s not RO\nif the firmware doesn\u0027t implement SetVariable at runtime."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:25:39.169Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/94c742324ed7e42c5bd6a9ed22e4ec6d764db4d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2aa141f8bc580f8f9811dfe4e0e6009812b73826"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4a9aa7db574a0da64307729cc031fb68597aa8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0049fe7e4a85849bdd778cdb72e51a791ff3d737"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4a714873db0866cc471521114eeac4a5072d548"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e8d2444168dd519fea501599d150e62718ed2fe"
        }
      ],
      "title": "efivarfs: force RO when remounting if SetVariable is not supported",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52463",
    "datePublished": "2024-02-23T14:46:23.537Z",
    "dateReserved": "2024-02-20T12:30:33.296Z",
    "dateUpdated": "2026-05-23T15:25:39.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52801 (GCVE-0-2023-52801)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:31 – Updated: 2026-08-05 09:11

Title

iommufd: Fix missing update of domains_itree after splitting iopt_area

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-24 15:13 UTC

CWE

CWE-284 - Improper Access Control

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/836db2e7e4565d821…
https://git.kernel.org/stable/c/fcb32111f01ddf3cb…
https://git.kernel.org/stable/c/e7250ab7ca4998fe0…

Impacted products

10 products

Vendor	Product	Version
Linux	Linux	Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < 836db2e7e4565d8218923b3552304a1637e2f28d (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < fcb32111f01ddf3cbd04644cde1773428e31de6a (git) Affected: 51fe6141f0f64ae0bbc096a41a07572273e8c0ef , < e7250ab7ca4998fe026f2149805b03e09dc32498 (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.5.13 , ≤ 6.5.* (semver) Unaffected: 6.6.3 , ≤ 6.6.* (semver) Unaffected: 6.7 , ≤ * (original_commit_for_fix)
linux	linux_kernel	Affected: 51fe6141f0f6 , < 836db2e7e456 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 51fe6141f0f6 , < fcb32111f01d (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 51fe6141f0f6 , < e7250ab7ca49 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Affected: 6..2 cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	Unaffected: 0 , < 6.2 (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.5.13 , ≤ 6.5.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.6.3 , ≤ 6.6.* (custom) cpe:2.3:o:linux:linux_kernel:-:::::::*
linux	linux_kernel	Unaffected: 6.7 cpe:2.3:o:linux:linux_kernel:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "836db2e7e456",
                "status": "affected",
                "version": "51fe6141f0f6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "fcb32111f01d",
                "status": "affected",
                "version": "51fe6141f0f6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e7250ab7ca49",
                "status": "affected",
                "version": "51fe6141f0f6",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "6..2"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6.2",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.5.*",
                "status": "unaffected",
                "version": "6.5.13",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.7"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52801",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T15:13:11.142898Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:19:30.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.602Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "836db2e7e4565d8218923b3552304a1637e2f28d",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "fcb32111f01ddf3cbd04644cde1773428e31de6a",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            },
            {
              "lessThan": "e7250ab7ca4998fe026f2149805b03e09dc32498",
              "status": "affected",
              "version": "51fe6141f0f64ae0bbc096a41a07572273e8c0ef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/io_pagetable.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Fix missing update of domains_itree after splitting iopt_area\n\nIn iopt_area_split(), if the original iopt_area has filled a domain and is\nlinked to domains_itree, pages_nodes have to be properly\nreinserted. Otherwise the domains_itree becomes corrupted and we will UAF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local ioctls on /dev/iommu or /dev/vfio/vfio (VFIO_IOMMU_UNMAP_DMA \u2192 iopt_cut_iova \u2192 iopt_area_split); there is no network or adjacent-network path.\nAC:L - The attacker fully controls the preconditions\u2014disable large pages (VFIO_TYPE1_IOMMU or IOMMU_OPTION_HUGE_PAGES), map an IOVA range with a filled domain, then partial-unmap to force the split\u2014so the domains_itree UAF is deterministic with no race or external condition.\nPR:L - iommufd_fops_open() has no capability check; access is only DAC on /dev/iommu (0660) or /dev/vfio/vfio (0666), routinely granted to unprivileged qemu/libvirt passthrough users, matching other iommufd CVEs scored PR:L.\nUI:N - The full map/set-iommu/partial-unmap sequence is issued by the attacker\u0027s own process with no victim interaction required.\nS:C - domains_itree tracks which iopt_areas hold DMA-mapped PFNs in live iommu_domains; leaving a freed area linked and then walking/removing from that tree corrupts IOMMU mapping bookkeeping and can unpin or mis-resolve pages still device-mapped, defeating the DMA isolation boundary.\nC:H - The commit documents a use-after-free on the freed iopt_area still linked in domains_itree; UAF of a sprayable kzalloc object enables arbitrary kernel memory disclosure, and corrupted domain PFN lookup can expose host pages to device DMA.\nI:H - The same UAF/tree corruption yields write primitives via interval-tree remove/insert on attacker-reclaimed memory and broken unpin/unmap of IOMMU-backed pages, enabling control-flow hijack and integrity compromise.\nA:H - Use-after-free on domains_itree walks causes kernel oops/panic, and interval-tree operations on a dangling freed node can hang or crash subsequent iommufd unmap/destroy paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:28.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/836db2e7e4565d8218923b3552304a1637e2f28d"
        },
        {
          "url": "https://git.kernel.org/stable/c/fcb32111f01ddf3cbd04644cde1773428e31de6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7250ab7ca4998fe026f2149805b03e09dc32498"
        }
      ],
      "title": "iommufd: Fix missing update of domains_itree after splitting iopt_area",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52801",
    "datePublished": "2024-05-21T15:31:13.700Z",
    "dateReserved": "2024-05-21T15:19:24.247Z",
    "dateUpdated": "2026-08-05T09:11:28.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26629 (GCVE-0-2024-26629)

Vulnerability from cvelistv5 – Published: 2024-03-13 14:01 – Updated: 2026-05-23 15:36

Title

nfsd: fix RELEASE_LOCKOWNER

Summary

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-21 16:10 UTC

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/10d75984495f7fe62…
https://git.kernel.org/stable/c/99fb654d01dc3f08b…
https://git.kernel.org/stable/c/c6f8b3fcc62725e41…
https://git.kernel.org/stable/c/e4cf8941664cae2f8…
https://git.kernel.org/stable/c/b7d2eee1f53899b53…
https://git.kernel.org/stable/c/8f5b860de87039b00…
https://git.kernel.org/stable/c/edcf9725150e42bee…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

3 products

Vendor	Product	Version
Linux	Linux	Affected: ef481b262bba4f454351eec43f024fec942c2d4c , < 10d75984495f7fe62152c3b0dbfa3f0a6b739c9b (git) Affected: 3097f38e91266c7132c3fdb7e778fac858c00670 , < 99fb654d01dc3f08b5905c663ad6c89a9d83302f (git) Affected: e2fc17fcc503cfca57b5d1dd3b646ca7eebead97 , < c6f8b3fcc62725e4129f2c0fd550d022d4a7685a (git) Affected: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b , < e4cf8941664cae2f89f0189c29fe2ce8c6be0d03 (git) Affected: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b , < b7d2eee1f53899b53f069bba3a59a419fc3d331b (git) Affected: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b , < 8f5b860de87039b007e84a28a5eefc888154e098 (git) Affected: ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b , < edcf9725150e42beeca42d085149f4c88fa97afd (git) Affected: fea1d0940301378206955264a01778700fc9c16f (git) Affected: 2ec65dc6635d1976bd1dbf2640ff7f810b2f6dd1 (git) Affected: a2235bc65ade40982c3d09025cdd34bc539d6a69 (git) Affected: ba747abfca27e23c42ded3912c87b70d7e16b6ab (git) Affected: e8020d96dd5b2dcc1f6a8ee4f87a53a373002cd5 (git) Affected: 4.19.246 , < 4.19.306 (semver) Affected: 5.10.120 , < 5.10.220 (semver) Affected: 5.15.45 , < 5.15.154 (semver) Affected: 4.9.317 , < 4.10 (semver) Affected: 4.14.282 , < 4.15 (semver) Affected: 5.4.197 , < 5.5 (semver) Affected: 5.17.13 , < 5.18 (semver) Affected: 5.18.2 , < 5.19 (semver)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 4.19.306 , ≤ 4.19.* (semver) Unaffected: 5.10.220 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.79 , ≤ 6.1.* (semver) Unaffected: 6.6.15 , ≤ 6.6.* (semver) Unaffected: 6.7.3 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Siemens	SIMATIC S7-1500 TM MFP - GNU/Linux subsystem	Affected: 0 , < * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26629",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T16:10:40.555857Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T16:10:48.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99fb654d01dc3f08b5905c663ad6c89a9d83302f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c6f8b3fcc62725e4129f2c0fd550d022d4a7685a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e4cf8941664cae2f89f0189c29fe2ce8c6be0d03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7d2eee1f53899b53f069bba3a59a419fc3d331b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8f5b860de87039b007e84a28a5eefc888154e098"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/edcf9725150e42beeca42d085149f4c88fa97afd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:49:20.693Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "10d75984495f7fe62152c3b0dbfa3f0a6b739c9b",
              "status": "affected",
              "version": "ef481b262bba4f454351eec43f024fec942c2d4c",
              "versionType": "git"
            },
            {
              "lessThan": "99fb654d01dc3f08b5905c663ad6c89a9d83302f",
              "status": "affected",
              "version": "3097f38e91266c7132c3fdb7e778fac858c00670",
              "versionType": "git"
            },
            {
              "lessThan": "c6f8b3fcc62725e4129f2c0fd550d022d4a7685a",
              "status": "affected",
              "version": "e2fc17fcc503cfca57b5d1dd3b646ca7eebead97",
              "versionType": "git"
            },
            {
              "lessThan": "e4cf8941664cae2f89f0189c29fe2ce8c6be0d03",
              "status": "affected",
              "version": "ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b",
              "versionType": "git"
            },
            {
              "lessThan": "b7d2eee1f53899b53f069bba3a59a419fc3d331b",
              "status": "affected",
              "version": "ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b",
              "versionType": "git"
            },
            {
              "lessThan": "8f5b860de87039b007e84a28a5eefc888154e098",
              "status": "affected",
              "version": "ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b",
              "versionType": "git"
            },
            {
              "lessThan": "edcf9725150e42beeca42d085149f4c88fa97afd",
              "status": "affected",
              "version": "ce3c4ad7f4ce5db7b4f08a1e237d8dd94b39180b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fea1d0940301378206955264a01778700fc9c16f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2ec65dc6635d1976bd1dbf2640ff7f810b2f6dd1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a2235bc65ade40982c3d09025cdd34bc539d6a69",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ba747abfca27e23c42ded3912c87b70d7e16b6ab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e8020d96dd5b2dcc1f6a8ee4f87a53a373002cd5",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.306",
              "status": "affected",
              "version": "4.19.246",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.220",
              "status": "affected",
              "version": "5.10.120",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.154",
              "status": "affected",
              "version": "5.15.45",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.317",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.282",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.197",
              "versionType": "semver"
            },
            {
              "lessThan": "5.18",
              "status": "affected",
              "version": "5.17.13",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.19.246",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.220",
                  "versionStartIncluding": "5.10.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.15.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.79",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.317",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.282",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.197",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.17.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: fix RELEASE_LOCKOWNER\n\nThe test on so_count in nfsd4_release_lockowner() is nonsense and\nharmful.  Revert to using check_for_locks(), changing that to not sleep.\n\nFirst: harmful.\nAs is documented in the kdoc comment for nfsd4_release_lockowner(), the\ntest on so_count can transiently return a false positive resulting in a\nreturn of NFS4ERR_LOCKS_HELD when in fact no locks are held.  This is\nclearly a protocol violation and with the Linux NFS client it can cause\nincorrect behaviour.\n\nIf RELEASE_LOCKOWNER is sent while some other thread is still\nprocessing a LOCK request which failed because, at the time that request\nwas received, the given owner held a conflicting lock, then the nfsd\nthread processing that LOCK request can hold a reference (conflock) to\nthe lock owner that causes nfsd4_release_lockowner() to return an\nincorrect error.\n\nThe Linux NFS client ignores that NFS4ERR_LOCKS_HELD error because it\nnever sends NFS4_RELEASE_LOCKOWNER without first releasing any locks, so\nit knows that the error is impossible.  It assumes the lock owner was in\nfact released so it feels free to use the same lock owner identifier in\nsome later locking request.\n\nWhen it does reuse a lock owner identifier for which a previous RELEASE\nfailed, it will naturally use a lock_seqid of zero.  However the server,\nwhich didn\u0027t release the lock owner, will expect a larger lock_seqid and\nso will respond with NFS4ERR_BAD_SEQID.\n\nSo clearly it is harmful to allow a false positive, which testing\nso_count allows.\n\nThe test is nonsense because ... well... it doesn\u0027t mean anything.\n\nso_count is the sum of three different counts.\n1/ the set of states listed on so_stateids\n2/ the set of active vfs locks owned by any of those states\n3/ various transient counts such as for conflicting locks.\n\nWhen it is tested against \u00272\u0027 it is clear that one of these is the\ntransient reference obtained by find_lockowner_str_locked().  It is not\nclear what the other one is expected to be.\n\nIn practice, the count is often 2 because there is precisely one state\non so_stateids.  If there were more, this would fail.\n\nIn my testing I see two circumstances when RELEASE_LOCKOWNER is called.\nIn one case, CLOSE is called before RELEASE_LOCKOWNER.  That results in\nall the lock states being removed, and so the lockowner being discarded\n(it is removed when there are no more references which usually happens\nwhen the lock state is discarded).  When nfsd4_release_lockowner() finds\nthat the lock owner doesn\u0027t exist, it returns success.\n\nThe other case shows an so_count of \u00272\u0027 and precisely one state listed\nin so_stateid.  It appears that the Linux client uses a separate lock\nowner for each file resulting in one lock state per lock owner, so this\ntest on \u00272\u0027 is safe.  For another client it might not be safe.\n\nSo this patch changes check_for_locks() to use the (newish)\nfind_any_file_locked() so that it doesn\u0027t take a reference on the\nnfs4_file and so never calls nfsd_file_put(), and so never sleeps.  With\nthis check is it safe to restore the use of check_for_locks() rather\nthan testing so_count against the mysterious \u00272\u0027."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:36:10.348Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/10d75984495f7fe62152c3b0dbfa3f0a6b739c9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/99fb654d01dc3f08b5905c663ad6c89a9d83302f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6f8b3fcc62725e4129f2c0fd550d022d4a7685a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4cf8941664cae2f89f0189c29fe2ce8c6be0d03"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7d2eee1f53899b53f069bba3a59a419fc3d331b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f5b860de87039b007e84a28a5eefc888154e098"
        },
        {
          "url": "https://git.kernel.org/stable/c/edcf9725150e42beeca42d085149f4c88fa97afd"
        }
      ],
      "title": "nfsd: fix RELEASE_LOCKOWNER",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26629",
    "datePublished": "2024-03-13T14:01:49.452Z",
    "dateReserved": "2024-02-19T14:20:24.135Z",
    "dateUpdated": "2026-05-23T15:36:10.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26630 (GCVE-0-2024-26630)

Vulnerability from cvelistv5 – Published: 2024-03-13 15:50 – Updated: 2026-08-05 11:26

Title

mm: cachestat: fix folio read-after-free in cache walk

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-13 19:45 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ba60fdf75e89ea762…
https://git.kernel.org/stable/c/fe7e008e0ce728252…
https://git.kernel.org/stable/c/3a75cb05d53f4a682…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < ba60fdf75e89ea762bb617be578dc47f27655117 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < fe7e008e0ce728252e4ec652cceebcc62211657c (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 3a75cb05d53f4a6823a32deb078de1366954a804 (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.21 , ≤ 6.6.* (semver) Unaffected: 6.7.9 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26630",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-13T19:45:46.313433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:39.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:07:19.749Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba60fdf75e89ea762bb617be578dc47f27655117"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fe7e008e0ce728252e4ec652cceebcc62211657c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a75cb05d53f4a6823a32deb078de1366954a804"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba60fdf75e89ea762bb617be578dc47f27655117",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "fe7e008e0ce728252e4ec652cceebcc62211657c",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "3a75cb05d53f4a6823a32deb078de1366954a804",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.21",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix folio read-after-free in cache walk\n\nIn cachestat, we access the folio from the page cache\u0027s xarray to compute\nits page offset, and check for its dirty and writeback flags.  However, we\ndo not hold a reference to the folio before performing these actions,\nwhich means the folio can concurrently be released and reused as another\nfolio/page/slab.\n\nGet around this altogether by just using xarray\u0027s existing machinery for\nthe folio page offsets and dirty/writeback states.\n\nThis changes behavior for tmpfs files to now always report zeroes in their\ndirty and writeback counters.  This is okay as tmpfs doesn\u0027t follow\nconventional writeback cache behavior: its pages get \"cleaned\" during\nswapout, after which they\u0027re no longer resident etc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local `cachestat(2)` system call on an open file descriptor. There is no remote or adjacent-network path to `filemap_cachestat()`.\nAC:L - Although this is a race, the attacker drives both sides of it: one thread loops on `cachestat()` while another loops `POSIX_FADV_DONTNEED`/truncate on a file it owns (e.g. a memfd) plus a slab-spray thread, so the window is created and retried at will with no dependence on conditions outside the attacker\u0027s control.\nPR:L - The syscall performs no capability or permission check beyond `fdget()` \u2014 any unprivileged local user with any open file descriptor can call it, and `CONFIG_CACHESTAT_SYSCALL` is `default y` in stock kernels.\nUI:N - The attacker\u0027s own processes populate the page cache, evict it, and call the syscall; no victim action is needed at any point.\nS:U - The read-after-free occurs in kernel memory and the disclosed data is returned to the calling process within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading the freed-and-reused `struct page` leaks stale metadata whose reuse the attacker can groom, and the pointer-sized `folio-\u003eindex` value (SLUB\u0027s `slab.freelist`) is recoverable exactly from the returned `nr_cache` counter, giving repeatable full kernel-heap address disclosure and KASLR defeat.\nI:N - Every access to the freed folio on this path is a read; the results are accumulated into a stack `struct cachestat` copied to the caller\u0027s own buffer, so no kernel memory is modified and no write primitive is created.\nA:H - This is a use-after-free, which crashes even when not exploited: a stale `PG_head` bit sends the read to `page[1]`, which can fault on an unpopulated vmemmap section on memory-hole/hotplug systems, and KASAN-instrumented kernels panic on the UAF report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:26:23.659Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba60fdf75e89ea762bb617be578dc47f27655117"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe7e008e0ce728252e4ec652cceebcc62211657c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a75cb05d53f4a6823a32deb078de1366954a804"
        }
      ],
      "title": "mm: cachestat: fix folio read-after-free in cache walk",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26630",
    "datePublished": "2024-03-13T15:50:32.480Z",
    "dateReserved": "2024-02-19T14:20:24.135Z",
    "dateUpdated": "2026-08-05T11:26:23.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26720 (GCVE-0-2024-26720)

Vulnerability from cvelistv5 – Published: 2024-04-03 14:55 – Updated: 2024-12-19 11:15

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2024-12-19T11:15:27.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26720",
    "datePublished": "2024-04-03T14:55:20.286Z",
    "dateRejected": "2024-12-19T11:15:27.766Z",
    "dateReserved": "2024-02-19T14:20:24.161Z",
    "dateUpdated": "2024-12-19T11:15:27.766Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-26886 (GCVE-0-2024-26886)

Vulnerability from cvelistv5 – Published: 2024-04-17 10:27 – Updated: 2026-06-01 16:04

Title

Bluetooth: af_bluetooth: Fix deadlock

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .recvmsg may cause a deadlock as shown bellow, so instead of using sock_sock this uses sk_receive_queue.lock on bt_sock_ioctl to avoid the UAF: INFO: task kworker/u9:1:121 blocked for more than 30 seconds. Not tainted 6.7.6-lemon #183 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __schedule+0x37d/0xa00 schedule+0x32/0xe0 __lock_sock+0x68/0xa0 ? __pfx_autoremove_wake_function+0x10/0x10 lock_sock_nested+0x43/0x50 l2cap_sock_recv_cb+0x21/0xa0 l2cap_recv_frame+0x55b/0x30a0 ? psi_task_switch+0xeb/0x270 ? finish_task_switch.isra.0+0x93/0x2a0 hci_rx_work+0x33a/0x3f0 process_one_work+0x13a/0x2f0 worker_thread+0x2f0/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe0/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK>

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:41 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/60673f442984fe689…
https://git.kernel.org/stable/c/64be3c61548862007…
https://git.kernel.org/stable/c/817e8138ce86001b2…
https://git.kernel.org/stable/c/2c9e2df022ef8b9d7…
https://git.kernel.org/stable/c/f7b94bdc1ec107c92…
https://git.kernel.org/stable/c/cb8adca52f306563d…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2b16d960c79abc397f102c3d23d30005b68cb036 , < 60673f442984fe689d4127a5dd4be414247b3d67 (git) Affected: 1d576c3a5af850bf11fbd103f9ba11aa6d6061fb , < 64be3c6154886200708da0dfe259705fb992416c (git) Affected: 2e07e8348ea454615e268222ae3fc240421be768 , < 817e8138ce86001b2fa5c63d6ede756e205a01f7 (git) Affected: 2e07e8348ea454615e268222ae3fc240421be768 , < 2c9e2df022ef8b9d7fac58a04a2ef4ed25288955 (git) Affected: 2e07e8348ea454615e268222ae3fc240421be768 , < f7b94bdc1ec107c92262716b073b3e816d4784fb (git) Affected: db1b14eec8c61a20374de9f9c2ddc6c9406a8c42 (git) Affected: 37f71e2c9f515834841826f4eb68ec33cfb2a1ff (git) Affected: 5.15.146 , < 5.15.209 (semver) Affected: 6.6.9 , < 6.6.23 (semver) Affected: 5.10.206 , < 5.11 (semver) Affected: 6.1.70 , < 6.2 (semver)
Linux	Linux	Affected: 6.7 Unaffected: 0 , < 6.7 (semver) Unaffected: 5.15.209 , ≤ 5.15.* (semver) Unaffected: 6.6.23 , ≤ 6.6.* (semver) Unaffected: 6.7.11 , ≤ 6.7.* (semver) Unaffected: 6.8.2 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26886",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:41:20.868479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-04T17:57:18.191Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:04.229Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cb8adca52f306563d958a863bb0cbae9c184d1ae"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "60673f442984fe689d4127a5dd4be414247b3d67",
              "status": "affected",
              "version": "2b16d960c79abc397f102c3d23d30005b68cb036",
              "versionType": "git"
            },
            {
              "lessThan": "64be3c6154886200708da0dfe259705fb992416c",
              "status": "affected",
              "version": "1d576c3a5af850bf11fbd103f9ba11aa6d6061fb",
              "versionType": "git"
            },
            {
              "lessThan": "817e8138ce86001b2fa5c63d6ede756e205a01f7",
              "status": "affected",
              "version": "2e07e8348ea454615e268222ae3fc240421be768",
              "versionType": "git"
            },
            {
              "lessThan": "2c9e2df022ef8b9d7fac58a04a2ef4ed25288955",
              "status": "affected",
              "version": "2e07e8348ea454615e268222ae3fc240421be768",
              "versionType": "git"
            },
            {
              "lessThan": "f7b94bdc1ec107c92262716b073b3e816d4784fb",
              "status": "affected",
              "version": "2e07e8348ea454615e268222ae3fc240421be768",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "db1b14eec8c61a20374de9f9c2ddc6c9406a8c42",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "37f71e2c9f515834841826f4eb68ec33cfb2a1ff",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.209",
              "status": "affected",
              "version": "5.15.146",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.23",
              "status": "affected",
              "version": "6.6.9",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.206",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.70",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/af_bluetooth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.23",
                  "versionStartIncluding": "6.6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.206",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.70",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: af_bluetooth: Fix deadlock\n\nAttemting to do sock_lock on .recvmsg may cause a deadlock as shown\nbellow, so instead of using sock_sock this uses sk_receive_queue.lock\non bt_sock_ioctl to avoid the UAF:\n\nINFO: task kworker/u9:1:121 blocked for more than 30 seconds.\n      Not tainted 6.7.6-lemon #183\nWorkqueue: hci0 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n __schedule+0x37d/0xa00\n schedule+0x32/0xe0\n __lock_sock+0x68/0xa0\n ? __pfx_autoremove_wake_function+0x10/0x10\n lock_sock_nested+0x43/0x50\n l2cap_sock_recv_cb+0x21/0xa0\n l2cap_recv_frame+0x55b/0x30a0\n ? psi_task_switch+0xeb/0x270\n ? finish_task_switch.isra.0+0x93/0x2a0\n hci_rx_work+0x33a/0x3f0\n process_one_work+0x13a/0x2f0\n worker_thread+0x2f0/0x410\n ? __pfx_worker_thread+0x10/0x10\n kthread+0xe0/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:04:31.416Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/60673f442984fe689d4127a5dd4be414247b3d67"
        },
        {
          "url": "https://git.kernel.org/stable/c/64be3c6154886200708da0dfe259705fb992416c"
        },
        {
          "url": "https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7b94bdc1ec107c92262716b073b3e816d4784fb"
        }
      ],
      "title": "Bluetooth: af_bluetooth: Fix deadlock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26886",
    "datePublished": "2024-04-17T10:27:40.941Z",
    "dateReserved": "2024-02-19T14:20:24.185Z",
    "dateUpdated": "2026-06-01T16:04:31.416Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26946 (GCVE-0-2024-26946)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:18 – Updated: 2026-05-11 20:07

Title

kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address

Summary

In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used before checking the address is in text or not. Syzcaller bot found a bug and reported the case if user specifies inaccessible data area, arch_adjust_kprobe_addr() will cause a kernel panic. [ mingo: Clarified the comment. ]

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-10 18:35 UTC

Assigner

Linux mitre root

References

5 references

URL	Tags
https://git.kernel.org/stable/c/6417684315087904f…
https://git.kernel.org/stable/c/f13edd1871d4fb4ab…
https://git.kernel.org/stable/c/20fdb21eabaeb8f78…
https://git.kernel.org/stable/c/b69f577308f107000…
https://git.kernel.org/stable/c/4e51653d5d871f40f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cc66bb91457827f62e2b6cb2518666820f0a6c48 , < 6417684315087904fffe8966d27ca74398c57dd6 (git) Affected: cc66bb91457827f62e2b6cb2518666820f0a6c48 , < f13edd1871d4fb4ab829aff629d47914e251bae3 (git) Affected: cc66bb91457827f62e2b6cb2518666820f0a6c48 , < 20fdb21eabaeb8f78f8f701f56d14ea0836ec861 (git) Affected: cc66bb91457827f62e2b6cb2518666820f0a6c48 , < b69f577308f1070004cafac106dd1a44099e5483 (git) Affected: cc66bb91457827f62e2b6cb2518666820f0a6c48 , < 4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b (git)
Linux	Linux	Affected: 5.18 Unaffected: 0 , < 5.18 (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26946",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-10T18:35:25.300440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-05T17:22:47.208Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.831Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6417684315087904fffe8966d27ca74398c57dd6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f13edd1871d4fb4ab829aff629d47914e251bae3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/20fdb21eabaeb8f78f8f701f56d14ea0836ec861"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b69f577308f1070004cafac106dd1a44099e5483"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kprobes/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6417684315087904fffe8966d27ca74398c57dd6",
              "status": "affected",
              "version": "cc66bb91457827f62e2b6cb2518666820f0a6c48",
              "versionType": "git"
            },
            {
              "lessThan": "f13edd1871d4fb4ab829aff629d47914e251bae3",
              "status": "affected",
              "version": "cc66bb91457827f62e2b6cb2518666820f0a6c48",
              "versionType": "git"
            },
            {
              "lessThan": "20fdb21eabaeb8f78f8f701f56d14ea0836ec861",
              "status": "affected",
              "version": "cc66bb91457827f62e2b6cb2518666820f0a6c48",
              "versionType": "git"
            },
            {
              "lessThan": "b69f577308f1070004cafac106dd1a44099e5483",
              "status": "affected",
              "version": "cc66bb91457827f62e2b6cb2518666820f0a6c48",
              "versionType": "git"
            },
            {
              "lessThan": "4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b",
              "status": "affected",
              "version": "cc66bb91457827f62e2b6cb2518666820f0a6c48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kernel/kprobes/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address\n\nRead from an unsafe address with copy_from_kernel_nofault() in\narch_adjust_kprobe_addr() because this function is used before checking\nthe address is in text or not. Syzcaller bot found a bug and reported\nthe case if user specifies inaccessible data area,\narch_adjust_kprobe_addr() will cause a kernel panic.\n\n[ mingo: Clarified the comment. ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:07:26.318Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6417684315087904fffe8966d27ca74398c57dd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f13edd1871d4fb4ab829aff629d47914e251bae3"
        },
        {
          "url": "https://git.kernel.org/stable/c/20fdb21eabaeb8f78f8f701f56d14ea0836ec861"
        },
        {
          "url": "https://git.kernel.org/stable/c/b69f577308f1070004cafac106dd1a44099e5483"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b"
        }
      ],
      "title": "kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26946",
    "datePublished": "2024-05-01T05:18:13.192Z",
    "dateReserved": "2024-02-19T14:20:24.197Z",
    "dateUpdated": "2026-05-11T20:07:26.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35791 (GCVE-0-2024-35791)

Vulnerability from cvelistv5 – Published: 2024-05-17 12:24 – Updated: 2026-08-05 11:29

Title

KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region()

Summary

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:42 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/2d13b79640b147bd7…
https://git.kernel.org/stable/c/e126b508ed2e616d6…
https://git.kernel.org/stable/c/4868c0ecdb6cfde7c…
https://git.kernel.org/stable/c/12f8e32a5a389a5d5…
https://git.kernel.org/stable/c/f6d53d8a2617dd58c…
https://git.kernel.org/stable/c/5ef1d8c1ddbf696e4…
https://lists.debian.org/debian-lts-announce/2024…	x_transferred

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 4f627ecde7329e476a077bb0590db8f27bb8f912 , < 2d13b79640b147bd77c34a5998533b2021a4122d (git) Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < e126b508ed2e616d679d85fca2fbe77bb48bbdd7 (git) Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865 (git) Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 12f8e32a5a389a5d58afc67728c76e61beee1ad4 (git) Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < f6d53d8a2617dd58c89171a6b9610c470ebda38a (git) Affected: 19a23da53932bc8011220bd8c410cb76012de004 , < 5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807 (git) Affected: f1ecde00ce1694597f923f0d25f7a797c5243d99 (git) Affected: 848bcb0a1d96f67d075465667d3a1ad4af56311e (git) Affected: 5.10.15 , < 5.10.215 (semver) Affected: 4.19.176 , < 4.20 (semver) Affected: 5.4.98 , < 5.5 (semver)
Linux	Linux	Affected: 5.11 Unaffected: 0 , < 5.11 (semver) Unaffected: 5.10.215 , ≤ 5.10.* (semver) Unaffected: 5.15.154 , ≤ 5.15.* (semver) Unaffected: 6.1.84 , ≤ 6.1.* (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.497Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35791",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:42:51.101780Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:23.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d13b79640b147bd77c34a5998533b2021a4122d",
              "status": "affected",
              "version": "4f627ecde7329e476a077bb0590db8f27bb8f912",
              "versionType": "git"
            },
            {
              "lessThan": "e126b508ed2e616d679d85fca2fbe77bb48bbdd7",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "12f8e32a5a389a5d58afc67728c76e61beee1ad4",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "f6d53d8a2617dd58c89171a6b9610c470ebda38a",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "lessThan": "5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807",
              "status": "affected",
              "version": "19a23da53932bc8011220bd8c410cb76012de004",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f1ecde00ce1694597f923f0d25f7a797c5243d99",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "848bcb0a1d96f67d075465667d3a1ad4af56311e",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.215",
              "status": "affected",
              "version": "5.10.15",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.176",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.98",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/sev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.215",
                  "versionStartIncluding": "5.10.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.84",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.98",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()\n\nDo the cache flush of converted pages in svm_register_enc_region() before\ndropping kvm-\u003elock to fix use-after-free issues where region and/or its\narray of pages could be freed by a different task, e.g. if userspace has\n__unregister_enc_region_locked() already queued up for the region.\n\nNote, the \"obvious\" alternative of using local variables doesn\u0027t fully\nresolve the bug, as region-\u003epages is also dynamically allocated.  I.e. the\nregion structure itself would be fine, but region-\u003epages could be freed.\n\nFlushing multiple pages under kvm-\u003elock is unfortunate, but the entire\nflow is a rare slow path, and the manual flush is only needed on CPUs that\nlack coherency for encrypted memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the `KVM_MEMORY_ENCRYPT_REG_REGION`/`KVM_MEMORY_ENCRYPT_UNREG_REGION` ioctls on a local KVM VM file descriptor obtained from /dev/kvm. There is no remote or network-facing path to `sev_mem_enc_register_region()`.\nAC:L - The attacker controls both sides of the race, issuing the register and unregister ioctls from two threads it owns, and can widen the window arbitrarily by registering a large region since `sev_clflush_pages()` loops per page with `cond_resched()` after the lock is dropped. Nothing about winning the race depends on conditions outside the attacker\u0027s influence.\nPR:L - No capability check exists on the path \u2014 neither `kvm_arch_vm_ioctl()`\u0027s `KVM_MEMORY_ENCRYPT_*_REGION` cases nor `sev_guest_init()` require CAP_SYS_ADMIN \u2014 so any local user with access to /dev/kvm (commonly granted via the `kvm` group or permissive device modes on virtualization hosts) can create an SEV VM and trigger the UAF.\nUI:N - The attacking process performs both ioctls itself; no action by any other user or victim process is needed.\nS:U - The attacker is host userspace (the VMM process) corrupting host kernel memory, so the vulnerable component and impacted component share the same security authority. This is not a guest-to-host escape, as the guest cannot issue these ioctls.\nC:H - The use-after-free reads a freed, sprayable kvmalloc\u0027d `struct page *` array and then maps and flushes those attacker-influenceable pointers via `kmap_local_page()`, exposing arbitrary kernel/physical memory and enabling information disclosure once the freed slabs are reallocated.\nI:H - Two heap objects (`region` and `region-\u003epages`) are used after being freed and can be reallocated with attacker-controlled contents, giving the heap-spray primitives typical of exploitable UAFs; `clflush_cache_range()` on a bogus mapping additionally acts on memory outside the intended range.\nA:H - Dereferencing freed `region-\u003enpages`/`region-\u003epages` and calling `kmap_local_page()` on garbage `struct page` pointers reliably produces an oops or panic, taking the host kernel down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:29:57.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d13b79640b147bd77c34a5998533b2021a4122d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e126b508ed2e616d679d85fca2fbe77bb48bbdd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4868c0ecdb6cfde7c70cf478c46e06bb9c7e5865"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f8e32a5a389a5d58afc67728c76e61beee1ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6d53d8a2617dd58c89171a6b9610c470ebda38a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ef1d8c1ddbf696e47b226e11888eaf8d9e8e807"
        }
      ],
      "title": "KVM: SVM: Flush pages under kvm-\u003elock to fix UAF in svm_register_enc_region()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35791",
    "datePublished": "2024-05-17T12:24:49.520Z",
    "dateReserved": "2024-05-17T12:19:12.339Z",
    "dateUpdated": "2026-08-05T11:29:57.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35797 (GCVE-0-2024-35797)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30

Title

mm: cachestat: fix two shmem bugs

Summary

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix two shmem bugs When cachestat on shmem races with swapping and invalidation, there are two possible bugs: 1) A swapin error can have resulted in a poisoned swap entry in the shmem inode's xarray. Calling get_shadow_from_swap_cache() on it will result in an out-of-bounds access to swapper_spaces[]. Validate the entry with non_swap_entry() before going further. 2) When we find a valid swap entry in the shmem's inode, the shadow entry in the swapcache might not exist yet: swap IO is still in progress and we're before __remove_mapping; swapin, invalidation, or swapoff have removed the shadow from swapcache after we saw the shmem swap entry. This will send a NULL to workingset_test_recent(). The latter purely operates on pointer bits, so it won't crash - node 0, memcg ID 0, eviction timestamp 0, etc. are all valid inputs - but it's a bogus test. In theory that could result in a false "recently evicted" count. Such a false positive wouldn't be the end of the world. But for code clarity and (future) robustness, be explicit about this case. Bail on get_shadow_from_swap_cache() returning NULL.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-17 17:19 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/b79f9e1ff27c994a4…
https://git.kernel.org/stable/c/d962f6c583458037d…
https://git.kernel.org/stable/c/24a0e73d544439bb9…
https://git.kernel.org/stable/c/d5d39c707a4cf0bcc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < b79f9e1ff27c994a4c452235ba09e672ec698e23 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d962f6c583458037dc7e529659b2b02b9dd3d94b (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < 24a0e73d544439bb9329fbbafac44299e548a677 (git) Affected: cf264e1329fb0307e044f7675849f9f38b44c11a , < d5d39c707a4cf0bcc84680178677b97aa2cb2627 (git)
Linux	Linux	Affected: 6.5 Unaffected: 0 , < 6.5 (semver) Unaffected: 6.6.24 , ≤ 6.6.* (semver) Unaffected: 6.7.12 , ≤ 6.7.* (semver) Unaffected: 6.8.3 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:19:03.392959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T16:52:46.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b79f9e1ff27c994a4c452235ba09e672ec698e23",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d962f6c583458037dc7e529659b2b02b9dd3d94b",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "24a0e73d544439bb9329fbbafac44299e548a677",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            },
            {
              "lessThan": "d5d39c707a4cf0bcc84680178677b97aa2cb2627",
              "status": "affected",
              "version": "cf264e1329fb0307e044f7675849f9f38b44c11a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: cachestat: fix two shmem bugs\n\nWhen cachestat on shmem races with swapping and invalidation, there\nare two possible bugs:\n\n1) A swapin error can have resulted in a poisoned swap entry in the\n   shmem inode\u0027s xarray. Calling get_shadow_from_swap_cache() on it\n   will result in an out-of-bounds access to swapper_spaces[].\n\n   Validate the entry with non_swap_entry() before going further.\n\n2) When we find a valid swap entry in the shmem\u0027s inode, the shadow\n   entry in the swapcache might not exist yet: swap IO is still in\n   progress and we\u0027re before __remove_mapping; swapin, invalidation,\n   or swapoff have removed the shadow from swapcache after we saw the\n   shmem swap entry.\n\n   This will send a NULL to workingset_test_recent(). The latter\n   purely operates on pointer bits, so it won\u0027t crash - node 0, memcg\n   ID 0, eviction timestamp 0, etc. are all valid inputs - but it\u0027s a\n   bogus test. In theory that could result in a false \"recently\n   evicted\" count.\n\n   Such a false positive wouldn\u0027t be the end of the world. But for\n   code clarity and (future) robustness, be explicit about this case.\n\n   Bail on get_shadow_from_swap_cache() returning NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the `cachestat(2)` syscall on a local file descriptor for a shmem/tmpfs mapping (memfd, /dev/shm, or any readable tmpfs file). There is no network or remote-peer path into `filemap_cachestat()`.\nAC:L - Once a poisoned swap entry exists in a shmem inode it persists until truncate, and every `cachestat()` call covering that index deterministically and repeatably performs the out-of-bounds `swapper_spaces[]` access; the attacker additionally controls both sides of the cachestat-vs-swapping/invalidation race and can drive unbounded shmem swap I/O (large tmpfs files plus memory pressure) to provoke the swapin error, which is routine on flash-backed embedded/IoT swap and network-backed swap in diskless/cloud deployments.\nPR:L - `cachestat(2)` performs only `fdget()` with no capability or permission check whatsoever in the affected versions, and any unprivileged user can create a shmem mapping via `memfd_create()` or `/dev/shm`. No elevated privileges or namespace tricks are needed.\nUI:N - The attacker triggers the flaw entirely from their own process with a single syscall on a file descriptor they already hold. No action by any other user or victim process is required.\nS:U - The out-of-bounds access, wild dereference and resulting oops are all confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The read past the end of `swapper_spaces[]` yields an unvalidated non-pointer value that is dereferenced as a `struct address_space` and walked as an xarray, so the kernel reads memory at an address it never bounds-checked; the value derived from that walk feeds `workingset_test_recent()` whose outcome is reflected in the `nr_recently_evicted` field copied back to userspace, forming a kernel-memory disclosure oracle. This is an unbounded out-of-bounds read, not a read strictly limited to a few bytes.\nI:N - The faulty path only performs reads (`xa_load`), and the memcg reference taken in `workingset_test_recent()` is released on all paths, so no kernel memory is written or corrupted and no write or control-flow-hijack primitive is produced. The only integrity effect is an inaccurate statistics counter returned to the caller.\nA:H - The out-of-bounds `swapper_spaces[31]` value is almost always zero (or unmapped garbage), producing a NULL/wild pointer dereference and kernel oops inside an `rcu_read_lock()` critical section; the leaked RCU nesting on task death can escalate to RCU stalls and a system-wide hang, and `panic_on_oops` systems panic outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:00.460Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b79f9e1ff27c994a4c452235ba09e672ec698e23"
        },
        {
          "url": "https://git.kernel.org/stable/c/d962f6c583458037dc7e529659b2b02b9dd3d94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/24a0e73d544439bb9329fbbafac44299e548a677"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5d39c707a4cf0bcc84680178677b97aa2cb2627"
        }
      ],
      "title": "mm: cachestat: fix two shmem bugs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35797",
    "datePublished": "2024-05-17T13:23:08.204Z",
    "dateReserved": "2024-05-17T12:19:12.340Z",
    "dateUpdated": "2026-08-05T11:30:00.460Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-35875 (GCVE-0-2024-35875)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30

Title

x86/coco: Require seeding RNG with RDRAND on CoCo systems

Summary

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source of entropy for CoCo guests is RDRAND. If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole is meant to gracefully continue on gathering entropy from other sources, but since there aren't other sources on CoCo, this is catastrophic. This is mostly a concern at boot time when initially seeding the RNG, as after that the consequences of a broken RDRAND are much more theoretical. So, try at boot to seed the RNG using 256 bits of RDRAND output. If this fails, panic(). This will also trigger if the system is booted without RDRAND, as RDRAND is essential for a safe CoCo boot. Add this deliberately to be "just a CoCo x86 driver feature" and not part of the RNG itself. Many device drivers and platforms have some desire to contribute something to the RNG, and add_device_randomness() is specifically meant for this purpose. Any driver can call it with seed data of any quality, or even garbage quality, and it can only possibly make the quality of the RNG better or have no effect, but can never make it worse. Rather than trying to build something into the core of the RNG, consider the particular CoCo issue just a CoCo issue, and therefore separate it all out into driver (well, arch/platform) code. [ bp: Massage commit message. ]

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-17 17:38 UTC

Assigner

Linux mitre root

References

4 references

URL	Tags
https://git.kernel.org/stable/c/22943e4fe4b3a2dcb…
https://git.kernel.org/stable/c/453b5f2dec276c1bb…
https://git.kernel.org/stable/c/08044b08b37528b82…
https://git.kernel.org/stable/c/99485c4c026f024e7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d8aa7eea78a1401cce39b3bb61ead0150044a3df , < 22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374 (git) Affected: d8aa7eea78a1401cce39b3bb61ead0150044a3df , < 453b5f2dec276c1bb4ea078bf8c0da57ee4627e5 (git) Affected: d8aa7eea78a1401cce39b3bb61ead0150044a3df , < 08044b08b37528b82f70a87576c692b4e4b7716e (git) Affected: d8aa7eea78a1401cce39b3bb61ead0150044a3df , < 99485c4c026f024e7cb82da84c7951dbe3deb584 (git)
Linux	Linux	Affected: 4.15 Unaffected: 0 , < 4.15 (semver) Unaffected: 6.1.85 , ≤ 6.1.* (semver) Unaffected: 6.6.26 , ≤ 6.6.* (semver) Unaffected: 6.8.5 , ≤ 6.8.* (semver) Unaffected: 6.9 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:48.795160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:41:42.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.026Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/core.c",
            "arch/x86/include/asm/coco.h",
            "arch/x86/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "453b5f2dec276c1bb4ea078bf8c0da57ee4627e5",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "08044b08b37528b82f70a87576c692b4e4b7716e",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "99485c4c026f024e7cb82da84c7951dbe3deb584",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/core.c",
            "arch/x86/include/asm/coco.h",
            "arch/x86/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/coco: Require seeding RNG with RDRAND on CoCo systems\n\nThere are few uses of CoCo that don\u0027t rely on working cryptography and\nhence a working RNG. Unfortunately, the CoCo threat model means that the\nVM host cannot be trusted and may actively work against guests to\nextract secrets or manipulate computation. Since a malicious host can\nmodify or observe nearly all inputs to guests, the only remaining source\nof entropy for CoCo guests is RDRAND.\n\nIf RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole\nis meant to gracefully continue on gathering entropy from other sources,\nbut since there aren\u0027t other sources on CoCo, this is catastrophic.\nThis is mostly a concern at boot time when initially seeding the RNG, as\nafter that the consequences of a broken RDRAND are much more\ntheoretical.\n\nSo, try at boot to seed the RNG using 256 bits of RDRAND output. If this\nfails, panic(). This will also trigger if the system is booted without\nRDRAND, as RDRAND is essential for a safe CoCo boot.\n\nAdd this deliberately to be \"just a CoCo x86 driver feature\" and not\npart of the RNG itself. Many device drivers and platforms have some\ndesire to contribute something to the RNG, and add_device_randomness()\nis specifically meant for this purpose.\n\nAny driver can call it with seed data of any quality, or even garbage\nquality, and it can only possibly make the quality of the RNG better or\nhave no effect, but can never make it worse.\n\nRather than trying to build something into the core of the RNG, consider\nthe particular CoCo issue just a CoCo issue, and therefore separate it\nall out into driver (well, arch/platform) code.\n\n  [ bp: Massage commit message. ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The adversary defined by the CoCo threat model is the untrusted hypervisor/host, which attacks the guest through the virtual platform it controls (CPUID, boot cmdline, TSC, interrupt and device inputs) rather than through the guest\u0027s network stack. This is read/write access to the vulnerable component\u0027s platform, i.e. local.\nAC:L - The attacker directly creates the vulnerable condition \u2014 the host supplies guest CPUID and can simply not advertise X86_FEATURE_RDRAND, after which arch_get_random_longs() returns 0 and every remaining entropy input (cmdline, TSC, bootloader seed, interrupt/device timings) is host-supplied or host-observable. No unpredictable precondition is required; the same state also arises unaided when x86_init_rdrand() disables faulty RDRAND.\nPR:N - Privileges are measured against the vulnerable component \u2014 the CoCo guest kernel \u2014 and the host holds no account, credential, or privilege inside the guest at all. The weak seeding happens unconditionally during guest boot with no guest-side authentication.\nUI:N - The defective seeding occurs automatically in setup_arch() on every guest boot; no action by any guest user or administrator is needed.\nS:U - The vulnerable component (guest kernel RNG seeding) and the impacted component (that same guest\u0027s kernel and userspace secrets) sit in the same security authority. No guest-to-host escape or IOMMU boundary is crossed.\nC:H - With RDRAND absent the entire input pool consists of values the host chose or can observe, so the host can reconstruct the CRNG state and predict all get_random_bytes()/getrandom()/urandom output \u2014 disk-encryption keys, TLS/SSH private keys, session keys and IVs generated in the guest. That is a complete, total loss of the confidentiality guarantee CoCo exists to provide.\nI:H - Predictable nonces and keys let the attacker forge signatures, authentication tokens and MACs produced inside the guest, and predictable net_secret/ts_secret enable off-path TCP sequence and syncookie forgery for data injection. Predictable stack canaries (boot_init_stack_canary runs straight off the unseeded pool) and predictable randomization secrets additionally hand the attacker reliable control-flow-hijack primitives.\nA:H - Knowledge of the boot stack canary and other kernel randomization secrets converts otherwise-unreliable memory-corruption bugs into dependable code execution and full guest takeover, and predictable TCP ISN/syncookie secrets permit off-path RST injection that tears down the guest\u0027s connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:35.909Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374"
        },
        {
          "url": "https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e"
        },
        {
          "url": "https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584"
        }
      ],
      "title": "x86/coco: Require seeding RNG with RDRAND on CoCo systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35875",
    "datePublished": "2024-05-19T08:34:32.767Z",
    "dateReserved": "2024-05-17T13:50:33.110Z",
    "dateUpdated": "2026-08-05T11:30:35.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:6567

CVE-2023-52463 (GCVE-0-2023-52463)

CVE-2023-52801 (GCVE-0-2023-52801)

CVE-2024-26629 (GCVE-0-2024-26629)

CVE-2024-26630 (GCVE-0-2024-26630)

CVE-2024-26720 (GCVE-0-2024-26720)

CVE-2024-26886 (GCVE-0-2024-26886)

CVE-2024-26946 (GCVE-0-2024-26946)

CVE-2024-35791 (GCVE-0-2024-35791)

CVE-2024-35797 (GCVE-0-2024-35797)

CVE-2024-35875 (GCVE-0-2024-35875)

Tags

Sightings

Nomenclature

Related by attack behaviour