https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:12:00 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:5101 <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451) * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939) * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622) * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669) * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802) * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843) * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878) * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653) * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823) * kernel: Revert &amp;#34;net/mlx5: Block entering switchdev mode with ns inconsistency&amp;#34; (CVE-2023-52658) * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807) * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801) * kernel: dyndbg: fix old BUG_ON in &amp;gt;control parser (CVE-2024-35947) * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893) * kernel: x86/mce: Make s…</p> <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: powerpc: Fix access beyond end of drmem array (CVE-2023-52451) * kernel: efivarfs: force RO when remounting if SetVariable is not supported (CVE-2023-52463) * kernel: tracing: Restructure trace_clock_global() to never block (CVE-2021-46939) * kernel: ext4: avoid online resizing failures due to oversized flex bg (CVE-2023-52622) * kernel: net/sched: flower: Fix chain template offload (CVE-2024-26669) * kernel: stmmac: Clear variable when destroying workqueue (CVE-2024-26802) * kernel: efi: runtime: Fix potential overflow of soft-reserved region size (CVE-2024-26843) * kernel: quota: Fix potential NULL pointer dereference (CVE-2024-26878) * kernel: TIPC message reassembly use-after-free remote code execution vulnerability (CVE-2024-36886) * kernel: SUNRPC: fix a memleak in gss_import_v2_context (CVE-2023-52653) * kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application (CVE-2024-21823) * kernel: Revert &amp;#34;net/mlx5: Block entering switchdev mode with ns inconsistency&amp;#34; (CVE-2023-52658) * kernel: ext4: fix corruption during on-line resize (CVE-2024-35807) * kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (CVE-2024-35801) * kernel: dyndbg: fix old BUG_ON in &amp;gt;control parser (CVE-2024-35947) * kernel: net/sched: act_skbmod: prevent kernel-infoleak (CVE-2024-35893) * kernel: x86/mce: Make s…</p> https://cve.radiocsirt.org/vuln/alsa-2024:5101 https://cve.radiocsirt.org/vuln/bdu:2025-15048 bdu:2025-15048 https://cve.radiocsirt.org/vuln/bdu:2025-15048 https://cve.radiocsirt.org/vuln/bell-cve-2024-26669 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-26669 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0383 certfr-2024-avi-0383 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0383 https://cve.radiocsirt.org/vuln/euvd-2026-312536 EUVD-2026-312536 https://cve.radiocsirt.org/vuln/euvd-2026-312536 https://cve.radiocsirt.org/vuln/fkie_cve-2024-26669 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: flower: Fix chain template offload</p> <p>When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter.</p> <p>However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].</p> <p>Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one.</p> <p>As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chain…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: flower: Fix chain template offload</p> <p>When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter.</p> <p>However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].</p> <p>Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one.</p> <p>As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chain…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-26669 https://cve.radiocsirt.org/vuln/ghsa-2wjh-rvr2-xxjw <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: flower: Fix chain template offload</p> <p>When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter.</p> <p>However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].</p> <p>Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one.</p> <p>As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chain…</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: flower: Fix chain template offload</p> <p>When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter.</p> <p>However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2].</p> <p>Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one.</p> <p>As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chain…</p> https://cve.radiocsirt.org/vuln/ghsa-2wjh-rvr2-xxjw https://cve.radiocsirt.org/vuln/gsd-2024-26669 gsd-2024-26669 https://cve.radiocsirt.org/vuln/gsd-2024-26669 https://cve.radiocsirt.org/vuln/msrc_cve-2024-26669 msrc_CVE-2024-26669 https://cve.radiocsirt.org/vuln/msrc_cve-2024-26669 https://cve.radiocsirt.org/vuln/oesa-2024-1620 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.(CVE-2022-48655) In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev-&amp;gt;bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev-&amp;gt;bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 &amp;lt;HASH:1f9e 1&amp;gt; Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 &amp;lt;48&amp;gt; 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP1: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.(CVE-2022-48655) In the Linux kernel, the following vulnerability has been resolved: usb: hub: Guard against accesses to uninitialized BOS descriptors Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h access fields inside udev-&amp;gt;bos without checking if it was allocated and initialized. If usb_get_bos_descriptor() fails for whatever reason, udev-&amp;gt;bos will be NULL and those accesses will result in a crash: BUG: kernel NULL pointer dereference, address: 0000000000000018 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 &amp;lt;HASH:1f9e 1&amp;gt; Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021 Workqueue: usb_hub_wq hub_event RIP: 0010:hub_port_reset+0x193/0x788 Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 &amp;lt;48&amp;gt; 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89…</p> https://cve.radiocsirt.org/vuln/oesa-2024-1620 https://cve.radiocsirt.org/vuln/rhsa-2024:5101 <p>kernel: tracing: Restructure trace_clock_global() to never block kernel: ensure definition of the fixmap area is in a limit kernel: net: ieee802154: fix null deref in parse dev addr kernel: isdn: mISDN: netjet: Fix crash in nj_probe kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: netfilter: conntrack: serialize hash resizes and cleanups kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: isdn: mISDN: Fix sleeping function called from invalid context kernel: mm: khugepaged: skip huge page collapse for special files kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() kernel: ovl: fix warning in ovl_create_real() kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: net: amd-xgbe: Fix skb data length underflow kernel: block: Fix wrong offset in bio_truncate() kernel: net: fix information leakage in /proc/net/ptype kernel: cifs: Fix memory leak when build ntlmssp negotiate blob failed kernel: x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() kernel: Local information disclosure on Intel(R) Atom(R) processors kernel: powerpc: Fix access beyond end of drmem array kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: use-after-free in kv_parse_power_table kernel: null po…</p> <p>kernel: tracing: Restructure trace_clock_global() to never block kernel: ensure definition of the fixmap area is in a limit kernel: net: ieee802154: fix null deref in parse dev addr kernel: isdn: mISDN: netjet: Fix crash in nj_probe kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: netfilter: conntrack: serialize hash resizes and cleanups kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: isdn: mISDN: Fix sleeping function called from invalid context kernel: mm: khugepaged: skip huge page collapse for special files kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() kernel: ovl: fix warning in ovl_create_real() kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: net: amd-xgbe: Fix skb data length underflow kernel: block: Fix wrong offset in bio_truncate() kernel: net: fix information leakage in /proc/net/ptype kernel: cifs: Fix memory leak when build ntlmssp negotiate blob failed kernel: x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() kernel: Local information disclosure on Intel(R) Atom(R) processors kernel: powerpc: Fix access beyond end of drmem array kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: use-after-free in kv_parse_power_table kernel: null po…</p> https://cve.radiocsirt.org/vuln/rhsa-2024:5101 https://cve.radiocsirt.org/vuln/rhsa-2024:5102 <p>kernel: tracing: Restructure trace_clock_global() to never block kernel: net: ieee802154: fix null deref in parse dev addr kernel: isdn: mISDN: netjet: Fix crash in nj_probe kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: netfilter: conntrack: serialize hash resizes and cleanups kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: isdn: mISDN: Fix sleeping function called from invalid context kernel: mm: khugepaged: skip huge page collapse for special files kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() kernel: ovl: fix warning in ovl_create_real() kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: net: amd-xgbe: Fix skb data length underflow kernel: block: Fix wrong offset in bio_truncate() kernel: net: fix information leakage in /proc/net/ptype kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: use-after-free in kv_parse_power_table kernel: null pointer dereference issues in ice_ptp.c kernel: drm: Don&#39;t unref the same fb many times by mistake due to deadlock handling kernel: wifi: mac80211: fix potential key use-after-free kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: ext4: avoid online resizing failures due to oversiz…</p> <p>kernel: tracing: Restructure trace_clock_global() to never block kernel: net: ieee802154: fix null deref in parse dev addr kernel: isdn: mISDN: netjet: Fix crash in nj_probe kernel: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized kernel: irqchip/gic-v3-its: Fix potential VPE leak on error kernel: netfilter: conntrack: serialize hash resizes and cleanups kernel: userfaultfd: fix a race between writeprotect and exit_mmap() kernel: isdn: mISDN: Fix sleeping function called from invalid context kernel: mm: khugepaged: skip huge page collapse for special files kernel: ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() kernel: ovl: fix warning in ovl_create_real() kernel: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() kernel: net: amd-xgbe: Fix skb data length underflow kernel: block: Fix wrong offset in bio_truncate() kernel: net: fix information leakage in /proc/net/ptype kernel: efivarfs: force RO when remounting if SetVariable is not supported kernel: use-after-free in kv_parse_power_table kernel: null pointer dereference issues in ice_ptp.c kernel: drm: Don&#39;t unref the same fb many times by mistake due to deadlock handling kernel: wifi: mac80211: fix potential key use-after-free kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: ext4: avoid online resizing failures due to oversiz…</p> https://cve.radiocsirt.org/vuln/rhsa-2024:5102 https://cve.radiocsirt.org/vuln/suse-su-2024:3190-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2024:3190-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26669 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 132 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter. However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2]. Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one. As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains. [1…</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 132 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the &#39;FLOW_BLOCK_UNBIND&#39; command. The stack then continues to replay the removal of the filters in the block for this driver by iterating over the chains in the block and invoking the &#39;reoffload&#39; operation of the classifier being used. In turn, the classifier in its &#39;reoffload&#39; operation prepares and emits a &#39;FLOW_CLS_DESTROY&#39; command for each filter. However, the stack does not do the same for chain templates and the underlying driver never receives a &#39;FLOW_CLS_TMPLT_DESTROY&#39; command when a qdisc is deleted. This results in a memory leak [1] which can be reproduced using [2]. Fix by introducing a &#39;tmplt_reoffload&#39; operation and have the stack invoke it with the appropriate arguments as part of the replay. Implement the operation in the sole classifier that supports chain templates (flower) by emitting the &#39;FLOW_CLS_TMPLT_{CREATE,DESTROY}&#39; command based on whether a flow offload callback is being bound to a filter block or being unbound from one. As far as I can tell, the issue happens since cited commit which reordered tcf_block_offload_unbind() before tcf_block_flush_all_chains() in __tcf_block_put(). The order cannot be reversed as the filter block is expected to be freed after flushing all the chains. [1…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-26669 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0749 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service oder einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service oder einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0749