<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://cve.radiocsirt.org</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Sat, 03 Oct 2026 15:11:49 +0000</lastBuildDate>
    <item>
      <title>ALSA-2024:8856 — Moderate: kernel security update</title>
      <link>https://cve.radiocsirt.org/vuln/alsa-2024:8856</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more&lt;/p&gt;
&lt;p&gt;The kernel packages contain the Linux kernel, the core of any Linux operating system.&lt;/p&gt;
&lt;p&gt;Security Fix(es):&lt;/p&gt;
&lt;p&gt;* kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)
  * kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)
  * kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)
  * kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
  * kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)
  * kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)
  * kernel: nouveau: lock the client object tree. (CVE-2024-27062)
  * kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)
  * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)
  * kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)
  * kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)
  * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)
  * kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
  * kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)
  * kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)
  * kernel: drm/i915/dp…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more&lt;/p&gt;
&lt;p&gt;The kernel packages contain the Linux kernel, the core of any Linux operating system.&lt;/p&gt;
&lt;p&gt;Security Fix(es):&lt;/p&gt;
&lt;p&gt;* kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() (CVE-2024-24857)
  * kernel: dmaengine: fix NULL pointer in channel unregistration function (CVE-2023-52492)
  * kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range (CVE-2024-26851)
  * kernel: netfilter: nft_set_pipapo: do not free live element (CVE-2024-26924)
  * kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump (CVE-2024-27017)
  * kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVE-2024-26976)
  * kernel: nouveau: lock the client object tree. (CVE-2024-27062)
  * kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info (CVE-2024-35839)
  * kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (CVE-2024-35898)
  * kernel: dma-direct: Leak pages on dma_set_decrypted() failure (CVE-2024-35939)
  * kernel: net/mlx5e: Fix netif state handling (CVE-2024-38608)
  * kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. (CVE-2024-38586)
  * kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541)
  * kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (CVE-2024-38540)
  * kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (CVE-2024-39503)
  * kernel: drm/i915/dp…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/alsa-2024:8856</guid>
    </item>
    <item>
      <title>bdu:2024-01193</title>
      <link>https://cve.radiocsirt.org/vuln/bdu:2024-01193</link>
      <description>bdu:2024-01193</description>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/bdu:2024-01193</guid>
    </item>
    <item>
      <title>BELL-CVE-2024-24857</title>
      <link>https://cve.radiocsirt.org/vuln/bell-cve-2024-24857</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Alpaquita:23: linux-lts&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Alpaquita:23: linux-lts&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/bell-cve-2024-24857</guid>
    </item>
    <item>
      <title>certfr-2024-avi-0334 — De multiples vulnérabilités ont été découvertes dans &lt;span
class="textit"&gt;le noyau Linux de Debian&lt;/span&gt;. Elles permet…</title>
      <link>https://cve.radiocsirt.org/vuln/certfr-2024-avi-0334</link>
      <description>certfr-2024-avi-0334</description>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/certfr-2024-avi-0334</guid>
    </item>
    <item>
      <title>EUVD-2026-316927</title>
      <link>https://cve.radiocsirt.org/vuln/euvd-2026-316927</link>
      <description>EUVD-2026-316927</description>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/euvd-2026-316927</guid>
    </item>
    <item>
      <title>fkie_cve-2024-24857</title>
      <link>https://cve.radiocsirt.org/vuln/fkie_cve-2024-24857</link>
      <description>&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/fkie_cve-2024-24857</guid>
    </item>
    <item>
      <title>GHSA-p453-6h64-wr8m</title>
      <link>https://cve.radiocsirt.org/vuln/ghsa-p453-6h64-wr8m</link>
      <description>&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/ghsa-p453-6h64-wr8m</guid>
    </item>
    <item>
      <title>gsd-2024-24857</title>
      <link>https://cve.radiocsirt.org/vuln/gsd-2024-24857</link>
      <description>gsd-2024-24857</description>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/gsd-2024-24857</guid>
    </item>
    <item>
      <title>ICSA-24-102-01 — Siemens SIMATIC S7-1500 TM MFP</title>
      <link>https://cve.radiocsirt.org/vuln/icsa-24-102-01</link>
      <description>&lt;p&gt;An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/icsa-24-102-01</guid>
    </item>
    <item>
      <title>msrc_CVE-2024-24857 — Race condition vulnerability in Linux kernel bluetooth in conn_info_{minmax}_age_set()</title>
      <link>https://cve.radiocsirt.org/vuln/msrc_cve-2024-24857</link>
      <description>msrc_CVE-2024-24857</description>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/msrc_cve-2024-24857</guid>
    </item>
    <item>
      <title>OESA-2025-1094 — kernel security update</title>
      <link>https://cve.radiocsirt.org/vuln/oesa-2025-1094</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; openEuler:20.03-LTS-SP4: kernel&lt;/p&gt;
&lt;p&gt;The Linux Kernel, the operating system core itself.&#13;
&#13;
Security Fix(es):&lt;/p&gt;
&lt;p&gt;In the Linux kernel, the following vulnerability has been resolved:&lt;/p&gt;
&lt;p&gt;ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min&lt;/p&gt;
&lt;p&gt;While the $val/$val2 values passed in from userspace are always &amp;amp;gt;= 0
integers, the limits of the control can be signed integers and the $min
can be non-zero and less than zero. To correctly validate $val/$val2
against platform_max, add the $min offset to val first.(CVE-2022-48917)&lt;/p&gt;
&lt;p&gt;In the Linux kernel, the following vulnerability has been resolved:&lt;/p&gt;
&lt;p&gt;tcp: do not accept ACK of bytes we never sent&lt;/p&gt;
&lt;p&gt;This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.&lt;/p&gt;
&lt;p&gt;ACK seq validation is currently following RFC 5961 5.2 guidelines:&lt;/p&gt;
&lt;p&gt;The ACK value is considered acceptable only if
   it is in the range of ((SND.UNA - MAX.SND.WND) &amp;amp;lt;= SEG.ACK &amp;amp;lt;=
   SND.NXT).  All incoming segments whose ACK value doesn&amp;amp;apos;t satisfy the
   above condition MUST be discarded and an ACK sent back.  It needs to
   be noted that RFC 793 on page 72 (fifth check) says: &amp;amp;quot;If the ACK is a
   duplicate (SEG.ACK &amp;amp;lt; SND.UNA), it can be ignored.  If the ACK
   acknowledges something not yet sent (SEG.ACK &amp;amp;gt; SND.NXT) then send an
   ACK, drop the segment, and return&amp;amp;quot;.  The &amp;amp;quot;ignored&amp;amp;quot; above implies that
   the processing of the incoming data segment continues, which means
   the ACK value is treated as acceptable.  This mitigation makes the
   ACK check mo…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; openEuler:20.03-LTS-SP4: kernel&lt;/p&gt;
&lt;p&gt;The Linux Kernel, the operating system core itself.&#13;
&#13;
Security Fix(es):&lt;/p&gt;
&lt;p&gt;In the Linux kernel, the following vulnerability has been resolved:&lt;/p&gt;
&lt;p&gt;ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min&lt;/p&gt;
&lt;p&gt;While the $val/$val2 values passed in from userspace are always &amp;amp;gt;= 0
integers, the limits of the control can be signed integers and the $min
can be non-zero and less than zero. To correctly validate $val/$val2
against platform_max, add the $min offset to val first.(CVE-2022-48917)&lt;/p&gt;
&lt;p&gt;In the Linux kernel, the following vulnerability has been resolved:&lt;/p&gt;
&lt;p&gt;tcp: do not accept ACK of bytes we never sent&lt;/p&gt;
&lt;p&gt;This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.&lt;/p&gt;
&lt;p&gt;ACK seq validation is currently following RFC 5961 5.2 guidelines:&lt;/p&gt;
&lt;p&gt;The ACK value is considered acceptable only if
   it is in the range of ((SND.UNA - MAX.SND.WND) &amp;amp;lt;= SEG.ACK &amp;amp;lt;=
   SND.NXT).  All incoming segments whose ACK value doesn&amp;amp;apos;t satisfy the
   above condition MUST be discarded and an ACK sent back.  It needs to
   be noted that RFC 793 on page 72 (fifth check) says: &amp;amp;quot;If the ACK is a
   duplicate (SEG.ACK &amp;amp;lt; SND.UNA), it can be ignored.  If the ACK
   acknowledges something not yet sent (SEG.ACK &amp;amp;gt; SND.NXT) then send an
   ACK, drop the segment, and return&amp;amp;quot;.  The &amp;amp;quot;ignored&amp;amp;quot; above implies that
   the processing of the incoming data segment continues, which means
   the ACK value is treated as acceptable.  This mitigation makes the
   ACK check mo…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/oesa-2025-1094</guid>
    </item>
    <item>
      <title>RHSA-2024:8856 — Red Hat Security Advisory: kernel security update</title>
      <link>https://cve.radiocsirt.org/vuln/rhsa-2024:8856</link>
      <description>&lt;p&gt;kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: cifs: fix oops during encryption kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: memcontrol: ensure memcg acquired by id is properly set up kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: cifs: fix oops during encryption kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: memcontrol: ensure memcg acquired by id is properly set up kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/rhsa-2024:8856</guid>
    </item>
    <item>
      <title>RHSA-2024:8870 — Red Hat Security Advisory: kernel-rt security update</title>
      <link>https://cve.radiocsirt.org/vuln/rhsa-2024:8870</link>
      <description>&lt;p&gt;kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert &amp;amp;#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&amp;amp;#34; kernel: bpf: Fix overrunning reser…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;kernel: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create kernel: gso: do not skip outer ip header in case of ipip and net_failover kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: netfilter: nf_conntrack_h323: Add protection for bmp length out of range kernel: netfilter: nft_set_pipapo: do not free live element kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: nouveau: lock the client object tree. kernel: netfilter: bridge: replace physindev with physinif in nf_bridge_info kernel: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq kernel: of: module: add buffer overflow check in of_modalias() kernel: r8169: Fix possible ring buffer corruption on fragmented Tx packets. kernel: net/mlx5e: Fix netif state handling kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: ipv6: prevent possible NULL deref in fib6_nh_init() kernel: tipc: force a dst refcount before doing decryption kernel: ACPICA: Revert &amp;amp;#34;ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine.&amp;amp;#34; kernel: bpf: Fix overrunning reser…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/rhsa-2024:8870</guid>
    </item>
    <item>
      <title>SSA-265688 — SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1</title>
      <link>https://cve.radiocsirt.org/vuln/ssa-265688</link>
      <description>&lt;p&gt;An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/ssa-265688</guid>
    </item>
    <item>
      <title>UBUNTU-CVE-2024-24857</title>
      <link>https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-24857</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-kvm and 176 more&lt;/p&gt;
&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-kvm and 176 more&lt;/p&gt;
&lt;p&gt;A race condition was found in the Linux kernel&amp;#39;s net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-24857</guid>
    </item>
    <item>
      <title>WID-SEC-W-2024-0296 — Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service</title>
      <link>https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0296</link>
      <description>&lt;p&gt;Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0296</guid>
    </item>
  </channel>
</rss>
