https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:30:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-07496 bdu:2025-07496 https://cve.radiocsirt.org/vuln/bdu:2025-07496 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0496 certfr-2024-avi-0496 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0496 https://cve.radiocsirt.org/vuln/euvd-2026-344492 EUVD-2026-344492 https://cve.radiocsirt.org/vuln/euvd-2026-344492 https://cve.radiocsirt.org/vuln/fkie_cve-2021-47465 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()</p> <p>In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame.</p> <p>idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.</p> <p>The emergency stack for a given CPU is allocated with:</p> <p>paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;</p> <p>So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use.</p> <p>idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.</p> <p>The end result is that w…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()</p> <p>In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame.</p> <p>idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.</p> <p>The emergency stack for a given CPU is allocated with:</p> <p>paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;</p> <p>So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use.</p> <p>idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.</p> <p>The end result is that w…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-47465 https://cve.radiocsirt.org/vuln/ghsa-r7pj-34j8-6jgg <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()</p> <p>In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame.</p> <p>idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.</p> <p>The emergency stack for a given CPU is allocated with:</p> <p>paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;</p> <p>So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use.</p> <p>idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.</p> <p>The end result is that w…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()</p> <p>In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame.</p> <p>idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.</p> <p>The emergency stack for a given CPU is allocated with:</p> <p>paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;</p> <p>So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use.</p> <p>idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.</p> <p>The end result is that w…</p> https://cve.radiocsirt.org/vuln/ghsa-r7pj-34j8-6jgg https://cve.radiocsirt.org/vuln/suse-su-2024:2008-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2024:2008-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-47465 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-gcp-5.4, Ubuntu:18.04:LTS: linux-hwe-5.4, Ubuntu:18.04:LTS: linux-oracle-5.4, Ubuntu:18.04:LTS: linux-raspi-5.4, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure and 81 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame. idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack. The emergency stack for a given CPU is allocated with: paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use. idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation. The end result is that we corrup…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-gcp-5.4, Ubuntu:18.04:LTS: linux-hwe-5.4, Ubuntu:18.04:LTS: linux-oracle-5.4, Ubuntu:18.04:LTS: linux-raspi-5.4, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure and 81 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest() In commit 10d91611f426 (&#34;powerpc/64s: Reimplement book3s idle code in C&#34;) kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn&#39;t use the frame to store anything, and also didn&#39;t store anything in its caller&#39;s frame. idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack. The emergency stack for a given CPU is allocated with: paca_ptrs[i]-&gt;emergency_sp = alloc_stack(limit, i) + THREAD_SIZE; So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca-&gt;kstack, which is initialised to point at an initial frame that is ready to use. idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation. The end result is that we corrup…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-47465 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1197 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder unspezifische Angriffe durchzuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder unspezifische Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1197