CVE-2024-26993Medium· 5.5▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the c…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
In the Linux kernel, the following vulnerability has been resolved:
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released.
Fix the leak by adding an explicit kobject_put() call when kn is NULL.
linux_kernel >= 3.16.62, < 3.17linux_kernel >= 3.18.121, < 3.19linux_kernel >= 4.4.154, < 4.5linux_kernel >= 4.9.125, < 4.10linux_kernel >= 4.14.68, < 4.15linux_kernel >= 4.18.6, < 4.19linux_kernel >= 4.19, < 5.15.157linux_kernel >= 5.16, < 6.1.88linux_kernel >= 6.2, < 6.6.29linux_kernel >= 6.7, < 6.8.8linux_kernel = 6.9Upgrade past the affected range:
linux_kernel 6.8.8Connected by shared product, vendor, weakness, or advisory.
CVE-2021-44879Medium· 5.5In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL pointer dereference.
CVE-2021-4090High· 7.1An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel
CVE-2022-36280Medium· 6.3An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'
CVE-2022-36123High· 7.8The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss)
CVE-2022-34918High· 7.8An issue was discovered in the Linux kernel through 5.18.9
CVE-2022-32250High· 7.8net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.