Ubuntu update for linux

1) Resource management error

EUVDB-ID: #VU94364

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25741

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the printer_write() in drivers/usb/gadget/function/f_printer.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU94930

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41079

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nvmet_execute_admin_connect() and nvmet_execute_io_connect() functions in drivers/nvme/target/fabrics-cmd.c, within the pr_debug() and nvmet_execute_auth_receive() functions in drivers/nvme/target/fabrics-cmd-auth.c, within the nvmet_req_init() function in drivers/nvme/target/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU94944

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41058

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cachefiles_withdraw_volumes() function in fs/cachefiles/cache.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper privilege management

EUVDB-ID: #VU95085

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41029

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the nvmem_populate_sysfs_cells() function in drivers/nvmem/core.c. A local user can read and manipulate data.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU95562

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42253

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the pca953x_irq_bus_sync_unlock() function in drivers/gpio/gpio-pca953x.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU95004

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41075

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cachefiles_ondemand_fd_llseek(), cachefiles_ondemand_fd_ioctl() and cachefiles_ondemand_copen() functions in fs/cachefiles/ondemand.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU96106

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hfcmulti_dtmf() and HFC_wait_nodebug() functions in drivers/isdn/hardware/mISDN/hfcmulti.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Integer overflow

EUVDB-ID: #VU95034

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42102

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the wb_dirty_limits() function in mm/page-writeback.c. A local user can execute arbitrary code.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) NULL pointer dereference

EUVDB-ID: #VU94979

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41055

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/mmzone.h. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Memory leak

EUVDB-ID: #VU94925

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41025

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fastrpc_init_create_static_process() function in drivers/misc/fastrpc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42124

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) NULL pointer dereference

EUVDB-ID: #VU94978

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41060

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the radeon_gem_va_update_vm() function in drivers/gpu/drm/radeon/radeon_gem.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource management error

EUVDB-ID: #VU95071

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41027

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the userfaultfd_api() function in fs/userfaultfd.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Resource management error

EUVDB-ID: #VU95065

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42146

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the p2p_enabled() and dma_buf_run_device() functions in drivers/gpu/drm/xe/tests/xe_dma_buf.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper locking

EUVDB-ID: #VU95560

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42251

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the page_folio() function in mm/gup.c, within the filemap_get_folios_contig(), filemap_get_read_batch() and next_uptodate_folio() functions in mm/filemap.c, within the cifs_extend_writeback() function in fs/smb/client/file.c, within the afs_extend_writeback() function in fs/afs/write.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Resource management error

EUVDB-ID: #VU95051

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41081

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ila_output() function in net/ipv6/ila/ila_lwt.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Input validation error

EUVDB-ID: #VU95104

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42065

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the xe_ttm_stolen_mgr_init() function in drivers/gpu/drm/xe/xe_ttm_stolen_mgr.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Resource management error

EUVDB-ID: #VU95059

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42129

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mlxreg_led_probe() function in drivers/leds/leds-mlxreg.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Resource management error

EUVDB-ID: #VU95070

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41031

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the do_sync_mmap_readahead() function in mm/filemap.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Input validation error

EUVDB-ID: #VU95109

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41035

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the usb_parse_endpoint() function in drivers/usb/core/config.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Improper locking

EUVDB-ID: #VU94994

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41047

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the i40e_xdp_setup() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource management error

EUVDB-ID: #VU95057

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52888

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the h264_enc_free_work_buf() function in drivers/media/platform/mediatek/vcodec/encoder/venc/venc_h264_if.c, within the vdec_av1_slice_free_working_buffer() function in drivers/media/platform/mediatek/vcodec/decoder/vdec/vdec_av1_req_lat_if.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper error handling

EUVDB-ID: #VU95512

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42248

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ma35d1serial_probe() function in drivers/tty/serial/ma35d1_serial.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU95042

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41039

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the cs_dsp_adsp1_parse_sizes(), cs_dsp_adsp2_parse_sizes(), cs_dsp_load() and cs_dsp_buf_free() functions in drivers/firmware/cirrus/cs_dsp.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Improper error handling

EUVDB-ID: #VU95015

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42119

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the find_first_free_audio() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU95048

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41038

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the cs_dsp_coeff_parse_string(), cs_dsp_coeff_parse_int(), cs_dsp_coeff_parse_coeff() and cs_dsp_parse_coeff() functions in drivers/firmware/cirrus/cs_dsp.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Resource management error

EUVDB-ID: #VU95049

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42150

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the txgbe_open() function in drivers/net/ethernet/wangxun/txgbe/txgbe_main.c, within the txgbe_irq_enable(), txgbe_request_irq() and txgbe_setup_misc_irq() functions in drivers/net/ethernet/wangxun/txgbe/txgbe_irq.c, within the wx_free_irq() function in drivers/net/ethernet/wangxun/libwx/wx_lib.c, within the wx_sw_init() function in drivers/net/ethernet/wangxun/libwx/wx_hw.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU94940

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42073

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlxsw_sp_sb_sr_occ_query_cb(), mlxsw_reg_sbsr_pack() and mlxsw_sp_sb_occ_max_clear() functions in drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) NULL pointer dereference

EUVDB-ID: #VU94964

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42089

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the fsl_asoc_card_probe() function in sound/soc/fsl/fsl-asoc-card.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Resource management error

EUVDB-ID: #VU94345

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41007

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tcp_rtx_probe0_timed_out() function in net/ipv4/tcp_timer.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Input validation error

EUVDB-ID: #VU95099

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42120

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dce110_vblank_set() function in drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Double free

EUVDB-ID: #VU95009

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42069

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the add_adev() function in drivers/net/ethernet/microsoft/mana/mana_en.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Use-after-free

EUVDB-ID: #VU94941

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41096

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the msi_capability_init() function in drivers/pci/msi/msi.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper locking

EUVDB-ID: #VU94983

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42153

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wait_reset(), i2c_pnx_master_xmit(), i2c_pnx_master_rcv(), i2c_pnx_interrupt(), i2c_pnx_timeout(), i2c_pnx_xfer() and i2c_pnx_probe() functions in drivers/i2c/busses/i2c-pnx.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) NULL pointer dereference

EUVDB-ID: #VU94957

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42151

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the bpf_dummy_unreg() and bpf_dummy_test_sleepable() functions in net/bpf/bpf_dummy_struct_ops.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Resource management error

EUVDB-ID: #VU95517

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42241

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the shmem_confirm_swap() and shmem_is_huge() functions in mm/shmem.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Input validation error

EUVDB-ID: #VU94997

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42126

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pcpu_cpu_to_node() and setup_per_cpu_areas() functions in arch/powerpc/kernel/setup_64.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Input validation error

EUVDB-ID: #VU95000

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42092

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the davinci_gpio_probe() function in drivers/gpio/gpio-davinci.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Resource management error

EUVDB-ID: #VU95061

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42231

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the calc_available_free_space() function in fs/btrfs/space-info.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Buffer overflow

EUVDB-ID: #VU95079

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41032

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the DEFINE_PER_CPU() function in mm/vmalloc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Memory leak

EUVDB-ID: #VU94928

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41076

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nfs4_set_security_label() function in fs/nfs/nfs4proc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Integer overflow

EUVDB-ID: #VU95036

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42136

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the cdrom_ioctl_timed_media_change() function in drivers/cdrom/cdrom.c. A local user can execute arbitrary code.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Memory leak

EUVDB-ID: #VU94929

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41078

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the btrfs_quota_disable() function in fs/btrfs/qgroup.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Resource management error

EUVDB-ID: #VU95072

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41068

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sclp_init() function in drivers/s390/char/sclp.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Use-after-free

EUVDB-ID: #VU94942

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41070

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_spapr_tce_attach_iommu_group() function in arch/powerpc/kvm/book3s_64_vio.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Out-of-bounds read

EUVDB-ID: #VU94841

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41091

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tun_xdp_one() function in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Use of uninitialized resource

EUVDB-ID: #VU95030

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42063

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the PROG_NAME() and PROG_NAME_ARGS() functions in kernel/bpf/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Input validation error

EUVDB-ID: #VU95090

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42157

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Reachable assertion

EUVDB-ID: #VU95006

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42118

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the resource_stream_to_stream_idx() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Double free

EUVDB-ID: #VU95010

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41046

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ltq_etop_free_channel() function in drivers/net/ethernet/lantiq_etop.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Memory leak

EUVDB-ID: #VU94924

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41023

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the enqueue_task_dl() function in kernel/sched/deadline.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Buffer overflow

EUVDB-ID: #VU95040

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42094

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the iucv_setmask_mp() and iucv_cpu_online() functions in net/iucv/iucv.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU95003

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41042

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nf_tables_rule_release(), nft_chain_validate(), nft_chain_validate_hooks() and nft_validate_register_store() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Improper error handling

EUVDB-ID: #VU95020

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41034

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_dotdot() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Improper locking

EUVDB-ID: #VU94987

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42096

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the profile_pc() function in arch/x86/kernel/time.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU94936

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42105

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_store_disk_layout() function in fs/nilfs2/the_nilfs.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU94946

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41051

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cachefiles_ondemand_clean_object() function in fs/cachefiles/ondemand.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper locking

EUVDB-ID: #VU95507

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42239

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __bpf_async_init(), drop_prog_refcnt(), BPF_CALL_1() and hrtimer_cancel() functions in kernel/bpf/helpers.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Reachable assertion

EUVDB-ID: #VU95005

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42117

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the find_disp_cfg_idx_by_plane_id() and find_disp_cfg_idx_by_stream_id() functions in drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Out-of-bounds read

EUVDB-ID: #VU94839

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41019

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the check_rstbl() function in fs/ntfs3/fslog.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Input validation error

EUVDB-ID: #VU95110

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41033

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the workingset_eviction(), workingset_test_recent() and workingset_refault() functions in mm/workingset.c, within the filemap_cachestat() function in mm/filemap.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Integer overflow

EUVDB-ID: #VU95037

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42223

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the tda10048_set_if() function in drivers/media/dvb-frontends/tda10048.c. A local user can execute arbitrary code.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) NULL pointer dereference

EUVDB-ID: #VU94970

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41098

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ata_host_release() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improper Initialization

EUVDB-ID: #VU95047

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41052

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the vfio_pci_ioctl_get_pci_hot_reset_info() function in drivers/vfio/pci/vfio_pci_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper locking

EUVDB-ID: #VU94995

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41036

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ks8851_tx_work() function in drivers/net/ethernet/micrel/ks8851_spi.c, within the ks8851_irq() and ks8851_set_rx_mode() functions in drivers/net/ethernet/micrel/ks8851_common.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Double free

EUVDB-ID: #VU95008

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41087

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ata_host_alloc() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Use-after-free

EUVDB-ID: #VU94932

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42115

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the jffs2_i_init_once() function in fs/jffs2/super.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Use-after-free

EUVDB-ID: #VU94945

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41057

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cachefiles_free_volume() function in fs/cachefiles/volume.c, within the cachefiles_withdraw_objects() and cachefiles_withdraw_cache() functions in fs/cachefiles/cache.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Use of uninitialized resource

EUVDB-ID: #VU95027

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42161

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the tools/lib/bpf/bpf_core_read.h. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Buffer overflow

EUVDB-ID: #VU95516

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42240

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the SYM_INNER_LABEL() function in arch/x86/entry/entry_64_compat.S. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Improper error handling

EUVDB-ID: #VU95019

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41093

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the amdgpu_vkms_prepare_fb() and amdgpu_vkms_cleanup_fb() functions in drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU95001

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42097

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the load_data() and load_guspatch() functions in sound/synth/emux/soundfont.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Resource management error

EUVDB-ID: #VU95068

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42077

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ocfs2_extend_trans() function in fs/ocfs2/journal.c, within the ocfs2_dio_end_io_write() function in fs/ocfs2/aops.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU94977

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41062

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the l2cap_sock_kill(), l2cap_sock_new_connection_cb() and l2cap_sock_recv_cb() functions in net/bluetooth/l2cap_sock.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Input validation error

EUVDB-ID: #VU95091

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42156

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU94976

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41077

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the null_validate_conf() function in drivers/block/null_blk/main.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) NULL pointer dereference

EUVDB-ID: #VU95505

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42235

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the crst_table_alloc() and base_crst_alloc() functions in arch/s390/mm/pgalloc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) NULL pointer dereference

EUVDB-ID: #VU94972

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41085

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cxl_mem_probe() function in drivers/cxl/mem.c, within the cxl_pmem_region_alloc() function in drivers/cxl/core/region.c, within the match_nvdimm_bridge() and cxlmd_release_nvdimm() functions in drivers/cxl/core/pmem.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper error handling

EUVDB-ID: #VU95018

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52887

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the j1939_xtp_rx_rts_session_new() function in net/can/j1939/transport.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Infinite loop

EUVDB-ID: #VU95513

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42237

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the cs_dsp_load(), cs_dsp_load_coeff() and regmap_async_complete() functions in drivers/firmware/cirrus/cs_dsp.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Out-of-bounds read

EUVDB-ID: #VU94955

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41061

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dml2_calculate_rq_and_dlg_params() function in drivers/gpu/drm/amd/display/dc/dml2/dml2_utils.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Double free

EUVDB-ID: #VU95011

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41073

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the nvme_cleanup_cmd() function in drivers/nvme/host/core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Resource management error

EUVDB-ID: #VU95066

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42087

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ili9881c_prepare() and ili9881c_unprepare() functions in drivers/gpu/drm/panel/panel-ilitek-ili9881c.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Input validation error

EUVDB-ID: #VU95002

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41086

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the downgrade_entry_next_c() and bch2_sb_downgrade_validate() functions in fs/bcachefs/sb-downgrade.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Input validation error

EUVDB-ID: #VU95108

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41044

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ppp_read() and ppp_write() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Memory leak

EUVDB-ID: #VU94927

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41066

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ibmvnic_xmit() function in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Resource management error

EUVDB-ID: #VU95058

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42128

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the an30259a_probe() function in drivers/leds/leds-an30259a.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) NULL pointer dereference

EUVDB-ID: #VU94958

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42144

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lvts_probe() function in drivers/thermal/mediatek/lvts_thermal.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Input validation error

EUVDB-ID: #VU95088

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42227

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dml_core_mode_programming() function in drivers/gpu/drm/amd/display/dc/dml2/display_mode_core.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Improper locking

EUVDB-ID: #VU94996

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41020

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fcntl_setlk64() function in fs/locks.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Input validation error

EUVDB-ID: #VU94842

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41015

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_check_dir_entry(), ocfs2_search_dirblock(), __ocfs2_delete_entry(), __ocfs2_add_entry(), ocfs2_dir_foreach_blk_id(), ocfs2_dir_foreach_blk_el(), ocfs2_find_dir_space_id() and ocfs2_find_dir_space_el() functions in fs/ocfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Use-after-free

EUVDB-ID: #VU95503

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42232

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the delayed_work() and EXPORT_SYMBOL() functions in net/ceph/mon_client.c. A local user can escalate privileges on the system.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Input validation error

EUVDB-ID: #VU95106

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41072

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cfg80211_wext_siwscan() function in net/wireless/scan.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Improper error handling

EUVDB-ID: #VU95021

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41030

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the smb2_create_open_flags() and smb2_open() functions in fs/smb/server/smb2pdu.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Input validation error

EUVDB-ID: #VU95100

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42098

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ecdh_set_secret() function in crypto/ecdh.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Input validation error

EUVDB-ID: #VU95098

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42121

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the read() and write() functions in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Input validation error

EUVDB-ID: #VU95103

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42080

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rdma_restrack_init() and type2str() functions in drivers/infiniband/core/restrack.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Out-of-bounds read

EUVDB-ID: #VU94956

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41071

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ieee80211_prep_hw_scan() function in net/mac80211/scan.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48

linux-image-kvm (Ubuntu package): before 6.8.0-48.48

linux-image-generic-lpae (Ubuntu package): before 6.8.0-48.48

linux-image-generic-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-generic-64k (Ubuntu package): before 6.8.0-48.48

linux-image-generic (Ubuntu package): before 6.8.0-48.48

linux-image-6.8.0-48-generic-64k (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-6.8.0-48-generic (Ubuntu package): before 6.8.0-48.48~22.04.1

• cpe:2.3:o:canonical:ubuntu:24.04:*:*:*:*:*:*:
• cpe:2.3:o:canonical:ubuntu:22.04:*:*:*:*:*:*:

http://ubuntu.com/security/notices/USN-7089-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Use of uninitialized resource

EUVDB-ID: #VU95028

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42225

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mt7915_mcu_add_nested_subtlv() function in drivers/net/wireless/mediatek/mt76/mt7915/mcu.c, within the mt76_connac_mcu_add_nested_tlv(), mt76_connac_mcu_hw_scan(), mt76_connac_mcu_sched_scan_req(), mt76_connac_mcu_update_gtk_rekey() and mt76_connac_mcu_set_wow_pattern() functions in drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c. A local user can perform a denial of service (DoS) attack.

Update the affected package linux to the latest version.

Ubuntu: 22.04 - 24.04

linux-image-virtual-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04d (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04c (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04b (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04a (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-oem-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-generic-64k-hwe-22.04 (Ubuntu package): before 6.8.0-48.48~22.04.1

linux-image-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-gcp (Ubuntu package): before 6.8.0-1017.19~22.04.1

linux-image-6.8.0-1017-azure-fde (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-6.8.0-1017-azure (Ubuntu package): before 6.8.0-1017.20~22.04.1

linux-image-virtual-hwe-24.04 (Ubuntu package): before 6.8.0-48.48

linux-image-virtual (Ubuntu package): before 6.8.0-48.48