https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:47:04 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:3306 <p><strong>Affected:</strong> AlmaLinux:9: bpftool, AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core and 52 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)</p> <p><strong>Affected:</strong> AlmaLinux:9: bpftool, AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core and 52 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (CVE-2024-26643) * kernel: netfilter: nf_tables: disallow anonymous set with timeout flag (CVE-2024-26642) * kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations (CVE-2024-26673) * kernel: net: ip_tunnel: prevent perpetual headroom growth (CVE-2024-26804)</p> https://cve.radiocsirt.org/vuln/alsa-2024:3306 https://cve.radiocsirt.org/vuln/bdu:2024-03771 bdu:2024-03771 https://cve.radiocsirt.org/vuln/bdu:2024-03771 https://cve.radiocsirt.org/vuln/bell-cve-2024-26643 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-26643 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0334 certfr-2024-avi-0334 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0334 https://cve.radiocsirt.org/vuln/euvd-2026-345477 EUVD-2026-345477 https://cve.radiocsirt.org/vuln/euvd-2026-345477 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26643 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout</p> <p>While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.</p> <p>Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;).</p> <p>Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.</p> <p>According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout</p> <p>While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.</p> <p>Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;).</p> <p>Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.</p> <p>According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-26643 https://cve.radiocsirt.org/vuln/ghsa-ph5r-c8gc-xg6f <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout</p> <p>While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.</p> <p>Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;).</p> <p>Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.</p> <p>According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout</p> <p>While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path.</p> <p>Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;).</p> <p>Fix this by setting on the dead flag for anonymous sets to skip async gc in this case.</p> <p>According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> https://cve.radiocsirt.org/vuln/ghsa-ph5r-c8gc-xg6f https://cve.radiocsirt.org/vuln/gsd-2024-26643 gsd-2024-26643 https://cve.radiocsirt.org/vuln/gsd-2024-26643 https://cve.radiocsirt.org/vuln/icsa-24-102-01 <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> https://cve.radiocsirt.org/vuln/icsa-24-102-01 https://cve.radiocsirt.org/vuln/oesa-2024-1682 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it&amp;apos;s pci_channel_io_frozen.(CVE-2021-47421) In the Linux kernel, the following vulnerability has been resolved: ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88800906c618 (size 8): comm &amp;quot;i2c-idt82p33931&amp;quot;, pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [&amp;lt;00000000312ed458&amp;gt;] __kmalloc_track_caller+0x19f/0x3a0 [&amp;lt;0000000079f6e2ff&amp;gt;] kvasprintf+0xb5/0x150 [&amp;lt;0000000026aae54f&amp;gt;] kvasprintf_const+0x60/0x190 [&amp;lt;000…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: handle the case of pci_channel_io_frozen only in amdgpu_pci_resume In current code, when a PCI error state pci_channel_io_normal is detectd, it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI driver will continue the execution of PCI resume callback report_resume by pci_walk_bridge, and the callback will go into amdgpu_pci_resume finally, where write lock is releasd unconditionally without acquiring such lock first. In this case, a deadlock will happen when other threads start to acquire the read lock. To fix this, add a member in amdgpu_device strucutre to cache pci_channel_state, and only continue the execution in amdgpu_pci_resume when it&amp;apos;s pci_channel_io_frozen.(CVE-2021-47421) In the Linux kernel, the following vulnerability has been resolved: ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88800906c618 (size 8): comm &amp;quot;i2c-idt82p33931&amp;quot;, pid 4421, jiffies 4294948083 (age 13.188s) hex dump (first 8 bytes): 70 74 70 30 00 00 00 00 ptp0.... backtrace: [&amp;lt;00000000312ed458&amp;gt;] __kmalloc_track_caller+0x19f/0x3a0 [&amp;lt;0000000079f6e2ff&amp;gt;] kvasprintf+0xb5/0x150 [&amp;lt;0000000026aae54f&amp;gt;] kvasprintf_const+0x60/0x190 [&amp;lt;000…</p> https://cve.radiocsirt.org/vuln/oesa-2024-1682 https://cve.radiocsirt.org/vuln/rhsa-2024:3306 <p>kernel: netfilter: nf_tables: disallow anonymous set with timeout flag kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations kernel: net: ip_tunnel: prevent perpetual headroom growth kernel: gro: fix ownership transfer</p> <p>kernel: netfilter: nf_tables: disallow anonymous set with timeout flag kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations kernel: net: ip_tunnel: prevent perpetual headroom growth kernel: gro: fix ownership transfer</p> https://cve.radiocsirt.org/vuln/rhsa-2024:3306 https://cve.radiocsirt.org/vuln/rhsa-2024:3460 <p>kernel: netfilter: nf_tables: disallow anonymous set with timeout flag kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref kernel: net: ip_tunnel: prevent perpetual headroom growth kernel: cifs: fix underflow in parse_server_interfaces() kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection()</p> <p>kernel: netfilter: nf_tables: disallow anonymous set with timeout flag kernel: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout kernel: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations kernel: ipv6: sr: fix possible use-after-free and null-ptr-deref kernel: net: ip_tunnel: prevent perpetual headroom growth kernel: cifs: fix underflow in parse_server_interfaces() kernel: fs: sysfs: Fix reference leak in sysfs_break_active_protection()</p> https://cve.radiocsirt.org/vuln/rhsa-2024:3460 https://cve.radiocsirt.org/vuln/ssa-265688 <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> <p>An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd. SUNRPC: null pointer dereference in svc_rqst_free(). When alloc_pages_node() returns null in svc_rqst_alloc(), the null rq_scratch_page pointer will be dereferenced when calling put_page() in svc_rqst_free(). NFSD: READDIR buffer overflow. If a client sends a READDIR count argument that is too small (say, zero), then the buffer size calculation in the new init_dirlist helper functions results in an underflow, allowing the XDR stream functions to write beyond the actual buffer. This calculation has always been suspect. NFSD has never sanity- checked the READDIR count argument, but the old entry encoders managed the problem correctly. With the commits below, entry encoding changed, exposing the underflow to the pointer arithmetic in xdr_reserve_space(). Modern NFS clients attempt to retrieve as much data as possible for each READDIR request. nfsd: NULL dereference in nfs3svc_encode_getaclres. A NULL pointer dereference vulnerability…</p> https://cve.radiocsirt.org/vuln/ssa-265688 https://cve.radiocsirt.org/vuln/suse-su-2024:2008-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2024:2008-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26643 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 126 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 126 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 (&#34;netfilter: nf_tables: use timestamp to check for set element timeout&#34;). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f (&#34;netfilter: nf_tables: mark newset as dead on transaction abort&#34;), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26643 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0694 <p>Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0694