Greg Kroah-Hartman

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A vulnerability in the Linux kernel has been resolved. The issue was related to a commit that used the HW lock manager for PSR1, which could cause a system hang when connecting with two eDP panels. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `vsock * has data()` function in the Linux kernel, specifically in the `net/vmw vsock/af vsock.c` module. It involves a null pointer dereference. The problem occurs when `vsock * has data()` is called on a vsock socket that has been de-assigned from a transport. To prevent this, the code now returns 0 (indicating no space or data available) with a warning, allowing the system to continue running in a nearly consistent state and enabling debugging of future problems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** A double free vulnerability was found in the Linux kernel's mtd: rawnand module, specifically in the `atmel pmecc create user()` function. The issue occurred because the "user" pointer was converted from being allocated with `kzalloc()` to being allocated by `devm kzalloc()`, and calling `kfree(user)` would lead to a double free. **Recommendations** For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the `atmel pmecc create user()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the handling of plane refcount in the Linux kernel's drm/amd/display module. The mechanism to backup and restore plane states does not maintain the refcount, which can cause problems if the refcount of the plane changes between backup and restore operations. This can lead to memory leaks if the refcount was supposed to go down, or double frees/invalid memory accesses if the refcount was supposed to go up. The fix involves caching and re-applying the current refcount when restoring plane states. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, related to the btrfs file system. The issue occurs when updating the action of an existing reference to BTRFS DROP DELAYED REF, which deletes the reference from its list using `list del()`. This leaves the reference's `add list` member not reinitialized, causing a crash when `drop delayed ref()` is called later. The crash happens because `list empty()` returns false due to the list not being reinitialized after `list del()`, leading to an invalid list access. This results in a splat if `CONFIG LIST HARDENED` and `CONFIG DEBUG LIST` are set, or invalid poison pointer dereferences otherwise. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.74 **Description** A use-after-free issue has been resolved in the Linux kernel, specifically in the scsi: qla2xxx module. This issue occurs when the `dpc thread` is terminated using the `UNLOADING` flag and `kthread stop` simultaneously, causing a system crash with a stack trace warning of use-after-free. The `UNLOADING` flag is removed to terminate `dpc thread`, and `kthread stop` is used as the main signal to exit `dpc thread`. The issue is observed on HP ProLiant DL380p Gen8 systems with BIOS P70 08/20/2012. **Recommendations** To resolve this issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider disabling the `qla2xxx` module until a patch is available. Restrict access to the `dpc thread` to minimize the risk of exploitation. Avoid using the `UNLOADING` flag to terminate `dpc thread` until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue concerns a "Missing outer runtime PM protection" warning in the Linux kernel, specifically in the drm/xe/oa component. This warning is associated with a drm WARN message that includes function calls such as `xe pm runtime get noresume`, `guc exec queue add msg`, `guc exec queue fini`, `xe exec queue destroy`, and `xe oa release`. The problem has been resolved, but details about the number of potentially affected devices or real-world incidents are not provided. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to 6.11.9 **Description** The issue is related to the `dc state copy internal` function in the Linux kernel's `drm/amd/display` module. It concerns a double free vulnerability that occurs when a `dml` allocation fails, causing subsequent calls to `dc state copy internal` to shallow copy invalid memory. If the new state is released, a double free would occur, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Linux Kernel versions prior to 6.11.9, update to a version that includes the fix for the `dml` allocation failure issue, such as version 6.11.10 or later, to prevent double free crashes. As a temporary workaround, consider applying the patch from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c to reset `dml` pointers in `new state` to NULL and avoid invalid pointers.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue arises from the handling of interrupts in IPU6 devices when they are disabled. Since some IPU6 devices share interrupts, the system needs to properly handle cases where an interrupt is triggered from another device on the shared irq line while the IPU6 device itself is disabled. This can lead to the system hanging. The problem occurs because when the IPU6 device is disabled, it returns 0xffffffff from the ISR STATUS register, causing the system to handle all irq cases for which it is not prepared. **Recommendations** To resolve the issue, use pm runtime get if active() to check if the device is enabled and prevent suspending it when handling irq until the end of irq. Additionally, use synchronize irq() in suspend. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.65 **Description** The issue concerns the KVM implementation in the Linux kernel, specifically with Intel PT virtualization in guest/host mode. There are multiple bugs in the implementation, some of which can be fatal to the guest and others that put the stability and health of the host at risk. The most significant problem is that KVM fails to ensure tracing is disabled before VM-Enter, which is necessary for hardware to load the guest's RTIT CTL. Additionally, KVM does not validate the guest CPUID configuration provided by userspace and uses this configuration to decide what MSRs to save/load at VM-Enter and VM-Exit. This can lead to KVM trying to passthrough, save, and load non-existent MSRs, resulting in various warnings and potential deadlocks. **Recommendations** To resolve the issue, update the Linux kernel to version 6.6.65 or later. As a temporary workaround, consider disabling the Intel PT virtualization in guest/host mode until a patch is available. Restrict access to the KVM module to minimize the risk of exploitation. Avoid configuring guest CPUID to enumerate more address ranges than are supported in hardware until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.58 **Description** A critical vulnerability in the Linux kernel's PCI keystone component has been fixed. The issue involved the `ks pcie quirk()` function, where an if-statement expression accidentally used `&&` instead of `||`, potentially resulting in a NULL dereference. This fix corrects the if-statement expression to use the correct condition. **Recommendations** For versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider restricting access to the PCI keystone component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the mapping of shared memory in the Linux kernel, specifically in the soc: qcom: cmd-db component. The problem arises when the XPU falsely detects clean cache eviction as a "write" into the write-protected region, leading to a secure interrupt and an endless loop in the Trust Zone. This occurs because the Qualcomm Hypervisor maps the region as Non-Cacheable memory in Stage 2 translation tables, but other hypervisors like Xen or KVM do not know about these specific mappings. The patch fixes the issue by updating the mapping of cmd-db memory from MEMREMAP WB to MEMREMAP WT/WC, removing the dependency on correct mappings in Stage 2 tables. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a reference count leak in the `uniphier spi probe()` function. This occurs when either `dma get slave caps()` or `devm spi register master()` returns an error code, causing the function to forget to decrease the refcount of both `dma rx` and `dma tx` objects. This may lead to refcount leaks. The issue happens in several error paths in `uniphier spi probe()`. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a race condition in the Linux kernel, specifically between the `really probe()` and `dev uevent()` functions. This race condition can occur when these functions run in different threads, leading to a potential system crash. The problem arises when `dev->driver` is set to `NULL` in `really probe()` and then accessed in `dev uevent()` after the check, causing the system to crash. The fix involves adding a lock to the non-protected path to prevent this race condition. Similar cases have been reported by syzkaller, but they are considered false-positives as they relate to the initialization of `dev->driver`. The same issue was previously reported and attempted to be fixed in 2015. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.15.0-rc5+ Description: The vulnerability is related to a NULL pointer dereference in the Linux kernel, specifically in the ice driver. The issue occurs when the Rx queue count differs from the Tx queue count, causing a hidden bug to be exposed. The vulnerability can be triggered when ethtool -L is used and XDP rings are configured. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include: - The `ice vsi free arrays()` function is vulnerable. - The `ice vsi rebuild()` function is also affected. - The `devres remove()` function is involved in the NULL pointer dereference. - The `ethtool -L` command can trigger the vulnerability when XDP rings are configured. Recommendations: To resolve the issue, update the Linux kernel to a version that includes the fix for the ice driver, taking into account the value that `num possible cpus()` yields in addition to `vsi->alloc txq` instead of doubling the latter. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a bounds check in the Linux kernel's drm/amd/display component, specifically for dcn35 DcfClocks. The problem arises because `NumFclkLevelsEnabled` is used instead of the designated `NumDcfClkLevelsEnabled` for the bounds check, potentially causing an array index out-of-bounds access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the btrfs load zone info() function, which can be triggered by a race condition with a device replace operation. This happens because the function extracts a device from the chunk map into a local variable and then uses the device while not under the protection of the device replace rwsem. If a device replace operation occurs while the device is being extracted and the device is the source of the replace operation, a use-after-free can be triggered if the replace operation finishes and frees the device before the function finishes using it. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.50 **Description** The issue is related to the Linux kernel, specifically with the `do dup2()` function, where a misprediction might lead to speculative execution of `tofree = fdt->fd[fd]`. This is wrong for the same reasons it is wrong in `close fd()`/`file close fd locked()`. The solution involves using `array index nospec(fd, fdt->max fds)` to protect against mispredictions. The vulnerability is associated with incorrect input validation in the `fs/file` component of the Linux kernel, which could allow an attacker to cause a denial of service. **Recommendations** For Linux kernel versions prior to 6.6.50, update to version 6.6.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable `do dup2()` function until a patch is available. Avoid using the `fd` variable in the affected `do dup2()` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the Linux kernel's mmc core component, where a negative index can be accessed with an array. This occurs because the iterator `i` is not checked to be greater than zero before assigning `prev idata = idatas[i - 1]`. The vulnerability may allow an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.